Shangzhi Xu (The University of New South Wales), Jialiang Dong (The University of New South Wales), Weiting Cai (Delft University of Technology), Juanru Li (Feiyu Tech), Arash Shaghaghi (The University of New South Wales), Nan Sun (The University of New South Wales), Siqi Ma (The University of New South Wales)

Nowadays, software development progresses
rapidly to incorporate new features. To facilitate such growth
and provide convenience for developers when creating and
updating software, reusing open-source software (i.e., thirdparty
library reuses) has become one of the most effective
and efficient methods. Unfortunately, the practice of reusing
third-party libraries (TPLs) can also introduce vulnerabilities
(known as 1-day vulnerabilities) because of the low maintenance
of TPLs, resulting in many vulnerable versions remaining in
use. If the software incorporating these TPLs fails to detect the
introduced vulnerabilities and leads to delayed updates, it will
exacerbate the security risks. However, the complicated code
dependencies and flexibility of TPL reuses make the detection of
1-day vulnerability a challenging task. To support developers in
securely reusing TPLs during software development, we design
and implement VULTURE, an effective and efficient detection
tool, aiming at identifying 1-day vulnerabilities that arise from
the reuse of vulnerable TPLs. It first executes a database creation
method, TPLFILTER, which leverages the Large Language
Model (LLM) to automatically build a unique database for the
targeted platform. Instead of relying on code-level similarity
comparison, VULTURE employs hashing-based comparison to
explore the dependencies among the collected TPLs and identify
the similarities between the TPLs and the target projects.
Recognizing that developers have the flexibility to reuse TPLs
exactly or in a custom manner, VULTURE separately conducts
version-based comparison and chunk-based analysis to capture
fine-grained semantic features at the function levels. We applied
VULTURE to 10 real-world projects to assess its effectiveness
and efficiency in detecting 1-day vulnerabilities. VULTURE
successfully identified 175 vulnerabilities from 178 reused TPLs.

View More Papers

URVFL: Undetectable Data Reconstruction Attack on Vertical Federated Learning

Duanyi Yao (Hong Kong University of Science and Technology), Songze Li (Southeast University), Xueluan Gong (Wuhan University), Sizai Hou (Hong Kong University of Science and Technology), Gaoning Pan (Hangzhou Dianzi University)

Read More

Distributed Function Secret Sharing and Applications

Pengzhi Xing (University of Electronic Science and Technology of China), Hongwei Li (University of Electronic Science and Technology of China), Meng Hao (Singapore Management University), Hanxiao Chen (University of Electronic Science and Technology of China), Jia Hu (University of Electronic Science and Technology of China), Dongxiao Liu (University of Electronic Science and Technology of China)

Read More

SCRUTINIZER: Towards Secure Forensics on Compromised TrustZone

Yiming Zhang (Southern University of Science and Technology and The Hong Kong Polytechnic University), Fengwei Zhang (Southern University of Science and Technology), Xiapu Luo (The Hong Kong Polytechnic University), Rui Hou (Institute of Information Engineering, Chinese Academy of Sciences), Xuhua Ding (Singapore Management University), Zhenkai Liang (National University of Singapore), Shoumeng Yan (Ant Group), Tao…

Read More

A Large-Scale Measurement Study of the PROXY Protocol and...

Stijn Pletinckx (University of California, Santa Barbara), Christopher Kruegel (University of California, Santa Barbara), Giovanni Vigna (University of California, Santa Barbara)

Read More