security analysis with WALA Omer Tripp IBM TJ Watson

Size: px

Start display at page:

Download "security analysis with WALA Omer Tripp IBM TJ Watson"

Irma Banks
6 years ago
Views:

1 security analysis with WALA Omer Tripp IBM TJ Watson Workshop on WALA (WoW), 13 June 2015

2 collaborators Marco Pistoia Patrick Cousot Radhia Cousot Julian Dolby Manu Sridharan Pietro Ferrrara Steve Fink Sal Guarnieri Takaaki Tateishi Omri Weisman Steve Teilhet Ryan Berg Shay Artzi Lotem Guy Roee Hay

3 motivation

threat evolution 1960 1970 1980 1990 2000 2010 Program installation only by experts

4 threat evolution Program installation only by experts Program sharing Program downloading Mobile code Web applications Mobile applications

5 threats: XSS Attacker s evil script <SCRIPT>...</SCRIPT> Web Application Attacker s evil script executed using victim s credentials Attacker Victim

6 threats: SQLi String query = SELECT * FROM users WHERE name= + username + AND pwd= + pwd + ; SELECT * FROM users WHERE name='jsmith' AND pwd='demo1234' Ouch! SELECT * FROM users WHERE name='foo';drop table custid;--' AND pwd=''

7 threats: info leakage

threats: JS 15% of Fortune 500 websites have exploitable security issues in JavaScript. According to an IBM study performed in 2010 DOM-based XSS document.write(document.url.

8 threats: JS 15% of Fortune 500 websites have exploitable security issues in JavaScript. According to an IBM study performed in 2010 DOM-based XSS document.write(document.url.substring( pos,document.url.length)); Open Redirect var pos = document.location.href.indexof("name="); var val = document.location.href.substring(pos); document.location.href = " + val;

9 threats: mobile *

owasp top ten 1. Cross-site scripting (XSS) 2. Injection flaws 3. Malicious file executions 4. Insecure direct object reference 5. Cross site request forgery (CSRF) 6.

10 owasp top ten 1. Cross-site scripting (XSS) 2. Injection flaws 3. Malicious file executions 4. Insecure direct object reference 5. Cross site request forgery (CSRF) 6. Information leakage and improper error handling 7. Broken authentication and improper session management 8. Unsecure cryptographic storage 9. Unsecure communications 10. Failure to restrict URL accesses

11 outline of our work

12 the high-level pieces dynamically loaded client-side code statically loaded client-side code server-side code security defenses: sanitizers and validators libraries and frameworks

13 the high-level progression TAJ PISA F4F Andromeda JSA

14 server-side security verification

15 TAJ (PLDI 09): Java taint analysis st i l i Store statement Load statement Hybrid SDG st 1 computed based on preliminary pointer analysis st 2 l 2 sk i c i r i s i Sink-dispatch statement Call statement Return statement Other statement l 1 st 3 l 2 st 4 computed using graph reachability over a noheap SDG Slice in the no-heap SDG c 1 c 5 r 5 c 4 r 4 c 2 s 1 s 2 c 3 r 3 r 7 Store-to-load direct edge l 3 l 4 l 5 r 1 r 2 r 8 Load-to-store or load- to-sink summary edge st 4 No-heap SDG edge sk 1 st 5 sk 2

16 TAJ: design choices pointer analysis: variant of Andersen s analysis custom context-sensitivity policy: unlimited-depth object sensitivity for Java collections (up to recursion) one level of call-string context for factory methods one level of call-string context for taint APIs one-level receiver-object context sensitivity as default field sensitivity flow insensitive, though intraprocedurally flow sensitive thanks to SSA

17 TAJ: WALA support pointer analysis / context sensitivity field sensitivity synthetic IR for taint APIs SSA representation IFDS enhancements [contributed to WALA] ICFGSupergraph [contributed to WALA].NET support [contributed to WALA] IBM AppScan Developer Edition

18 Andromeda (FASE 13): demand-driven taint analysis

19 Andromeda: WALA support PA-free CG construction algs for Java (CHA, RTA, ) efficient infrastructure for fixpoint iteration IBM AppScan Source Edition

20 the high-level pieces dynamically loaded client-side code statically loaded client-side code server-side code security defenses: sanitizers and validators libraries and frameworks

21 the high-level pieces dynamically loaded client-side code statically loaded client-side code server-side code security defenses: sanitizers and validators libraries and frameworks

22 framework modeling

23 F4F (OOPSLA 13): modeling Java web frameworks

24 effect of modeling

25 F4F: WALA support synthetic IR for call-graph methods customization of call-graph target resolution (CustomContextSelector) various knobs to tweak in pointer analysis IBM AppScan Source Edition

26 the high-level pieces dynamically loaded client-side code statically loaded client-side code server-side code security defenses: sanitizers and validators libraries and frameworks

27 the high-level pieces dynamically loaded client-side code statically loaded client-side code server-side code security defenses: sanitizers and validators libraries and frameworks

28 sanitizer verification

29 PISA (ISSTA 11, TOSEM 13): encoding into M2L

30 PISA: sanitizers from the wild

31 PISA: WALA support uniform IR: JS, Java, pointer analysis: aliasing SSA IBM AppScan Source Edition

32 the high-level pieces dynamically loaded client-side code statically loaded client-side code server-side code security defenses: sanitizers and validators libraries and frameworks

33 the high-level pieces dynamically loaded client-side code statically loaded client-side code server-side code security defenses: sanitizers and validators libraries and frameworks

34 client-side security verification

35 Actarus (ISSTA 11): JS taint analysis NY times WordPress

36 Actarus: handling aliases

37 Actarus: WALA support JS IR, including property accesses arguments array lexical scoping function pointers novel CG construction algs for JS [contributed to WALA] IBM AppScan Source Edition

38 the high-level pieces dynamically loaded client-side code statically loaded client-side code server-side code security defenses: sanitizers and validators libraries and frameworks

39 the high-level pieces dynamically loaded client-side code statically loaded client-side code server-side code security defenses: sanitizers and validators libraries and frameworks

40 handling dynamic aspects of JS

41 JSA (ISSTA 14): HTML/JavaScript, concrete URLs, DOM modeling reduce scope black-box scanner taint analysis find issues string analysis eliminate false positives issues

42 JSA (ISSTA 14): specialized string analysis using dynamic pieces of information (e.g., concrete URL) " var str = document.url; var url_check = str.indexof('login.html'); if (url_check > -1) { result = str.substring(0,url_check); result = result + 'login.jsp' + str.substring((url_check+search_term.length), str.length); document.url = result; } part controlled by attacker is unknown, but known prefix modeled precisely URL as Source NOT CONTROLLED BY ATTACKER CONTROLLED BY ATTACKER

43 JSA: WALA support call-graph construction IFDS / RHS (proved general enough!) ability to leverage domain knowledge CallNoneToReturnFlow as a means to plug in models IBM AppScan Standard Edition

44 the high-level pieces dynamically loaded client-side code statically loaded client-side code server-side code security defenses: sanitizers and validators libraries and frameworks

45 the high-level pieces dynamically loaded client-side code statically loaded client-side code server-side code security defenses: sanitizers and validators libraries and frameworks

46 nowadays

47 PL / ML

48 PL / ML

49 PL / ML

50 PL / ML

51 PL / ML

52 thoughts into the future

53 query-based analyses more WALA support around IFDS / IDE (already underway!!) integration with machine-learning engines like WEKA integration with dynamic analyses

54 thank you!

Andromeda: XSS Accurate and Scalable Security Analysis of Web Applications. OWASP* Top Ten Security Vulnerabilities. SQL Injection.

Andromeda: XSS Accurate and Scalable Security Analysis of Web Applications Attacker s evil script ... Omer Tripp Marco Pistoia Tel Aviv University & IBM IBM T. J. Watson Research Center