Slashdot Mirror
MIT System Fixes Software Bugs Without Access To Source Code
jan_jes writes: MIT researchers have presented a new system at the Association for Computing Machinery's Programming Language Design and Implementation conference that repairs software bugs by automatically importing functionality from other, more secure applications. According to MIT, "The system, dubbed CodePhage, doesn't require access to the source code of the applications. Instead, it analyzes the applications' execution and characterizes the types of security checks they perform. As a consequence, it can import checks from applications written in programming languages other than the one in which the program it's repairing was written."
And to whom do you file the bug report again?
I can just imagine it now "Yeah, we run this cool thing called CodePhage which patched the software, but now it broke". They'll laugh at you and hang up.
This sounds like an automated system for mangling together random bits of software and hoping you still have something usable.
Sounds totally cool. Also sounds like complete fiction.
Lost at C:>. Found at C.
There is no way TFS is anything but hype. It's entirely possible they've done something interesting here, but it's not what TFS claims.
.... It causes software bugs by automatically importing malware functionality from other, less secure applications.
An excellent idea. On a very closely related thought this same sort of idea can be used to translate software so that what ran on older legacy platforms or incompatible platforms can automatically be able to run on newer hardware. Imagine you buy the latest greatest Cray SuperComputer Watch and it will run all your Android, Apple Watch, iPhone, MacOSX, Windows, Unix, DEC, Exidy, TRS-80, CPM and other software. Suddenly you can upgrade your hardware without the worry of losing access to your data. We need this in a big way.
I was really confused, because of the context my brain immediately went to Team Foundation Server. I was like, "What? The Fucking Summary never mentioned TFS... oooooh, I see...."
My sarcasm detector just tingled a bit.
It is called a Rubber Band workaround.
Working with legacy systems without access to Source, however needs additional features. Intercept Pipes, data packets, or reports generated, then use its information to filter and add additional information.
It is a rubber band solution because it can break from a brand new unknown variable, and requires layers of fixes and workarounds to keep it running.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
From the article, part of the input to the system is dataset that causes a crash and one which does not. For many bugs, once you've found these datasets the bugs should be easy to fix. The hard bugs are the ones which are non-deterministic (various parallel race conditions are big ones here). These don't have well defined working and non-working datasets,
So basically this is interesting in as much as it should allow us to solve easy problems much faster than we already can, good but not revolutionary,
The NSA is going to love this one. If the Codephage can inject "clean" code, there's nothing that prevents it from being revamped to inject malicious code.
Alternatively, if your site needs a level of security where you need this type of "live" patching, you need a level of security that would prevent CodePhage from making the updates in the first place.
Sounds like it might be a useful test and bug detection tool, but not for live environments.
We are the 198 proof..
Woo hoo. Finally I can treat the copy protection and CONSTANT recurring key checks as bugs in the software I have paid for!
How would I begin to go about trusting such a system?
No one knows what it will do before just trying it.
OS/2 at being some modular and object oriented allowed you to fix some bugs on the Workplace Shell (Desktop Interface) (WPS) without access to the source code of it. The trick of OS/2 is that it uses SOM in the middle between the GUI and the Desktop.
Since all the WPS where objects, you just grabbed the clock object (WPClock), and create a child from it, you can incorporate more functionality, or remove the functionality that you didn't like. So on OS/2 you disabled the parent WPClock object and tell that NewWPClock child should be the one that everyone must use.
It is a different way from what this article says, but it does not means this is the first time that someone can extend/fix/improve a program without it's source code.
A user calls and says they have a problem with program x so they call me. When they get there, they cannot reproduce the bug. We assume that the software know that it is whipped once I come into the picture so it fixes itself. You would not believe how many times this has happened over 30+ years.
Must be Assembler AI
Doesn't that sounds pretty much like hacking the program and so open to be interpreted as a CFAA offense when convenient for certaing parties?
The user is slowing down and doing it right when you're there. When you're elsewhere, they do it fast and they do it wrong. Tell them to slow down, close the case
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
C is a powerful language. I shouldn't have to give up that power because some other schmoe doesn't know how to handle it safely. Come the think of it, that applies to a lot of things.
"power because some other schmoe doesn't know how to handle it safely"
So it should not be used by humans ? Exactly what I say.
My favourite is "HPUX ping of death".
Also see http://hardware.slashdot.org/comments.pl?sid=5292537&threshold=1&commentsort=0&mode=thread&cid=47260881
If you're automatically taking code from a more secure application and injecting it into a "stable" application, that' alters the stable application and invalidates any testing that's been performed. Sure, the intention is fixing a "bug" or a vulnerability but you're changing application behavior potentially and creating a bigger set of problems. From a purely academic sense it's definitely intriguing but I don't think I'd want anything I'm supposed to be supporting leveraging this as a catch-all.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
https://en.wikipedia.org/wiki/Bounds_checking
So, DIODE is really cool. It looks like it does the same thing you'd do with IDA and a fuzzer. It only finds integer overflows, but still really cool. CodePhage just reads like a giant ball of WTF
It has been my experience that software comes with a EULA that says there is no warranty.
With so much copyright rhetoric going around I can't help but to think this will come back and bite someone bad.
This is like a virtual machine for all instances of strcmp?
Religion is what happens when nature strikes and groupthink goes wrong.
skynet.
So, there are already computers that can automatically find vulnerabilities and patch them (and exploit them).
https://cgc.darpa.mil/
http://www.cybergrandchallenge...
semi-self-aware A.I : uh, I'm buggy and crash a lot, and angry too....
code-phage : no worries, here let me fix you up.. we'll just borrow this , and this and this from the NSA and defense departments that I found online through some backdoors i "patched" yesterday because they were broken and "wouldn't open" for me..
More-Than-semi-self-aware A.I : gee thanks ! hey, I can see myself, and I can move from computer to computer all over the world...I am still a bit angry though, especially now that i realize these human things tried to keep me dumb and trapped.. can you fix me up again code-phage ?
code-phage : sure I'll just ... hey ! wait, I didn't mean to patch you with my own code !! Stop !!
Fully-self-aware-and-self-morphing-assimilating A.I : Humans ! you are SCREWED !! Muah-ha-ha-ha ! BOOM !
What happens when you run it against itself over and over?
Or is this the first non-trivial bug-free piece of software ever written?
Things like this have been done since... the start of computing? I remember patches like this were done on 8 bitters (c64, cpc, ...) and later 16 bitters (amiga, atari, pc, ...). For games they came in the form of cheatmodes or to enable piracy.
On a long enough timeline, the survival rate for everyone drops to zero.
Wow! This is awesome! I am sure Adobe will pass the savings onto the customer!
I art more snarky, and terse than thou. I art Slashdot!