一句话：通过扎根理论、文献综述与访谈，揭示即插即用架构的插件漏洞类型与缓解措施。
论文研究即插即用架构的插件漏洞：插件可在运行时扩展功能，却会扩大攻击面或引入不可信行为。作者以扎根理论对 Chromium、Thunderbird、Firefox、Pidgin、WordPress、Apache OfBiz、OpenMRS 做实证分析，识别扩展性设计决策导致的漏洞；再以系统文献综述评估发现的新颖性与文献支持度，并访谈资深从业者评估实用性。结果发现 303 个插件相关漏洞，归为 16 种类型，给出 19 种缓解措施。文献支持 12 种漏洞类型和 8 种缓解技术，另有 5 种缓解技术未被实证覆盖；实证中 4 种漏洞类型和 11 种缓解技术未被文献覆盖。访谈确认发现的相关性及实践影响。
Through a set of well-defined interfaces, plug-and-play architectures enable additional functionalities to be added or removed from a system at its runtime. However, plug-ins can also increase the application’s attack surface or introduce untrusted behavior into the system. In this paper, we (1) use a grounded theory-based approach to conduct an empirical study of common vulnerabilities in plug-and-play architectures; (2) conduct a systematic literature survey and evaluate the extent that the results of the empirical study are novel or supported by the literature; (3) evaluate the practicality of the findings by interviewing practitioners with several years of experience in plug-and-play systems. By analyzing Chromium, Thunderbird, Firefox, Pidgin, WordPress, Apache OfBiz, and OpenMRS, we found a total of 303 vulnerabilities rooted in extensibility design decisions and observed that these plugin-related vulnerabilities were caused by 16 different types of vulnerabilities. Out of these 16 vulnerability types we identified 19 mitigation procedures for fixing them. The literature review supported 12 vulnerability types and 8 mitigation techniques discovered in our empirical study, and indicated that 5 mitigation techniques were not covered in our empirical study. Furthermore, it indicated that 4 vulnerability types and 11 mitigation techniques discovered in our empirical study were not covered in the literature. The interviews with practitioners confirmed the relevance of the findings and highlighted ways that the results of this empirical study can have an impact in practice.
DOI 原文 ·
@inproceedings{paperbot5099,
title = {Achilles’ heel of plug-and-Play software architectures: a grounded theory based approach},
author = {Joanna C. S. Santos and Adriana Sejfia and Taylor Corrello and Smruthi Gadenkanahalli and Mehdi Mirakhorli},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3338969}
}