English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Nearly all modern software suffers from bloat that negatively impacts itsperformance and security. To combat this problem, several automated techniqueshave been proposed to debloat software. A key metric used in many of theseworks to demonstrate improved security is code reuse gadget count reduction.The use of this metric is based on the prevailing idea that reducing the numberof gadgets available in a software package reduces its attack surface and makesmounting a gadget-based code reuse exploit such as return-oriented programming(ROP) more difficult for an attacker. In this paper, we challenge this idea andshow through a variety of realistic debloating scenarios the flaws inherent tothe gadget count reduction metric. Specifically, we demonstrate that softwaredebloating can achieve high gadget count reduction rates, yet fail to limit anattacker's ability to construct an exploit. Worse yet, in some scenarios highgadget count reduction rates conceal instances in which software debloatingmakes security worse by introducing new, useful gadgets. To address theseissues, we propose a set of four new metrics for measuring securityimprovements realized through software debloating that are quality-orientedrather than quantity-oriented. We show that these metrics can identify whendebloating negatively impacts security and be efficiently calculated using ourstatic binary analysis tool, the Gadget Set Analyzer. Finally, we demonstratethe utility of these metrics in two realistic case studies: iterativedebloating and debloater evaluation.

Is Less Really More? Why Reducing Code Reuse Gadget Counts via Software Debloating Doesn't Necessarily Indicate Improved Security