CROW: Code Diversification for WebAssembly

TL;DR

This paper introduces CROW, an automated tool for diversifying WebAssembly binaries to mitigate side channel vulnerabilities, demonstrating effectiveness on various C programs and cryptographic libraries.

Contribution

It presents the first fully automated workflow and open-source tool for WebAssembly code diversification, addressing security concerns.

Findings

CROW diversifies 79% of small programs tested.

Successfully diversifies cryptographic library libsodium.

Effective in reducing side channel attack surface.

Abstract

The adoption of WebAssembly has rapidly increased in the last few years as it provides a fast and safe model for program execution. However, WebAssembly is not exempt from vulnerabilities that could be exploited by side channels attacks. This class of vulnerabilities that can be addressed by code diversification. In this paper, we present the first fully automated workflow for the diversification of WebAssembly binaries. We present CROW, an open-source tool implementing this workflow. We evaluate CROW's capabilities on 303 C programs and study its use on a real-life security-sensitive program: libsodium, a cryptographic library. Overall, CROWis able to generate diverse variants for 239 out of 303,(79%) small programs. Furthermore, our experiments show that our approach and tool is able to successfully diversify off-the-shelf cryptographic software (libsodium).