论文标题
乌鸦：WebAssembly的代码多元化
CROW: Code Diversification for WebAssembly
论文作者
论文摘要
在过去的几年中，WebAssembly的采用迅速增加，因为它为程序执行提供了快速安全的模型。但是，WebAssembly并不能免除侧渠道攻击可以利用的漏洞。可以通过代码多元化解决的这类漏洞。在本文中，我们介绍了WebAssembly二进制文件多元化的第一个完全自动化的工作流程。我们提出了Crow，这是一种实现此工作流程的开源工具。我们评估了乌鸦在303 C计划中的功能，并研究了其在现实生活中的安全敏感程序中的用途：libsodium，一个加密库。总体而言，Crowis能够在303个（79％）小计划中产生不同的变体。此外，我们的实验表明，我们的方法和工具能够成功地使现成的加密软件（libsodium）多样化。
The adoption of WebAssembly has rapidly increased in the last few years as it provides a fast and safe model for program execution. However, WebAssembly is not exempt from vulnerabilities that could be exploited by side channels attacks. This class of vulnerabilities that can be addressed by code diversification. In this paper, we present the first fully automated workflow for the diversification of WebAssembly binaries. We present CROW, an open-source tool implementing this workflow. We evaluate CROW's capabilities on 303 C programs and study its use on a real-life security-sensitive program: libsodium, a cryptographic library. Overall, CROWis able to generate diverse variants for 239 out of 303,(79%) small programs. Furthermore, our experiments show that our approach and tool is able to successfully diversify off-the-shelf cryptographic software (libsodium).
