[SPARTA - bodies.dissemination-committee] Paper Submission - CINI - Request for Acknowledgment

Dear All, As CINI (Italy) WP6.2 members, we are submitting a paper named "PROLEPSIS: Binary Analysis and Instrumentation of IoT Software for Control-Flow Integrity” to the IEEE International Conference on Electrical, Computer, Communications and Mechatronic Engineering (ICECCME) 2021. Authors and abstract of the paper are below. If accepted, we would like to have your consent to acknowledge SPARTA. Authors: Valentina FORTE, Nicolò MAUNERO, Paolo PRINETTO, Gianluca ROASCIO Abstract: Nowadays, the growing pervasiveness of digital components and their interconnection in the so-called Internet of Things, raises serious questions regarding security and integrity not only of the data exchanged, but also of the devices themselves and the software they run. Code-Reuse Attacks (CRA) are one of the most powerful binary attack paradigms, aiming to exploit memory vulnerabilities such as buffer overflows to force the application to execute an unintended sequence of instructions present in memory. To counter such a kind of attacks, ensuring the program's control-flow integrity (CFI) appears to be the most promising solution presented so far. A plethora of CFI implementations have been offered in the literature and by vendors, based on control-flow monitors located at the software level or even into hardware extensions. However, many proposed solutions opt for coarse-grained checks, or insert enforcement before all flow transfers. For software running on IoT platforms, where resources are usually limited, protections can increase the footprint in an unsustainable way. This paper presents PROLEPSIS, an automated binary code analysis tool for IoT applications written for ARM platforms. With an optimised search, the tool is able to identify only those executable point (control-flow instructions) that are really at risk of control-flow hijacking. Each recognised insecure point is instrumented according to a custom technique of choice, either based on a software or a hardware monitor, depending on the specific application needs. All the best, Gianluca Roascio -- *Gianluca ROASCIO* *CINI* - Laboratorio Nazionale Cybersecurity Sede di Torino c/o LINKS - Leading Innovation & Knowledge for Society Via Pier Carlo Boggio 61, I-10138 Torino TO - Italy Tel: +39 334 3762427 gianluca.roascio(a)consorzio-cini.it Skype: gianluca.roascio www.cybersecnatlab.it <http://www.consorzio-cini.it/>