11/11/2022
You may not have heard of them, but they play an important role in the hacking of programs: Out-of-bounds writes. These can be used to trick a program into accessing memory at certain locations where that should not be possible. From changing account balances in banking software to breaking into critical systems at hospitals, there are many malicious applications. For his master’s thesis, Linus Hafkemeyer developed a tool making it much easier to assess the severity of such vulnerabilities, speeding up the process of fixing them and, ultimately, leading to a more secure digital society. For this, he earned the title of of the faculty of Electrical Engineering, Mathematics & Computer Science.
His supervisor, professor Andrea Continella, is very impressed by his thesis work, calling it a novel and important approach that has very practical implications in the real world. ‘It will speed up the process of fixing these out-of-bound writes security vulnerabilities, leading to more secure programs.’
‘The problem with existing out-of-bounds write detection solutions is that they are invasive; they need to add some code to a program to facilitate detection,’ Hafkemeyer says. ‘But then, when observing program behaviour with the added code, it will differ from how the original, unaltered program would perform, making any output worthless for triaging.’ He designed an approach where no modification in the programme is needed while still fully capable of observing its behaviour without any unwanted effects.
Together with his supervisor, he is now preparing to submit the approach for publication at a well-known cybersecurity conference, expecting quite some interest from security companies and software developers.
Read more about his work here: https://www.tudelft.nl/en/stories/articles/out-of-bounds-an-outside-view-of-computer-memory-vulnerabilities
