State of Attack Surface Elimination in a World Plagued by Vulnerable Software

State of Attack Surface Elimination in a World Plagued by Vulnerable Software

Speakers: Mayur, Goro

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=yGq2GKx0Ypc

Overview

In an era defined by an exponentially expanding threat landscape, the talk "State of Attack Surface Elimination in a World Plagued by Vulnerable Software" delivered by Mayur and Goro at VulnCon presents a critical examination of current vulnerability management paradigms and introduces a groundbreaking approach to effectively identify and mitigate security weaknesses. Mayur, leading both detection and mitigation teams at Qualys, and Goro, a key member of the mitigation team, bring a wealth of practical experience to address the systemic challenges organizations face in securing their digital assets.

The core of their presentation revolves around the limitations of traditional attack surface discovery and remediation methods, particularly in dealing with the sheer volume and complexity of modern vulnerabilities like Log4j and XZ. They propose Veda (Vulnerability Elimination through Deep Analysis), an innovative system designed to overcome these hurdles by performing deep, version-independent analysis of binaries. This talk is highly relevant for security professionals grappling with the ever-growing burden of vulnerability management, offering a fresh perspective on shifting from reactive patching to proactive attack surface elimination.

Background

▶ Watch: Introduction and core problem statement (0:00)

The speakers begin by defining attack surface broadly as anything quantifiable that can be targeted—devices, hardware, software, or even people. Once an attack surface is quantified and given an identifier, it becomes a vulnerability. The challenge, they highlight, lies in the fact that not all vulnerabilities or remediation workflows are equal. Organizations often prioritize fixes based on arbitrary severity scores (e.g., CVSS 5 and above), leaving lower-rated but potentially exploitable issues unaddressed. Furthermore, attack surface discovery scans vary widely; authenticated scans yield different results than remote scans, and many vulnerabilities lack a CVE (Common Vulnerabilities and Exposures) identifier entirely, making them invisible to traditional tools.

The scale of the problem is staggering. The number of new vulnerabilities discovered has grown exponentially since 1999, with over 40,000 CVEs reported by early 2024. This rapid increase makes it nearly impossible for security teams to keep pace. Iconic vulnerabilities like Log4j serve as stark reminders of the difficulty in detecting and mitigating issues within shared libraries, which can be embedded deep within applications or operating systems. Similarly, the XZ Utils supply chain vulnerability demonstrated how a minuscule change in a widely installed binary could create an enormous, insidious attack surface.

Compounding these issues are the varied ways software can be installed: via package managers, direct binary execution, or compilation from source code. Each method can introduce variability, making it difficult to consistently detect specific vulnerable versions. This "loss of visibility" directly impacts the Mean Time To Patch (MTTP) and Mean Time To Detect (MTTD), increasing them exponentially. Adding to this complexity are vendor delays in patching, or worse, End-of-Life (EOL) software for which no patches or support are available, leaving organizations exposed. These multifaceted challenges underscore the urgent need for a more robust and adaptable approach to vulnerability management, one that doesn't solely rely on vendor patches or superficial version checks.

Key Findings

▶ Watch: Challenges: Log4j and XZ supply chain examples (3:30)

The central finding of this talk is the development and efficacy of the Veda system, an innovative platform for Vulnerability Elimination through Deep Analysis. Veda represents a significant paradigm shift from traditional vulnerability management by moving beyond version-based or signature-based detection to a deep, code-level analysis of binaries. The key contribution is its ability to identify vulnerabilities directly within the code blocks of binaries, irrespective of their version, installation method, or packaging. This allows for the detection of vulnerabilities that would otherwise remain hidden from conventional tools, such as those embedded in repackaged applications (e.g., Log4j within an Electron app) or present in EOL software.

Veda achieves this through the synergistic application of two primary methods: feature extraction and deep learning with fine-tuned Large Language Models (LLMs). These methods enable a comprehensive understanding of a binary's behavior and structure, correlating internal code characteristics with known vulnerability patterns. The system's capacity to provide payload-agnostic mitigations directly at the attack surface level, rather than relying on specific exploit signatures, is another critical finding. This approach promises to significantly reduce an organization's overall risk posture by eliminating the exploitability of vulnerabilities, even in the absence of official vendor patches or for unsupported software.

Technical Deep Dive

▶ Watch: Introducing Veda: Vulnerability Elimination through Deep Analysis (6:40)

The Veda system, which stands for Vulnerability Elimination through Deep Analysis, employs a multi-pronged approach that combines advanced feature extraction with deep learning techniques to identify and mitigate vulnerabilities at a granular, binary level. The core idea is to move beyond superficial version checks and delve into the actual code to understand its security posture.

Feature Extraction Method

The first method involves feature extraction from binaries, both patched and vulnerable versions, serving as a comprehensive dataset. The system currently extracts over 1,300 distinct features. These features are not merely metadata but delve into the operational characteristics of the code. The process involves:

1. Data Collection: Information is gathered from diverse sources, including NVD (National Vulnerability Database), GitHub advisories, and Nuclei templates. This broad data set provides context on known vulnerabilities.
2. Vulnerability Information Correlation: The collected data is used to extract and correlate various vulnerability identifiers:

• CPE (Common Platform Enumeration): Identifies specific hardware, operating systems, and applications.
• CWE (Common Weakness Enumeration): If not explicitly available, Veda has the capability to infer and extract CWE information.
• CVSS (Common Vulnerability Scoring System) 2, 3, and 4: The system considers all versions of CVSS scores, acknowledging the nuances and differences in calculation, as highlighted by other research presented at the conference (e.g., the Korean CERT talk on CVSS 3 vs. 4). This multi-version approach ensures a comprehensive understanding of vulnerability severity.

1. Binary Code Analysis: This is where Veda truly shines. It extracts code blocks from the binaries and analyzes their low-level behavior. Key aspects include:

• Syscalls: Identifying the system calls made by the binary, which can indicate specific functionalities or potential misuse.
• Register Movements: Executing binaries in a controlled environment to observe how registers change during execution. For instance, a vulnerable binary might exhibit different register behavior in response to a ping compared to a non-vulnerable one.
• Metadata: Analyzing simple metadata like the presence and configuration of exploit mitigations such as ASLR (Address Space Layout Randomization), DEP (Data Execution Prevention), and CFG (Control Flow Guard).

1. Classifier Input: All extracted features—from vulnerability databases and binary analysis—are then fed into a trained classifier. This classifier learns to distinguish between vulnerable and non-vulnerable code blocks based on the intricate patterns identified.

Deep Learning Method

The second, complementary method leverages deep learning and Large Language Models (LLMs). This is an ongoing research area for the Qualys team, exploring different approaches to enhance accuracy and detection capabilities.

1. Auto Feature Extraction: Similar to the first method, it begins with automated feature extraction from both vulnerable and patched binaries to create a rich dataset for positive and negative cases.
2. Feature Labeling: Extracted features are labeled using comprehensive vulnerability information (CV, CWE, CVSS) to provide context for the LLM.
3. Binary Reverse Engineering and LLM Processing:

• The binary is reverse-engineered to identify individual code blocks (analogous to functions).
• These code blocks are then sent to a fine-tuned, offline LLM. The speakers emphasize using an offline LLM, running it internally, to address data privacy and security concerns, avoiding reliance on external API services.
• The LLM generates embeddings for these code blocks, which are high-dimensional vector representations capturing the semantic and structural meaning of the code.

1. Vector Database and Classification:

• These embeddings are then vectorized and labeled with their corresponding CV, CWE, and CVSS information.
• The labeled vectors are stored in a vector database, enabling efficient similarity searches and classification.
• The system then performs classification by comparing new binary embeddings against the database to identify known vulnerability patterns.

1. LLM Models and Training: The team has experimented with several LLMs, including Code Llama, Code Gen 2, and Mistral, observing varying levels of performance and accuracy. These models are trained using a supervised learning method. The training data includes:

• CISA KEV (Known Exploited Vulnerabilities) catalog: A critical source for real-world exploited vulnerabilities.
• Curated list of vulnerabilities: Collected by the Qualys Threat Research Unit, providing proprietary and highly relevant data.
• The speakers note that initial accuracy was low without this specialized training data, highlighting the importance of fine-tuning LLMs with security-specific contexts.

1. Contextual Analysis: A crucial aspect of the deep learning method is its focus on context. Vulnerabilities reside in code, and code has context. By analyzing code blocks directly, the system gains a deeper understanding of the vulnerability's nature, as opposed to relying solely on metadata. A simple buffer overflow example is provided to illustrate how Veda identifies vulnerable code: a small buffer being overflowed, a classic weakness that traditional tools might miss if the software version is unknown or the code is repackaged.

Both methods aim to map binaries to CPEs to identify specific vendors and then feed the reverse-engineered code blocks into their respective analysis pipelines, culminating in a classification result that pinpoints vulnerabilities with high confidence.

Demo / Proof of Concept

▶ Watch: Leveraging NVD, GitHub, and ML for vulnerability analysis (8:30)

The speakers presented two brief video demonstrations to illustrate the capabilities of the Veda system, showcasing both the feature extraction and deep learning methods in action. Due to logistical constraints, they could not provide a live demonstration of the full appliance but offered concise visual proofs of concept.

The first demo, related to the feature extraction method, involved comparing two Linux binaries: one vulnerable and one patched. The video showed the system analyzing these binaries, highlighting the differences in their assembly code. Crucially, Veda was able to identify CWE information with a high degree of confidence. The demonstration concluded by classifying the vulnerable binary as a variant of the Shellshock vulnerability with 100% confidence. This highlighted Veda's ability to pinpoint specific vulnerability types and their underlying weaknesses directly from binary analysis.

The second demo, illustrating the deep learning method, followed a similar format. It again presented information about the same set of vulnerable and patched Linux binaries. The video depicted the process of starting an MCP server (likely a component of their system for processing binaries), sending the data to their fine-tuned LLM, and subsequently receiving a classification result. Similar to the first demo, the LLM confidently identified the binary as vulnerable to Shellshock and its variants. This reinforced the system's capability to leverage advanced AI for precise vulnerability detection, even across different analytical approaches.

Both demonstrations effectively showcased Veda's core strength: the ability to analyze binaries directly, identify subtle differences, and classify vulnerabilities with high confidence, without relying on traditional version numbers or external vulnerability databases alone.

Defensive Implications

▶ Watch: Correlating MITRE KEV with binary code block analysis (10:00)

The Veda system and its associated mitigation strategies offer profound defensive implications, fundamentally reshaping how organizations can approach vulnerability management and attack surface reduction. The core concept revolves around elimination of the attack surface rather than merely patching specific vulnerabilities.

1. Version-Independent Detection and Mitigation: This is perhaps the most significant defensive advantage. Traditional security tools are heavily reliant on software versions, package manager metadata, and known CVEs. Veda breaks this dependency by analyzing the actual code within binaries. This means it can detect vulnerabilities in:

• Repackaged applications: As highlighted by the Log4j example, where a vulnerable library might be bundled within an Electron application or a custom Chrome build, making it invisible to standard scans.
• Custom or in-house developed binaries: Where no public CVEs or version numbers exist.
• EOL (End-of-Life) software: For which vendors no longer provide patches, leaving organizations with critical systems exposed. Veda provides a lifeline by allowing for mitigation without vendor support.

1. Comprehensive Vulnerability Mitigation: Veda's approach to mitigation is to apply small, stateless pieces of code or configuration changes that directly eliminate the exploitability of a vulnerability. These are not full software patches but targeted interventions.
2. Payload-Agnostic Mitigation: A key benefit is that these mitigations are payload-agnostic. Instead of defending against a specific exploit signature, Veda aims to cut off the entire attack surface. This means that even if new exploit techniques emerge for a known vulnerability, the applied mitigation can still be effective because it addresses the underlying weakness, not just the known attack vector. Examples could include registry changes or specific configuration modifications that prevent vulnerable code paths from being triggered.
3. Reduced Dependency on Software Updates: By providing internal mitigations, organizations can reduce their immediate reliance on vendor software updates. This is crucial for:

• Avoiding breaking changes: Updates can sometimes introduce instability or break compatibility with other systems.
• Cost savings: Eliminating the need to purchase new licenses or hardware for upgraded software versions, especially for EOL systems.
• Operational continuity: Providing a buffer period for organizations to plan and test updates thoroughly, rather than rushing deployments.

1. Proactive Risk Elimination: Veda shifts the defensive posture from a reactive "patch-and-pray" model to a proactive "risk eliminate" strategy. By identifying and mitigating vulnerabilities at the code level, organizations can prevent exploitation before a patch is even available or deployed. This is particularly valuable in fast-moving threat landscapes or for zero-day vulnerabilities.
2. Enhanced Visibility and Control: By understanding vulnerabilities directly within the binary code, security teams gain unprecedented visibility into their true attack surface, offering a deeper level of control over their security posture than what is possible with traditional, external scanning methods.

In essence, Veda empowers defenders to take control of their security fate, offering a robust mechanism to manage vulnerabilities in complex, heterogeneous, and often unsupported environments.

Key Takeaways

• Traditional vulnerability management methods are failing: The exponential growth of CVEs, complexity of shared libraries (e.g., Log4j), and varied software installation methods create significant blind spots for conventional version- and signature-based detection tools.
• Veda offers version-independent vulnerability detection: By performing deep analysis of binary code using both feature extraction and fine-tuned LLMs, Veda can identify vulnerabilities regardless of software version, package manager, or whether the application is repackaged (e.g., Log4j in Electron apps).
• Contextual code analysis is critical: Veda's approach emphasizes reverse engineering binaries to analyze code blocks and extract context, understanding how vulnerabilities manifest at the functional level rather than relying solely on abstract metadata.
• Payload-agnostic mitigations enhance defense: The system provides stateless, resource-light mitigations through small code or configuration changes that eliminate the attack surface itself, preventing exploitation irrespective of the specific attack payload.
• Addresses EOL software and patch delays: Veda provides a crucial solution for mitigating vulnerabilities in End-of-Life software or when vendor patches are delayed, reducing dependency on external updates and avoiding associated costs (e.g., new licenses, hardware).
• Shifts focus to proactive attack surface elimination: The methodology moves beyond reactive patching to a proactive strategy of eliminating the exploitability of vulnerabilities within the code, offering a more resilient security posture against evolving threats.

About the Speaker(s)

Mayur is a leader at Qualys, where he spearheads two critical teams. His first team is responsible for developing robust detections within the Qualys platform, ensuring that vulnerabilities are accurately identified across diverse environments. His second team focuses on mitigating these detected vulnerabilities, working to neutralize threats and reduce attack surfaces. Mayur's expertise spans both the identification and remediation aspects of security, providing a holistic understanding of vulnerability management challenges.

Goro is a colleague of Mayur and is an integral part of the Qualys team dedicated to writing mitigations. His work directly contributes to the practical solutions offered by the Veda system, focusing on developing the stateless code and configuration changes that eliminate attack surfaces. Goro's role is crucial in translating vulnerability insights into actionable defensive measures, making systems more resilient against exploitation.