cid dda1b99cd13223084456ee57a6b3d4efb5c89ac0d223c96a82f24c730f78c90e · original · open access · via openalex
Title: CROW: Code Diversification for WebAssembly Authors: Javier Cabrera-Arteaga; Orestis Floros; Oscar Luis Vera Pérez; Benoît Baudry; Martin Monperrus Venue: Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb) Year: 2021 Canonical: doi:10.14722/madweb.2021.23004 URL: https://doi.org/10.14722/madweb.2021.23004 Collector: openalex OA: true ABSTRACT The adoption of WebAssembly increases rapidly, as it provides a fast and safe model for program execution in the browser.However, WebAssembly is not exempt from vulnerabilities that can be exploited by malicious observers.Code diversification can mitigate some of these attacks.In this paper, we present the first fully automated workflow for the diversification of WebAssembly binaries.We present CROW, an open-source tool implementing this workflow through enumerative synthesis of diverse code snippets expressed in the LLVM intermediate representation.We evaluate CROW's capabilities on 303 C programs and study its use on a real-life securitysensitive program: libsodium, a modern cryptographic library.Overall, CROW is able to generate diverse variants for 239 out of 303 (79%) small programs.Furthermore, our experiments show that our approach and tool is able to successfully diversify offthe-shelf cryptographic software (libsodium).