Lava : Large-scale Automated Vulnerability Addition

Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora (i.e., software that has known bugs with triggering inputs). LAVA attempts to solve this problem by automatically injecting bugs into software.

Every LAVA bug is accompanied by an input that triggers it whereas normal inputs are extremely unlikely to do so. These vulnerabilities are synthetic but, we argue, still realistic, in the sense that they are embedded deep within programs and are triggered by real inputs.

Our work forms the basis of an approach for generating large ground-truth vulnerability corpora on demand, enabling rigorous tool evaluation and providing a high-quality target for tool developers.

It is the product of a collaboration between MIT Lincoln Laboratory, NYU, and Northeastern University.

Also Read – LNAV : Log File Navigator 2020

Quick Start

On a system running Ubuntu 16.04, you should be able to just run python2 setup.py. Note that this install script will install packages and make changes to your system. Once it finishes, you should have PANDA installed into panda/build/ (PANDA is used to perform dynamic taint analysis).

Next, run init-host.py to generate a host.json. This file is used by LAVA to store settings specific to your machine. You can edit these settings as necessary, but the default values should work.

Project configurations are located in the target_configs directory, where every configuration is located at target_configs/projectname/projectname.json. Paths specified within these configuration files are relative to values set in your host.json file.

Finally, you can run ./scripts/lava.sh to actually inject bugs into a program. Just provide the name of a project that is in the target_configs directory, for example:

./scripts/lava.sh toy

You should now have a buggy copy of toy!

If you want to inject bugs into a new target, you will likely need to make some modifications. Check out How-to-Lava for guidance.

Authors

LAVA is the result of several years of development by many people; a partial (alphabetical) list of contributors is below:

  • Andy Davis
  • Brendan Dolan-Gavitt
  • Andrew Fasano
  • Zhenghao Hu
  • Patrick Hulin
  • Amy Jiang
  • Engin Kirda
  • Tim Leek
  • Andrea Mambretti
  • Wil Robertson
  • Aaron Sedlacek
  • Rahul Sridhar
  • Frederick Ulrich
  • Ryan Whelan
R K

Recent Posts

Networking Devices 101: Understanding Routers, Switches, Hubs, and More

What is Networking? Networking brings together devices like computers, servers, routers, and switches so they…

24 minutes ago

Sock Puppets in OSINT: How to Build and Use Research Accounts

Introduction In the world of Open Source Intelligence (OSINT), anonymity and operational security (OPSEC) are…

2 hours ago

What is SIEM? Complete Guide to Security Information and Event Management

Introduction As cyber threats grow more sophisticated, organizations need more than just firewalls and antivirus…

12 hours ago

Website OSINT: Tools and Techniques for Reconnaissance

Introduction When it comes to cybersecurity and ethical hacking, one of the most effective ways…

23 hours ago

Top OSINT Tools to Find Emails, Usernames and Passwords

Introduction In the world of cybersecurity, knowledge is power. One of the most powerful skillsets…

2 days ago

Google Dorking in Cybersecurity: A Complete Guide

Introduction In the vast ocean of the internet, the most powerful tool you already have…

2 days ago