Filter-resistant code injection on ARM

Code injection attacks are one of the most powerful and important classes of attacks on software. In these attacks, the attacker sends malicious input to a software application, where it is stored in memory. The malicious input is chosen in such a way that its representation in memory is also a valid representation of a machine code program that performs actions chosen by the attacker. The attacker then triggers a bug in the application to divert the control flow to this injected machine code. A typical action of the injected code is to launch a command interpreter shell, and hence the malicious input is often called shellcode. Attacks are usually performed against network facing applications, and such applications often perform validations or encodings on input. Hence, a typical hurdle for attackers, is that the shellcode has to pass one or more filtering methods before it is stored in the vulnerable application??s memory space. Clearly, for a code injection attack to succeed, the malicious input must survive such validations and transformations. Alphanumeric input (consisting only of letters and digits) is typically very robust for this purpose: it passes most filters and is untouched by most transformations. This paper studies the power of alphanumeric shellcode on the ARM architecture. It shows that the subset of ARM machine code programs that (when interpreted as data) consist only of alphanumerical characters is a Turing complete subset. This is a non-trivial result, as the number of instructions that consist only of alphanumeric characters is very limited. To craft useful exploit code (and to achieve Turing completeness), several tricks are needed, including the use of self-modifying code.     

Automatic verification of Java programs with dynamic frames

Framing in the presence of data abstraction is a challenging and important problem in the verification of object-oriented programs Leavens et al. (Formal Aspects Comput (FACS) 19:159–189, 2007). The dynamic frames approach is a promising solution to this problem. However, the approach is formalized in the context of an idealized logical framework. In particular, it is not clear the solution is suitable for use within a program verifier for a Java-like language based on verification condition generation and automated, first-order theorem proving. In this paper, we demonstrate that the dynamic frames approach can be integrated into an automatic verifier based on verification condition generation and automated theorem proving. The approach has been proven sound and has been implemented in a verifier prototype. The prototype has been used to prove correctness of several programming patterns considered challenging in related work.     

A Difference Reference Voltage Buffer for ΔΣ-Converters

An open loop architecture for a reference voltage buffer in -converters is presented to achieve fast-settling, since the settling time of the references plays an important role in the global performance of sampled data converters. This design has been tested on a 2-1 -converter with an on-chip bandgap reference increasing the input related dynamic range up to 93.4 dB for a bandwidth of 99 kHz.     

Characterization of coagulase-negative staphylococcus species from cows’ milk and environment based on bap,icaA,and mecA genes and phenotypic susceptibility to antimicrobials and teat dips

The aim of this study was to investigate whether the main coagulase-negative staphylococci (CNS) species involved in bovine intramammary infections (IMI) possess specific characteristics that promote colonization of the udder. Virulence markers associated with biofilm formation, antimicrobial resistance, and biocide tolerance were compared between typically contagious CNS species (Staphylococcus chromogenes, Staphylococcus epidermidis, Staphylococcus haemolyticus, and Staphylococcus simulans) and those rarely causing IMI (Staphylococcus sciuri, Staphylococcus equorum, and others) to find possible associations with pathogenicity. Coagulase-negative staphylococci isolates (n = 366) belonging to 22 different species were analyzed by PCR for the presence of the biofilm-associated genes bap and icaA, and the methicillin resistance gene mecA. A selection of 82 isolates was additionally tested for their susceptibility to 5 antibiotics and 2 commercial teat dip products. Minimum inhibitory concentrations of antimicrobials were determined by Etest (AB bioMérieux, Marcy l’Etoile, France), and a microdilution method was optimized to determine minimum biocidal concentrations of teat dips. The bap, icaA, and mecA genes were detected significantly more in isolates from CNS species typically living in the cows’ environment than in isolates from IMI-causing species. Antimicrobial resistance was mainly against erythromycin (23%) or oxacillin (16%), and was detected more often in the environmental species. The isolates least susceptible to the teat dips belonged to the IMI-causing species Staph. chromogenes and Staph. simulans. We concluded that carriage of biofilm genes and antimicrobial resistance were not associated with the ability to colonize the mammary gland because free-living CNS species constituted a more significant reservoir of biofilm and resistance determinants than did IMI-causing species. In contrast, increased tolerance to biocides may favor the establishment of bovine IMI by some CNS species.     

A high-voltage output driver in a 2.5-V 0.25-/spl mu/m CMOS technology

The design of a high-voltage output driver in a digital 0.25-/spl mu/m 2.5-V technology is presented. The use of stacked devices with a self-biased cascode topology allows the driver to operate at three times the nominal supply voltage. Oxide stress and hot carrier degradation is minimized since the driver operates within the voltage limits imposed by the design rules of a mainstream CMOS technology. The proposed high-voltage architecture uses a switching output stage. The realized prototype delivers an output swing of 6.46 V to a 50-/spl Omega/ load with a 7.5-V supply and an input square wave of 10 MHz. A PWM signal with a dual-tone sinusoid at 70 kHz and 250 kHz results in an IM3 of -65 dB and an IM2 of -67 dB. The on-resistance is 5.9 /spl Omega/.     

Security enforcement aware software development

In the domain of security policy enforcement, the concerns of application developers are almost completely ignored. As a consequence, it is hard to develop useful and reliable applications that will function properly under a variety of policies. This paper addresses this issue for application security policies specified as security automata, and enforced through run-time monitoring. Our solution consists of three elements: the definition of an abstract interface to the policy that is being enforced, a sound construct to query that policy, and a static verification algorithm that guarantees absence of security policy violations in critical blocks of code.     

A Simple Sequential Reasoning Approach for Sound Modular Verification of Mainstream Multithreaded Programs

Reasoning about multithreaded object-oriented programs is difficult, due to the non-local nature of object aliasing, data races, and deadlocks. We propose a programming model that prevents data races and deadlocks, and supports local reasoning in the presence of object aliasing and concurrency. Our programming model builds on the multi-threading and synchronization primitives as they are present in current mainstream languages. Java or C# programs developed according to our model can be annotated by means of stylized comments to make the use of the model explicit. We show that such annotated programs can be formally verified to comply with the programming model. In other words, if the annotated program verifies, the underlying Java or C# program is guaranteed to be free from data races and deadlocks, and it is sound to reason locally about program behavior. Our approach supports immutable objects as well as static fields and static initializers. We have implemented a verifier for programs developed according to our model in a custom build of the Spec# programming system, and have validated our approach on a case study.     

Algorithm 32 automatic computation of integrals with singular integrand,over a finite or an infinite range

A numerical quadrature algorithm is developed, for integrands which may exhibit some kind of singular behaviour within the finite of infinite integration range. Using the automatical FORTRAN IV integration program, one should provide the abscissae the function is not “smooth” at. The quadrature formula has been obtained by applying the trapezoidal rule after transformation of the integrand. Standing severe tests which were based on the test functions of Casaletto et al. and on Kahaner's sample set, the integration scheme turned out to be of a remarkable reliability, efficiency and accuracy.