Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SoK: Analysis techniques for WebAssembly

Håkon Harnes, Donn Morrison

TL;DR

A systematic review of analysis techniques for WebAssembly binaries, focusing on vulnerability analysis, cryptojacking detection, and smart contract security reveals that static techniques are efficient but may struggle with complex binaries, while dynamic techniques offer better detection at the cost of increased overhead.

Abstract

WebAssembly is a low-level bytecode language that allows high-level languages like C, C++, and Rust to be executed in the browser at near-native performance. In recent years, WebAssembly has gained widespread adoption is now natively supported by all modern browsers. However, vulnerabilities in memory-unsafe languages, like C and C++, can translate into vulnerabilities in WebAssembly binaries. Unfortunately, most WebAssembly binaries are compiled from such memory-unsafe languages, and these vulnerabilities have been shown to be practical in real-world scenarios. WebAssembly smart contracts have also been found to be vulnerable, causing significant financial loss. Additionally, WebAssembly has been used for malicious purposes like cryptojacking. To address these issues, several analysis techniques for WebAssembly binaries have been proposed. In this paper, we conduct a comprehensive literature review of these techniques and categorize them based on their analysis strategy and objectives. Furthermore, we compare and evaluate the techniques using quantitative data, highlighting their strengths and weaknesses. In addition, one of the main contributions of this paper is the identification of future research directions based on the thorough literature review conducted.

SoK: Analysis techniques for WebAssembly

TL;DR

A systematic review of analysis techniques for WebAssembly binaries, focusing on vulnerability analysis, cryptojacking detection, and smart contract security reveals that static techniques are efficient but may struggle with complex binaries, while dynamic techniques offer better detection at the cost of increased overhead.

Abstract

WebAssembly is a low-level bytecode language that allows high-level languages like C, C++, and Rust to be executed in the browser at near-native performance. In recent years, WebAssembly has gained widespread adoption is now natively supported by all modern browsers. However, vulnerabilities in memory-unsafe languages, like C and C++, can translate into vulnerabilities in WebAssembly binaries. Unfortunately, most WebAssembly binaries are compiled from such memory-unsafe languages, and these vulnerabilities have been shown to be practical in real-world scenarios. WebAssembly smart contracts have also been found to be vulnerable, causing significant financial loss. Additionally, WebAssembly has been used for malicious purposes like cryptojacking. To address these issues, several analysis techniques for WebAssembly binaries have been proposed. In this paper, we conduct a comprehensive literature review of these techniques and categorize them based on their analysis strategy and objectives. Furthermore, we compare and evaluate the techniques using quantitative data, highlighting their strengths and weaknesses. In addition, one of the main contributions of this paper is the identification of future research directions based on the thorough literature review conducted.
Paper Structure (33 sections, 3 equations, 1 figure, 5 tables)

This paper contains 33 sections, 3 equations, 1 figure, 5 tables.

Table of Contents

  1. Introduction
  2. Background
  3. History
  4. WebAssembly
  5. Security
  6. Vulnerabilities
  7. Smart Contracts
  8. Cryptojacking
  9. Related Work
  10. Methodology
  11. Search Strategy
  12. Selection Process
  13. Data Extraction and Analysis
  14. Analysis Techniques for WebAssembly
  15. Detecting Malicious WebAssembly Binaries
  16. ...and 18 more sections

Figures (1)

  • Figure 1: WebAssembly serves as the intermediate bytecode bridging the gap between multiple source languages and host environments. The host environments compile the WebAssembly binaries into native code for the specific hardware architecture.