Hao Chen University of California, Davis Web services are highly - - PowerPoint PPT Presentation

▶

hao chen university of california davis web services are

Hao Chen University of California, Davis Web services are highly - - PowerPoint PPT Presentation

Aug 22, 2022 183 likes •895 views

Benjamin Davis Benjamin Davis Hao Chen University of California, Davis Web services are highly attractive targets Over 60% of attacks target Web applications Over 80% of vulnerabilities found are in Web applications (From SANS 2009

slide-1

SLIDE 1

Benjamin Davis Benjamin Davis Hao Chen University of California, Davis

slide-2

SLIDE 2

 Web services are highly attractive targets  Over 60% of attacks target Web applications  Over 80% of vulnerabilities found are in Web

applications (From SANS 2009 Top Cyber Security Risks)

2

slide-3

SLIDE 3

3

<h1>Latest Comment</h1> <p> </p>

{User Content}

slide-4

SLIDE 4

4

<h1>Latest Comment</h1> <p> This is <b>great!</b> </p>

slide-5

SLIDE 5

5

<h1>Latest Comment</h1> <p> <script> steal(document.cookie); </script> </p>

slide-6

SLIDE 6

6

Application ? ? ? ? ?

slide-7

SLIDE 7

Information Flow Tracking System

7

Application     Input !!

slide-8

SLIDE 8

Information Flow Tracking System

8

Application     !!

slide-9

SLIDE 9

Information Flow Tracking System

9

Application     !! !!

slide-10

SLIDE 10

Information Flow Tracking System

10

Application     !! Output !!

slide-11

SLIDE 11

Information Flow Tracking System

11

Application     !! !! Output

X X

slide-12

SLIDE 12

 Language-based “taint mode”

Perl
Ruby

 Adding support to language structures

Java [Chin, Wagner 09]
PHP [Venema]

12

slide-13

SLIDE 13

Information Flow Tracking System

13

Web Application Output Input Database Interface Database

slide-14

SLIDE 14

Information Flow Tracking System Web Application

14

Output Input Database Interface Database     !!

slide-15

SLIDE 15

Information Flow Tracking System Web Application

15

Output Input Database Interface Database     !!

slide-16

SLIDE 16

Information Flow Tracking System Web Application

16

Output Input Database Interface Database     !!

slide-17

SLIDE 17

Information Flow Tracking System Web Application

17

Output Input Database Interface Database     !!

slide-18

SLIDE 18

Information Flow Tracking System Web Application

18

Output Input Database Interface Database     ?

slide-19

SLIDE 19

Information Flow Tracking System Web Application

19

Output Input Database Interface Database     ?

slide-20

SLIDE 20

Information Flow Tracking System Web Application

20

Output Input Database Interface Database     ?

slide-21

SLIDE 21

 What if you have multiple applications?  How to treat data from the database?

All tainted -> false positives
All untainted -> false negatives
Require manual annotation?
Application-specific decisions?

21

slide-22

SLIDE 22

 Taint tracking through the entire system

[Asbestos, 05]
[HiStar, 06]

 Implemented in

Hardware
OS
VMM/emulator

22

slide-23

SLIDE 23

Web Application

23

Output Input Database Interface Database !!

slide-24

SLIDE 24

Web Application

24

Output Input Database Interface Database

slide-25

SLIDE 25

Web Application

25

Output Input Database Interface Database !!

slide-26

SLIDE 26

Web Application

26

Output Input Database Interface Database

slide-27

SLIDE 27

 Low level/fine granularity

Hardware mechanism [Suh, Lee, Devadas 04]
Minos [Crandall, Chong, 04]

 Lacks high-level database semantics

Aggregate functions
Comparisons, SELECT DISTINCT

27

slide-28

SLIDE 28

 End-to-end taint tracking

Across Web applications and databases

 Leverage existing single-application

information flow tracking engines

 Compatible with existing Web services

Require no changes to Web applications

 Taint propagation through database functions

28

slide-29

SLIDE 29

29

DB Interface Web Application Database Engine SQL

slide-30

SLIDE 30

30

DB Interface Web Application Database Engine SQL Single-application information flow DBTaint

slide-31

SLIDE 31

 Store taint data in database composite types

Tuple of form: (<value>, <taint_value>)

 Store/retrieve taint values via SQL

No additional mechanisms needed in the database
No change to underlying database data structures

31

Id Id Status Status (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32, 0) (‘pending, 1) Id Id Status Status 19 ‘closed’ 27 ‘open’ 32 ‘pending’ Before DBTaint With DBTaint

slide-32

SLIDE 32

 Create functions that operate on composite

types

Comparison operators (=, !=, <, …)
Arithmetic operations (+, -, …)
Text operations (upper, lower, …)
Aggregate functions (MAX, MIN, SUM, …)

 Functions implemented in SQL

CREATE FUNCTION
CREATE OPERATOR
CREATE AGGREGATE

32

slide-33

SLIDE 33

 Arithmetic operations

(4, 0) + (5, 1) = (9, ?)

33

slide-34

SLIDE 34

 Arithmetic operations

(4, 0) + (5, 1) = (9, ?)

34

untainted tainted

slide-35

SLIDE 35

 Arithmetic operations

(4, 0) + (5, 1) = (9, 1)

35

untainted tainted tainted

slide-36

SLIDE 36

 MAX

{(2, 0), (3, 1), (5, 0)} = (5, ?)

36

slide-37

SLIDE 37

 MAX

{(2, 0), (3, 1), (5, 0)} = (5, ?)

37

untainted tainted untainted

slide-38

SLIDE 38

 Untainted: trusted source

Web application defaults
Values generated entirely by the Web application

 Tainted: from untrusted source, or unknown

User input

 Explicit information flow  Database returns untainted value only if

database has received that value untainted

38

slide-39

SLIDE 39

 MAX

{(2, 0), (3, 1), (5, 0)} = (5, ?)

39

untainted tainted untainted

slide-40

SLIDE 40

 MAX

{(2, 0), (3, 1), (5, 0)} = (5, 0)

40

untainted tainted untainted untainted

slide-41

SLIDE 41

 Equality

(3, 0) = (3, 1)

41

untainted tainted

?

slide-42

SLIDE 42

 Equality

3 == 3

42

slide-43

SLIDE 43

 Equality

(3, 0) == (3, 1)

 Adopt notion of backwards-compatibility

[Chin, Wagner 09]

43

untainted tainted

slide-44

SLIDE 44

 MAX

{(5, 1), (5, 0)} = (5, ?)

44

untainted tainted

slide-45

SLIDE 45

 MAX

{5, 5} = 5

45

slide-46

SLIDE 46

 MAX

{5, 5} = 5

46

OR

slide-47

SLIDE 47

 MAX

{(5, 1), (5, 0)} = (5, ?)

47

OR

slide-48

SLIDE 48

 MAX

{(5, 1), (5, 0)} = (5, 0)

 When possible, prefer to return untainted

values

48

untainted tainted untainted

slide-49

SLIDE 49

49

WebApp DB Interface Database Table Id Id Status Status 19 ‘closed’ 27 ‘open’ 32 ‘pending’

slide-50

SLIDE 50

50

WebApp DB Interface Database Table x = DB.get(id=27) Id Id Status Status 19 ‘closed’ 27 ‘open’ 32 ‘pending’

slide-51

SLIDE 51

51

WebApp DB Interface Database Table x = DB.get(id=27) Id Id Status Status 19 ‘closed’ 27 ‘open’ 32 ‘pending’

slide-52

SLIDE 52

52

WebApp DB Interface Database Table x = DB.get(id=27) Id Id Status Status 19 ‘closed’ 27 ‘open’ 32 ‘pending’

slide-53

SLIDE 53

53

WebApp DB Interface Database Table x = “open” Id Id Status Status 19 ‘closed’ 27 ‘open’ 32 ‘pending’

slide-54

SLIDE 54

54

WebApp DB Interface Database Table Id Id Status Status (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32, 0) (‘pending, 1) DBTaint

slide-55

SLIDE 55

55

WebApp Database Table Id Id Status Status (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32, 0) (‘pending, 1) x = DB.get(id=27) DB Interface DBTaint

slide-56

SLIDE 56

56

WebApp Database Table Rewritten query Id Id Status Status (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32, 0) (‘pending, 1) DB Interface DBTaint

slide-57

SLIDE 57

57

WebApp Database Table Result tuples Id Id Status Status (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32, 0) (‘pending, 1) DB Interface DBTaint

slide-58

SLIDE 58

58

WebApp Database Table Id Id Status Status (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32, 0) (‘pending, 1) DB Interface DBTaint Collapse tuples and taint appropriately

slide-59

SLIDE 59

59

WebApp Database Table x = “open” // x is tainted Id Id Status Status (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32, 0) (‘pending, 1) DB Interface DBTaint

slide-60

SLIDE 60

 Account for composite types in SQL queries  Collapse and taint result tuples as needed  These changes are:

Transparent to web application
High-level, portable

60

unchanged DB DB Interface DBTaint

slide-61

SLIDE 61

61

 Parameterized queries  Prepare:

INSERT … (id, status) VALUES (?, ?)
Execute
(27, ‘open’)

slide-62

SLIDE 62

62

 Parameterized queries  Prepare:

INSERT … (id, status) VALUES (?, ?)
// with DBTaint:
INSERT … (id, status) VALUES (ROW(?, ?), ROW(?, ?))

slide-63

SLIDE 63

63

 Parameterized queries  Prepare:

INSERT … (id, status) VALUES (?, ?)
// with DBTaint:
INSERT … (id, status) VALUES (ROW(?, ?), ROW(?, ?))
Execute
(27, ‘open’) // 27 is untainted, ‘open’ is tainted
// with DBTaint:
(27, 0, ‘open’, 1)

slide-64

SLIDE 64

 Prepare phase:

Queries are passed with placeholders for data

 Execute phase:

Data values are passed separately, independently

 Taint tracking engine requirement:

Only need to track taint values per variable

 We handle non-parameterized queries too

See paper for details

64

slide-65

SLIDE 65

 Leverage existing single-application

information flow tracking systems

 No changes to Web application

65

DB Interface Web Application Single-application information flow DBTaint

slide-66

SLIDE 66

 Languages

Perl
Java

 Database Interfaces

Perl DataBase Interface (DBI)
Java Database Connectivity (JDBC)

 Database

PostgreSQL

66

slide-67

SLIDE 67

 RT: Request Tracker (ticket tracking system)

60,000+ lines of Perl
Perl DBI (DataBase Interface) API
Perl taint mode

 JForum (discussion board system)

30,000+ lines of Java
Java Database Connectivity (JDBC) API
Character-level taint engine [Chin, Wagner ’09]

67

slide-68

SLIDE 68

5 10 15 20 25 30

JForum RT

requests/second requests/second

Original DBTaint

68

slide-69

SLIDE 69

 Cross-application information flow tracking  Persistent taint tracking  Multiple Web applications, multiple Databases

69

slide-70

SLIDE 70

 End-to-end information flow through Web

services

 Compatible with existing Web services

Requires no changes to Web applications

 Taint propagation through database functions

70