You are here
Junfeng Yang, Ang Cui, Sal Stolfo, and Simha Sethumadhavan, Columbia University
Just as errors in sequential programs can lead to security exploits, errors in concurrent programs can lead to concurrency attacks. Questions such as whether these attacks are feasible and what characteristics they have remain largely unknown. In this paper, we present a preliminary study of concurrency attacks and the security implications of real world concurrency errors. Our study yields several interesting ﬁndings. For instance, we observe that the exploitability of a concurrency error depends on the duration of the timing window within which the error may occur. We further observe that attackers can increase this window through carefully crafted inputs. We also ﬁnd that four out of ﬁve commonly used sequential defenses become unsafe when applied to concurrent programs. Based on our ﬁndings, we propose new defense directions and ﬁxes to existing defenses.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.