I'm a part-time assistant professor of system and software security and post-doctoral researcher at Ghent University (UGent), ELIS Department, Computer Systems Lab. This is my research-related page, I also have a personal homepage. From 2003 to 2007 I worked on my Master's degree in Computer Science (a 'licentiaat in de informatica'), and in June 2013 I received my PhD in Computer Science Engineering.
My research interests are multi-variant execution environments, program analyses for finding security issues in low-level code, timing-based side-channel attacks, software obfuscations, software diversity, and software security and systems security in general.
My research is about automatically making binary programs more secure (given different attack models). For example, I have worked on the compiler-level generation of binary code to output programs that are less vulnerable to timing-based side channel attacks, and on rewriting binary code at link-time to make it more resistant against patch-based attacks. I have also worked on other techniques to protect software against different types of attacks: Multi-Variant Execution Environments (MVEEs) to protect software against exploits, on finding bugs and security vulnerabilities in systems code bases (such as Linux, OpenSSL, etc.), anti-debugging techniques to delay some forms of reverse engineering, etc.
Finding bugs and vulnerabilities. Code in large code bases often depends on implicit assumptions and rules to function correctly. For example, it is not always documented which locks protect which shared resources, or which specific return values are considered to be errors and which not. I am interested in automatically deducing such rules, and then (statically) finding violations against those (deduced) rules. For example, with ESSS (Error Specification through Structural Similarities) we first automatically deduce what the error specifications are for functions (without needing to depend on any application-specific a priori knowledge), and then we find code locations where error checks are either missing or inconsistent with those specifications.
Multi-Variant Execution. Legacy code bases written in an unsafe language, will contain vulnerabilities which can be exploited in different ways. Multi-Variant Execution allows mitigating and preventing entire classes of exploits for these vulnerabilities. A monitor executes the same program multiple times (in parallel) on the same input. Rather than run these programs in an identical fashion, the multi-variant execution environment enforces structural diversity between the variants. This diversity is constructed in such a way that under normal inputs, all variants behave identically; but when an attacker feeds malicious inputs to the program, the behavior of the variants diverges. The monitor detects this divergence, and halts the execution before malicious system calls are executed. Making multi-variant execution environments support larger classes of programs while keeping the overhead small is an active research topic. In our group we work on improving the ReMon Multi-Variant Execution Environment.
Protection against patch-based attacks. The problem of patch-based attacks is that of Patch Tuesday/Exploit Wednesday. Here a security update is released, after which hackers try to find the vulnerability in the unpatched program by analyzing the difference between the original version of the program and the patched version. If this can be done fast enough, attackers can exploit this vulnerability with the mass of users that has not yet applied this patch. Applying software diversity increases the effort for attacker to find the original vulnerability, thus increasing the time window in which a user running unpatched code is safe from such exploitation. I try to mitigate these using software diversity. This is a technique where an application instance is transformed into syntactically different, but semantically equivalent instance. I do this at link time using the binary link time rewriting framework Diablo.
Protection against side-channel attacks. Differences in the execution time of a program can give an attacker additional information on the internal state of a cryptographic algorithm, potentially leading to the compromise of secret information. I researched mitigating side-channels on modern x86 processors. I worked on a compiler-based toolflow to apply if-conversion to cryptographical code in order to eliminate control-flow related side-channels. Furthermore, using the division instruction as an example of a variable-latency instruction on the x86 architecture, I evaluated different techniques to mitigate data-flow related timing side-channels.
I am involved in the following courses as a lecturer:
I also assist in the (computer) labs of the following courses:
My personal email address is kde @ bartcoppens.be
.
My university email address is Bart.Coppens @ UGent.be
.
My PGP key fingerprint is 1540 BAC4 779C EACB 5212 A959 6516 95B0 5F29 CF10 (also available on keybase.io).
Being social, Mastodon or Facebook.
My LinkedIn profile.
My Orcid profile.
My DBLP profile.