Asem Ghaleb

I am a final-year Ph.D. candidate at the University of British Columbia (UBC), Vancouver, where I work with Karthik Pattabiraman and Julia Rubin. My research interests lie in program analysis and automated reasoning techniques with applications in software security. Specifically, my Ph.D. thesis focus is on building effective and efficient analysis techniques for detecting security vulnerabilities in Ethereum smart contracts. Previously, I have worked on the security analysis of industrial control systems (ICS), mainly, the network communication between Siemens programmable logic controllers (PLC) and the engineering stations. Through this work, I discovered three network attacks that can lead to serious compromise of PLCs. I also worked on dynamically analyzing the behavior of more than 700 ransomware samples to build ransomware detection models based on the behavior of the machine being compromised.

news

Feb 24, 2023	Receiving `Artifact Evaluated Reusable` and `Artifact Available` badges from ICSE’23 Artifact Evaluation for our paper “AChecker: Statically Detecting Smart Contract Access Control Vulnerabilities” Contracts”!
Dec 8, 2022	Our paper `AChecker: Statically Detecting Smart Contract Access Control Vulnerabilities` has been accepted to ICSE’23!
Aug 5, 2022	My paper `Towards Effective Static Analysis Approaches for Security Vulnerabilities in Smart Contracts` has been accepted to the ASE’22 doctoral symposium!
Jun 2, 2022	Receiving `Artifact Reusable Badge` from ISSTA’22 Artifact Evaluation for our paper “eTainter: Detecting Gas-Related Vulnerabilities in Smart Contracts”!
Apr 8, 2022	Our paper `eTainter: Detecting Gas-Related Vulnerabilities in Smart Contracts` has been accepted to ISSTA’22!

selected publications

ICSE 2023

AChecker: Statically Detecting Smart Contract Access Control Vulnerabilities

Asem Ghaleb, Julia Rubin, and Karthik Pattabiraman

2023

Abs PDF Code Slides

As most smart contracts have a financial nature and handle valuable assets, smart contract developers use access control to protect assets managed by smart contracts from being misused by malicious or unauthorized people. Unfortunately, programming languages used for writing smart contracts, such as Solidity, were not designed with a permission-based security model in mind. Therefore, smart contract developers implement access control checks based on their judgment and in an ad-hoc manner, which results in several vulnerabilities in smart contracts, called access control vulnerabilities. Further, the inconsistency in implementing access control makes it difficult to reason about whether a contract meets access control needs and is free of access control vulnerabilities. In this work, we propose AChecker – an approach for detecting access control vulnerabilities. Unlike prior work, AChecker does not rely on pre-defined patterns or contract transactions history. Instead, it infers access control implemented in smart contracts via static data-flow analysis. Moreover, the approach performs further symbolic-based analysis to distinguish cases when unauthorized people can obtain control of the contract as intended functionality. We evaluated AChecker on three public datasets of real-world smart contracts, including one which consists of contracts with assigned access control CVEs, and compared its effectiveness with eight analysis tools. The evaluation results showed that AChecker outperforms these tools in terms of both precision and recall. In addition, AChecker flagged vulnerabilities in 21 frequently-used contracts on Ethereum blockchain with 90% precision.
ISSTA 2022

eTainter: Detecting Gas-Related Vulnerabilities in Smart Contracts

Asem Ghaleb, Julia Rubin, and Karthik Pattabiraman

2022

Abs PDF Code Slides

The execution of smart contracts on the Ethereum blockchain consumes gas paid for by users submitting contracts’ invocation requests. A contract execution proceeds as long as the users dedicate enough gas, within the limit set by Ethereum. If insufficient gas is provided, the contract execution halts and changes made during execution get reverted. Unfortunately, contracts may contain code patterns that increase execution cost, causing the contracts to run out of gas. These patterns can be manipulated by malicious attackers to induce unwanted behavior in the targeted victim contracts, e.g., Denial-of-Service (DoS) attacks. We call these gas-related vulnerabilities. We propose eTainter, a static analyzer for detecting gas-related vulnerabilities based on taint tracking in the bytecode of smart contracts. We evaluate eTainter by comparing it with the prior work, MadMax, on a dataset of annotated contracts. The results show that eTainter outperforms MadMax in both precision and recall, and that eTainter has a precision of 90% based on manual inspection. We also use eTainter to perform large-scale analysis of 60,612 real-world contracts on the Ethereum blockchain. We find that gas-related vulnerabilities exist in 2,763 of these contracts, and that eTainter analyzes a contract in eight seconds, on average.
ISSTA 2020

How Effective Are Smart Contract Analysis Tools? Evaluating Smart Contract Static Analysis Tools Using Bug Injection

Asem Ghaleb, and Karthik Pattabiraman

2020

Abs PDF Code Slides

Security attacks targeting smart contracts have been on the rise, which have led to financial loss and erosion of trust. Therefore, it is important to enable developers to discover security vulnerabilities in smart contracts before deployment. A number of static analysis tools have been developed for finding security bugs in smart contracts. However, despite the numerous bug-finding tools, there is no systematic approach to evaluate the proposed tools and gauge their effectiveness. This paper proposes SolidiFI, an automated and systematic approach for evaluating smart contracts’ static analysis tools. SolidiFI is based on injecting bugs (i.e., code defects) into all potential locations in a smart contract to introduce targeted security vulnerabilities. SolidiFI then checks the generated buggy contract using the static analysis tools, and identifies the bugs that the tools are unable to detect (false-negatives) along with identifying the bugs reported as false-positives. SolidiFI is used to evaluate six widely-used static analysis tools, namely, Oyente, Securify, Mythril, SmartCheck, Manticore and Slither, using a set of 50 contracts injected by 9369 distinct bugs. It finds several instances of bugs that are not detected by the evaluated tools despite their claims of being able to detect such bugs, and all the tools report many false positives.
IJCIP

On PLC network security

Asem Ghaleb, Sami Zhioua, and Ahmad Almulhem

International Journal of Critical Infrastructure Protection 2018

Abs HTML

Programmable Logic Controller (PLC) is an important component in modern Industrial Control Systems (ICS) particular in Supervisory Control and Data Acquisition (SCADA) systems. Disturbing the normal operation of PLCs can lead to significant damages ranging from minor annoyance to large scale incidents threatening the life of people. While most of existing work in the SCADA security literature focuses on the communication between PLCs and field devices, this paper presents a network security analysis of the communication between PLCs and the engineering stations in charge of setting up and configuring them. Interestingly, this aspect of SCADA security was exploited by the most famous SCADA attack, namely, Stuxnet. Using a testbed with a common PLC device, we successfully carried out three network attacks leading to serious compromise of typical PLCs.