Date: Wednesday October 14th
Location: Campus Cyber (5-7 rue Bellini, La Défense, Metro 1 Station “Esplanade de la Défense”)
The room for the presentation will be at the Inria floor (3rd floor), in the GATE 5 meeting room.
Provenance supports security monitoring and forensics by capturing causal relationships between system objects and representing them as provenance graphs. On Linux, eBPF has become the preferred capture means for provenance, yet three fundamental design choices remain unsettled: i) Where to capture in the kernel execution flow; ii) What kernel hooks to instru- ment; and iii) How to model captured objects as graph nodes. We show that these choices impact the portability, robustness, performance, and utility of provenance capture systems. We also find that existing approaches either produce unsound graphs or cannot uniquely identify kernel objects without a patched kernel. Thus, we propose RECAP, an eBPF-based capture system that addresses all three choices: i) Where: the Linux Security Module (LSM) interface provides the most suitable capture location; ii) What: 43 LSM hooks specifically selected for security-oriented use cases, whereas existing capture systems capture too much or too little; and iii) How: objects are versioned only on modification and uniquely identified without a patched kernel. Compared to state-of-the-art LSM-based systems, RECAP produces sound and 11–20× more concise graphs, yielding on average 3–13× better detection performance with Provenance-based Intrusion Detection Systems (PIDS) and 4× better with signature-based forensics, while significantly reducing data loss and imposing similar or lower overhead. To support these claims, we provide a dataset of provenance graphs captured by RECAP and the capture systems we used for comparison, spanning benign and malicious scenarios
Reproducing software vulnerabilities is fundamental to security researchers, open-source maintainers, and educators. Yet, vulnerabilities remain hard to reproduce today, and even when they can be reproduced, recreating a software environment where the vulnerability can be exploited becomes harder and harder over time. We present NICE, the NIx CvE reproduction framework, which uses declarative recipes to build and automatically validate vulnerable environments. In NICE, a reproduced CVE comprises one or more NixOS virtual machine configurations, a scripted exploitation scenario, and machine-checkable assertions that provide factual evidence of exploitation. This design facilitates sharing, validation, review, and long-term reproducibility. We evaluate NICE on 19 diverse real-world CVEs spanning multiple CWE categories, attack vectors, and target types (user-space, system software, kernel, and graphical applications). We show that NICE allows to produce concise recipes and integration tests that reproduce vulnerable environments and provide proofs of exploitation. NICE is applicable to security education and training (e.g., creating cyber ranges), but also to vulnerability reporting, where its reproducibility and reviewability properties can make reports easier to audit and verify.
TBD