Combining Static Analysis and Runtime Monitoring to Counter - - PowerPoint PPT Presentation

▶
combining static analysis and runtime monitoring to
SMART_READER_LITE
LIVE PREVIEW

Combining Static Analysis and Runtime Monitoring to Counter - - PowerPoint PPT Presentation

Nov 04, 2022 17 likes •191 views

Combining Static Analysis and Runtime Monitoring to Counter SQL-Injection Attacks William Halfond & Alessandro Orso Georgia Institute of Technology This work was supported in part by NSF awards CCR-0306372, CCR-0205422, and CCR-0209322 to

slide-1
SLIDE 1

Combining Static Analysis and Runtime Monitoring to Counter SQL-Injection Attacks

William Halfond & Alessandro Orso Georgia Institute of Technology

This work was supported in part by NSF awards CCR-0306372, CCR-0205422, and CCR-0209322 to Georgia Tech.

slide-2
SLIDE 2

William Halfond – WODA 2005

Vulnerable Application

String queryString = "SELECT info FROM userTable WHERE "; if ((! login.equals("")) && (! password.equals(""))) { queryString += "login='" + login + "' AND pass='" + password + "'"; } else { queryString+="login='guest'"; } ResultSet tempSet = stmt.executeQuery(queryString);

slide-3
SLIDE 3

William Halfond – WODA 2005

Attack Scenario

String queryString = "SELECT info FROM userTable WHERE "; if ((! login.equals("")) && (! password.equals(""))) { queryString += "login='" + login + "' AND pass='" + password + "'"; } else { queryString+="login='guest'"; } ResultSet tempSet = stmt.executeQuery(queryString);

Normal Usage

  • User submits login “doe” and password “xyz”
  • SELECT info FROM users WHERE login=’doe’ AND

pass=’xyz’

slide-4
SLIDE 4

William Halfond – WODA 2005

Malicious Usage

  • Attacker submits “’ or 1=1 --” and password of “”
  • SELECT info FROM users WHERE login=’’ or 1=1 --’ AND

pass=’’

Attack Scenario

String queryString = "SELECT info FROM userTable WHERE "; if ((! login.equals("")) && (! password.equals(""))) { queryString += "login='" + login + "' AND pass='" + password + "'"; } else { queryString+="login='guest'"; } ResultSet tempSet = stmt.executeQuery(queryString);

slide-5
SLIDE 5

William Halfond – WODA 2005

Presentation Outline

  • Related Work
  • Our Solution
  • Implementation Details
  • Preliminary Results
slide-6
SLIDE 6

William Halfond – WODA 2005

Related Approaches

  • Program Analysis
  • Information Flow Reasoning [Huang04]
  • Type Analysis [Gould04]
  • Check for Tautologies [Wasserman04]
  • Defensive Coding [WSC03]
  • Proxy Filtering [Scott02]
  • Randomized Instruction Set [Kc03]
  • Penetration Testing [Huang03]
slide-7
SLIDE 7

William Halfond – WODA 2005

Our Solution

Basic Insights

1.

Code contains enough information to accurately predict and model all possible queries.

2.

A SQL Injection Attack will not conform to the predicted model.

Solution: Static analysis => build query models Runtime analysis => enforce models

slide-8
SLIDE 8

William Halfond – WODA 2005

Overview of Analysis

1.

Identify all hotspots.

2.

Build SQL query models for each hotspot.

3.

Instrument hotspots.

4.

Monitor application at runtime.

slide-9
SLIDE 9

William Halfond – WODA 2005

1 -- Identify Hotspots

Scan application code to identify hotspots.

String queryString = "SELECT info FROM userTable WHERE "; if ((! login.equals("")) && (! password.equals(""))) { queryString += "login='" + login + "' AND pass='" + password + "'"; } else { queryString+="login='guest'"; } ResultSet tempSet = stmt.executeQuery(queryString);

Hotspot

slide-10
SLIDE 10

William Halfond – WODA 2005

2 -- Build SQL Query Model

1.

Use JSA [Christensen03] to construct character-level automaton.

2.

Parse graph (similar to [Gould04]) to group characters into SQL tokens.

SELECT info FROM userTable WHERE login = ‘ guest ‘ login = ‘ ‘ VAR AND pass = ‘ ‘ VAR

slide-11
SLIDE 11

William Halfond – WODA 2005

3 -- Instrument Application

Wrap each hotspot with call to monitor.

String queryString = "SELECT info FROM userTable WHERE "; if ((! login.equals("")) && (! password.equals(""))) { queryString += "login='" + login + "' AND pass='" + password + "'"; } else { queryString+="login='guest'"; } if (monitor.accepts (hotspotID, queryString) { ResultSet tempSet = stmt.executeQuery(queryString);

} Hotspot Call to Monitor

slide-12
SLIDE 12

William Halfond – WODA 2005

4 -- Runtime Monitoring

Normal Usage:

SELECT info FROM userTable WHERE login = ‘ ‘ doe AND pass = ‘ ‘ xyz

Check queries against SQL query model.

SELECT info FROM userTable WHERE login = ‘ guest ‘ login = ‘ ‘ VAR AND pass = ‘ ‘ VAR

slide-13
SLIDE 13

William Halfond – WODA 2005

4 -- Runtime Monitoring

Check queries against SQL query model.

SELECT info FROM userTable WHERE login = ‘ guest ‘ login = ‘ ‘ VAR AND pass = ‘ ‘ VAR

Malicious Usage:

SELECT info FROM userTable WHERE login = ‘ ‘ AND pass = ‘ ‘ OR 1 = 1

  • ‘
slide-14
SLIDE 14

William Halfond – WODA 2005

Implementation

Analysis Module: (Steps 1 & 2)

  • String Analysis: JSA

[Christensen03]

  • SQL Tokenizing: Modified depth-

first traversal

Instrumentation: (Step 3)

  • InsECT [Chawla04]

Run-time Monitoring: (Step 4)

  • Monitoring Library: InsECT

[Chawla04]

  • Runtime Checker: NDFA

implementation

slide-15
SLIDE 15

William Halfond – WODA 2005

Preliminary Results

  • Used two applications
  • Identified vulnerable hotspots
  • Crafted targeted attack queries and

normal queries

  • Evaluated effectiveness of technique for

protecting applications

  • No false positives or negatives.
slide-16
SLIDE 16

William Halfond – WODA 2005

Future Work

  • More extensive and realistic evaluation
  • Identify limitations of analysis
  • Evaluate scalability of technique
  • Use of dynamic techniques to construct

model where static analysis fails

slide-17
SLIDE 17

William Halfond – WODA 2005

Questions