Hao Chen Benjamin Davis. University of California, Davis. HELIX Project Review Meeting, August 6,2010

Transcription

1 Hao Chen Benjamin Davis University of California, Davis HELIX Project Review Meeting, August 6,2010

2 Goal: protect systems at high level Web services are highly attractive targets Over 60% of attacks target Web applications Over 80% of vulnerabilities are in Web apps Noncespaces: Randomize XML tags of untrusted content Defeat XSS attacks (From SANS 2009 Top Cyber Security Risks) 2

3 <h1>latest Comment</h1> <p> {User Content} </p> 3

4 <h1>latest Comment</h1> <p> This is <b>great!</b> </p> 4

5 <h1>latest Comment</h1> <p> <script> steal(document.cookie); </script> </p> 5

6 6

7 Information Flow Tracking System!! Input Application 7

8 Information Flow Tracking System Application!! 8

9 Information Flow Tracking System!! Application!! 9

10 Information Flow Tracking System Application Output!!!! 10

11 Information Flow Tracking System Application X!! Output!! 11

12 Language-based taint mode Perl Ruby Adding support to language structures Java [Chin, Wagner 09] PHP [Venema] 12

13 Information Flow Tracking System Database Interface Input Web Application Database Output 13

14 Information Flow Tracking System Database Interface!! Input Web Application Database Output 14

15 Information Flow Tracking System Database Interface Input Web Application Database Output!! 15

16 Information Flow Tracking System Database!! Interface Input Web Application Database Output 16

17 Information Flow Tracking System Database Interface!! Input Web Application Database Output 17

18 Information Flow Tracking System Database Interface? Input Web Application Database Output 18

19 Information Flow Tracking System Database Interface Input Web Application? Database Output 19

20 Information Flow Tracking System Database Interface? Input Web Application Database Output 20

21 What if you have multiple applications? How to treat data from the database? All tainted -> false positives All untainted -> false negatives Require manual annotation? Application-specific decisions? 21

22 Taint tracking through the entire system [Asbestos, 05] [HiStar, 06] Implemented in Hardware OS VMM/emulator 22

23 Database Interface!! Input Web Application Database Output 23

24 Database Interface Input Web Application Database Output 24

25 Database Interface!! Input Web Application Database Output 25

26 Database Interface Input Web Application Database Output 26

27 Low level/fine granularity Hardware mechanism [Suh, Lee, Devadas 04] Minos [Crandall, Chong, 04] Lacks high-level database semantics Aggregate functions Comparisons, SELECT DISTINCT 27

28 End-to-end taint tracking Across Web applications and databases Leverage existing single-application information flow tracking engines Compatible with existing Web services Require no changes to Web applications Taint propagation through database functions 28

29 DB Interface SQL Database Engine Web Application 29

30 DBTaint DB Interface SQL Database Engine Web Application Single-application information flow 30

31 Store taint data in database composite types Tuple of form: (<value>, <taint_value>) Store/retrieve taint values via SQL No additional mechanisms needed in the database No change to underlying database data structures Id Status Id Status 19 closed 27 open 32 pending Without DBTaint (19, 0) ( closed, 1) (27, 0) ( open, 1) (32, 0) ( pending, 1) With DBTaint 31

32 Create functions that operate on composite types Comparison operators (=,!=, <, ) Arithmetic operations (+, -, ) Text operations (upper, lower, ) Aggregate functions (MAX, MIN, SUM, ) Functions implemented in SQL CREATE FUNCTION CREATE OPERATOR CREATE AGGREGATE 32

33 Arithmetic operations (4, 0) + (5, 1) = (9,?) 33

34 Arithmetic operations (4, 0) + (5, 1) = (9,?) untainted tainted 34

35 Arithmetic operations (4, 0) + (5, 1) = (9, 1) untainted tainted tainted 35

36 MAX {(2, 0), (3, 1), (5, 0)} = (5,?) 36

37 MAX {(2, 0), (3, 1), (5, 0)} = (5,?) untainted tainted untainted 37

38 Untainted: trusted source Web application defaults Values generated entirely by the Web application Tainted: from untrusted source, or unknown User input Explicit information flow Database returns untainted value only if database has received that value untainted 38

39 MAX {(2, 0), (3, 1), (5, 0)} = (5,?) untainted tainted untainted 39

40 MAX {(2, 0), (3, 1), (5, 0)} = (5, 0) untainted tainted untainted untainted 40

41 Equality? (3, 0) = (3, 1) untainted tainted 41

42 Equality 3 == 3 42

43 Equality (3, 0) == (3, 1) untainted tainted Adopt notion of backwards-compatibility [Chin, Wagner 09] 43

44 MAX {(5, 1), (5, 0)} = (5,?) tainted untainted 44

45 MAX {5, 5} = 5 45

46 MAX {5, 5} = 5 OR 46

47 MAX {(5, 1), (5, 0)} = (5,?) OR 47

48 MAX {(5, 1), (5, 0)} = (5, 0) tainted untainted untainted When possible, prefer to return untainted values 48

49 DB Interface Database Table Id Status 19 closed 27 open 32 pending WebApp 49

50 DB Interface x = DB.get(id=27) Database Table Id Status 19 closed 27 open 32 pending WebApp 50

51 DB Interface x = DB.get(id=27) Database Table Id Status 19 closed 27 open 32 pending WebApp 51

52 DB Interface x = DB.get(id=27) Database Table Id Status 19 closed 27 open 32 pending WebApp 52

53 DB Interface Database Table x = open Id Status 19 closed 27 open 32 pending WebApp 53

54 DBTaint DB Interface Database Table Id Status (19, 0) ( closed, 1) (27, 0) ( open, 1) (32, 0) ( pending, 1) WebApp 54

55 DBTaint DB Interface x = DB.get(id=27) Database Table Id Status (19, 0) ( closed, 1) (27, 0) ( open, 1) (32, 0) ( pending, 1) WebApp 55

56 DBTaint DB Interface Rewritten query Database Table Id Status (19, 0) ( closed, 1) (27, 0) ( open, 1) (32, 0) ( pending, 1) WebApp 56

57 DBTaint DB Interface Result tuples Database Table Id Status (19, 0) ( closed, 1) (27, 0) ( open, 1) (32, 0) ( pending, 1) WebApp 57

58 DBTaint DB Interface Database Table Collapse tuples and taint appropriately Id Status (19, 0) ( closed, 1) (27, 0) ( open, 1) (32, 0) ( pending, 1) WebApp 58

59 DBTaint DB Interface Database Table x = open // x is tainted Id Status (19, 0) ( closed, 1) (27, 0) ( open, 1) (32, 0) ( pending, 1) WebApp 59

60 Account for composite types in SQL queries Collapse and taint result tuples as needed These changes are: Transparent to web application High-level, portable DBTaint DB Interface DB unchanged 60

61 Parameterized queries Prepare: INSERT (id, status) VALUES (?,?) Execute (27, open ) 61

62 Parameterized queries Prepare: INSERT (id, status) VALUES (?,?) // with DBTaint: INSERT (id, status) VALUES (ROW(?,?), ROW(?,?)) 62

63 Parameterized queries Prepare: INSERT (id, status) VALUES (?,?) // with DBTaint: INSERT (id, status) VALUES (ROW(?,?), ROW(?,?)) Execute (27, open ) // 27 is untainted, open is tainted // with DBTaint: (27, 0, open, 1) 63

64 Prepare phase: Queries are passed with placeholders for data Execute phase: Data values are passed separately, independently Taint tracking engine requirement: Only need to track taint values per variable We handle non-parameterized queries too See paper for details 64

65 Leverage existing single-application information flow tracking systems No changes to Web application DBTaint DB Interface Web Application Single-application information flow 65

66 Languages Perl Java Database Interfaces Perl DataBase Interface (DBI) Java Database Connectivity (JDBC) Database PostgreSQL 66

67 RT: Request Tracker (ticket tracking system) 60,000+ lines of Perl Perl DBI (DataBase Interface) API Perl taint mode JForum (discussion board system) 30,000+ lines of Java Java Database Connectivity (JDBC) API Character-level taint engine [Chin, Wagner 09] 67

68 68

69 End-to-end information flow through Web services Compatible with existing Web services Requires no changes to Web applications Taint propagation through database functions For detail, see our paper at USENIX WebApps. June Boston, MA. 69