Workshop Program

All sessions will be held in the Empire Room unless otherwise noted.

The full papers published by USENIX for the workshop are available as a download or individually below to workshop registrants immediately and to everyone beginning June 28, 2013. Everyone can view the abstracts immediately. Copyright to the individual works is retained by the author[s]. There are some presentations in the program that do not include papers.

Download Paper Archives

Attendee Files 
HotSWUP '13 Papers ZIP

 

Friday, June 28, 2013

8:30 a.m.–9:00 a.m. Friday

Continental Breakfast

Market Street Foyer
9:00 a.m.–10:30 a.m. Friday

Keynote Address

Strategies for Updating at Scale at Adobe

Peleus Uhley, Platform Security Strategist, Adobe Systems, Inc.

Adobe's near ubiquitous product adoption requires the ability to update a significant population of the Internet. As a result, this presents many unique challenges in defining a comprehensive update strategy. Not only is it required that updates ship for both consumers and enterprises across multiple operating systems, devices, and browsers, it also often needs to be completed very quickly with as little friction as possible. This presentation will discuss Adobe's approach with software updates and the lessons learned in the process.

Adobe's near ubiquitous product adoption requires the ability to update a significant population of the Internet. As a result, this presents many unique challenges in defining a comprehensive update strategy. Not only is it required that updates ship for both consumers and enterprises across multiple operating systems, devices, and browsers, it also often needs to be completed very quickly with as little friction as possible. This presentation will discuss Adobe's approach with software updates and the lessons learned in the process.

Peleus Uhley is the Platform Security Strategist within Adobe's Secure Software Engineering Team (ASSET). His primary focus is advancing Adobe's Secure Product Lifecycle (SPLC) and assisting with incident response within Adobe platform technologies, including Flash Player, ColdFusion, and AIR. Prior to joining Adobe, Peleus started in the security industry as a developer for Anonymizer, Inc., and went on to be a security consultant for @stake and Symantec.

Available Media
10:30 a.m.–11:00 a.m. Friday

Break with Refreshments

Market Street Foyer
11:00 a.m.–12:30 p.m. Friday

Updates in Object-Oriented Languages

Rubah: Efficient, General-purpose Dynamic Software Updating for Java

Luís Pina, INESC-ID/Instituto Superior Técnico; Michael Hicks, University of Maryland, College Park

This paper presents Rubah, a new dynamic software updating (DSU) system for Java programs that works on stock JVMs. Rubah supports a large range of program changes (e.g., changes to the class hierarchy and updates to running methods), does not restrict important programming idioms (e.g., reflection), and, as shown by performance experiments using an updatable version of the H2 database management system, imposes low overhead on normal execution.

Available Media

Fine-grained Patches for Java Software Upgrades

Eduardo R. B. Marques, Faculdade de Ciências da Universidade de Lisboa

We present a novel methodology for deriving fine-grained patches of Java software. We consider an abstract-syntax tree (AST) representation of Java classes compiled to the Java Virtual Machine (JVM) format, and a difference analysis over the AST representation to derive patches. The AST representation defines an appropriate abstraction level for analyzing differences, yielding compact patches that correlate modularly to actual source code changes. The approach contrasts to other common, coarse-grained approaches, like plain binary differences, which may easily lead to disproportionately large patches. We present the main traits of the methodology, a prototype tool called aspa that implements it, and a case-study analysis on the use of aspa to derive patches for the Java 2 SE API. The case-study results illustrates that aspa patches have a significantly smaller size than patches derived by binary differencing tools.

Available Media
12:30 p.m.–2:00 p.m. Friday

FCW Luncheon

Market Street Foyer
2:00 p.m.–3:30 p.m. Friday

Updates for C and Embedded Systems

DynSec: On-the-fly Code Rewriting and Repair

Mathias Payer, ETH Zurich and University of California, Berkeley; Boris Bluntschli and Thomas R. Gross, ETH Zurich

Security patches protect an application from discovered vulnerabilities and should be applied as fast as possible. On the other hand, patching the application reduces the availability of the service due to the necessary restart. System administrators need to balance system availability with a potential compromise of system integrity. 

A dynamic software update mechanism applies security updates on the fly but does not protect from unknown vulnerabilities. Software-based fault isolation on the other hand uses a sandbox to protect the integrity of a system by detecting unpatched vulnerabilities but provides no mechanism to repair any vulnerabilities. 

This paper presents DynSec, a mechanism for on-the fly code rewriting and repair that dynamically applies security patches for unmodified binary applications. A sandbox protects the integrity of the system while the dynamic update mechanism increases the availability of the application. A prototype implementation that needs no a-priori cooperation from the application incurs a combined overhead of 11% on the SPEC CPU2006 benchmarks for the sandbox and the dynamic update mechanism.

Available Media

Lightweight Framework for Runtime Updating of C-Based Software in Embedded Systems

Simon Holmbacka, Turku Centre for Computer Science; Wictor Lund, Sébastien Lafond, and Johan Lilius, Åbo Akademi University

Software updates in embedded systems are typically performed by bringing the system to stop, replacing the software and restarting the system. This process can in certain cases be very time consuming and costly, which leads to less frequent software updates. In order to establish both long uptime and up-to-date software, the software must be updated during runtime. This paper presents a runtime updating framework for embedded systems capable of replacing parts of software without stopping the system. The framework is based on FreeRTOS and mechanisms have been added to dynamically link and re-link FreeRTOS tasks to the system during runtime. Our framework enables the programmer to easily create updatable software with simple annotations to the program. Experiments demonstrate the benefits of updating software during runtime with an acceptable overhead when transferring the application state.

Available Media
3:30 p.m.–4:00 p.m. Friday

Break with Refreshments

Market Street Foyer
4:00 p.m.–5:30 p.m. Friday

Other Updates

Prototyping DSU Techniques Using Python

Sébastien Martinez and Fabien Dagnat, Université Européenne de Bretagne, IRISA, Institut Mines-Télécom, and Télécom Bretagne; Jérémy Buisson, Université Européenne de Bretagne, IRISA and Écoles de St-Cyr Coëtquidan

This paper presents PyMoult, a Python library implementing various dynamic software update (DSU) mechanisms. This library aims to provide a prototyping platform for experimenting with DSU and to implement a vast choice of update mechanisms while allowing their combination and customization.

We selected different update mechanisms from the literature and implemented them in PyMoult. This paper focuses on how we implemented these mechanisms and discusses the cost of implementing DSU in Python.

Available Media