ICACT20210212 Question.1
Questioner: wsub@korea.ac.kr 2021-02-09 오후 4:13:49 |
ICACT20210212 Answer.1
Answer by Auhor hjcho1@korea.ac.kr 2021-02-09 오후 4:13:49
Chrome  Click!! |
| Great work. Eventually, when all alarms occur in view of security and reliability Are you insisting that developers and test engineers need to modify the code? I think it is inefficient to modify the code for every alarm. What do you think of my opinion? Thanks. |
Thank you for your question. Yes, it is. You might think it is inefficient to fix the code for every alarm generated by a static analysis tool. Still, later weaknesses become vulnerabilities, and the code could be more expensive to fix. Therefore, we must remove all defects and create software that satisfies reliability and security. |
ICACT20210212 Question.2
Questioner: nguyen@dsp.cse.kyutech.ac.jp 2021-02-09 오후 4:13:02 |
ICACT20210212 Answer.2
Answer by Auhor hjcho1@korea.ac.kr 2021-02-09 오후 4:13:02
Chrome Click!! |
| It's an interesting topic. However, I confuse about the conclusion that there is no need to determine whether an integer overflow is a true positive or false positive. But this determination is necessary to evaluate the warning. If there is only a need to fix the code, is it enough to avoid all cases of the attack? |
Thank you for your question. Static analysis tool users view alarms and distinguish between true and false positives for many reasons. The tool may have made a mistake, or the properties they want to check may be different. However, it takes a lot of effort and time to judge true and false positives. We experimented with the integer overflow that occurred in the static analysis tool. Many papers evaluate the tool's performance and alarm, but we argue that it is unnecessary for integer overflows. We don't think all attack cases can be avoided by simply modifying the code. However, we believe developers can reduce the possible attack vectors and make the software more reliable and secure. |
ICACT20210212 Question.3
Questioner: nguyen@dsp.cse.kyutech.ac.jp 2021-02-09 오후 4:13:13 |
ICACT20210212 Answer.3
Answer by Auhor hjcho1@korea.ac.kr 2021-02-09 오후 4:13:13
Chrome Click!! |
| What are the INT_MAX value in case 2 and case 4? What does this number mean when is used to evaluate the potential integer overflow? |
Thank you for your question. INT_MAX is any large value. The first and last variables defined in the specification have different ranges depending on N's value. The example code we experimented with uses the int data type, so if the first and last variables are greater than INT_MAX/2, an integer overflow occurs. |
ICACT20210212 Question.4
Questioner: James_Lan@htx.gov.sg 2021-02-09 오후 4:13:23 |
ICACT20210212 Answer.4
Answer by Auhor hjcho1@korea.ac.kr 2021-02-09 오후 4:13:23
Chrome Click!! |
| Hi, thanks for the sharing.
What are your views for the applicable of the paper to binary reversing? That is, without source code. When reversing the binary, if static analysis generated integer overflow then there could a attacking vector to the binary?
Thanks |
Thank you for your question. My personal opinion is that weaknesses in development can lead to vulnerabilities after software release. When performing binary reversing, you can refer to the alarm generated by the static analysis tool to find the attack vector and cause an integer overflow through injection. For example, the vulnerable memcpy function in the C language could be a static analysis alarm. |
