SaTC: CORE: Medium: Securing WebAssembly using Static Analysis and Binary Instrumentation

WebAssembly is a web technology that has rapidly been gaining in popularity. It is a low-level bytecode format that was introduced in 2017, and was originally designed for computationally-intensive tasks in the browser such as cryptography and games. Today, as envisioned, WebAssembly is supported by all modern browsers, and heavily used by applications. Recently, a number of critical security concerns in WebAssembly binaries have been identified for which no adequate solutions exist. This project is concerned with the development of WASSY, a novel system and a comprehensive suite of tools for detecting and mitigating security vulnerabilities in applications that rely on WebAssembly. WASSY will rely on a combination of static analysis techniques, which analyze WebAssembly binaries without executing them, to detect likely vulnerabilities, and binary instrumentation techniques that rewrite a WebAssembly binary to mitigate potential vulnerabilities. The developed techniques will be evaluated on a suite of applications that rely on WebAssembly binaries and that contain vulnerabilities. The research will benefit users of web applications by reducing the number of vulnerabilities that can be exploited, thereby reducing the potential for loss of data, and associated financial and legal exposure. Results of the project will be disseminated via publications in scientific venues and through release of open-source software and data sets. Societal benefits will follow from improvements in web software security that is enabled by the adoption of the developed techniques. The developed static analysis techniques will be designed to accommodate several characteristics that are specific to WebAssembly such as its stack-based representation, lack of names and structure, lack of type information, and index-based access to linear memory and function tables. A family of flow-insensitive, flow-sensitive, and context-sensitive algorithms will be developed accordingly, using abstractions suitable to the domain, and designed to account for interaction with JavaScript code that executes in the host environment. The developed binary instrumentation techniques will be designed to counteract vulnerabilities that may arise in web applications that rely on WebAssembly binaries, such as injection vulnerabilities and cross-site scripting vulnerabilities. To this end, binary instrumentation will be used to implement suitable variations on classic security concepts such as stack canaries, memory segmentation, and address space randomization. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.