Modelgen: Mining Explicit Information Flow Specifications from - PowerPoint PPT Presentation

Modelgen: Mining Explicit Information Flow Specifications from Concrete Executions Lazaro Clapp, Saswat Anand, Alex Aiken Stanford University

I Why mine specifications?

Whole-program static analysis Application

Whole-program static analysis Static Malware? Application Analysis Bugs? Documentation

Whole-program static analysis? Application Platform (e.g. Android)

Whole-program static analysis? ??? Static Application Analysis Platform (e.g. Android)

Whole-program static analysis? ??? Static Application Analysis Platform • Native code (e.g. Android)

Whole-program static analysis? ??? Static Application Analysis Platform • Native code (e.g. Android) • Reflection

Whole-program static analysis? ??? Static Application Analysis Platform • Native code (e.g. Android) • Reflection • Complex OOP patterns / indirection

Whole-program static analysis? ??? Static Application Analysis Platform • Native code (e.g. Android) • Reflection • Complex OOP patterns / indirection • Large (e.g. Android >2 MLOC, Java)

Whole-program static analysis? ??? Static Application Analysis Platform • Native code (e.g. Android) • Reflection • Complex OOP patterns / indirection • Large (e.g. Android >2 MLOC, Java)

Options: Best-case Under-approximation Static Application Analysis (Very) Unsound Platform False negatives (e.g. Android)

Options: Worst-case Over-approximation Static Application Analysis (Very) Imprecise Platform False positives (e.g. Android)

Options: Specifications Slight over-approximation • Application Manually written • Platform (e.g. Android) Effort intensive* • * Our system (STAMP): Models for 1,116 methods, written over 2 years

Mining Specifications Slight over-approximation • Application Manually written • Platform (e.g. Android) Effort intensive •

Mining Specifications Slight over-approximation • Application Mined automatically using • Platform dynamic analysis (e.g. Android)

Mining Specifications Application Platform Specifications (e.g. Android) Dynamic Analysis

Mining Specifications Static Malware? Application Analysis Bugs? Platform Documentation Specifications (e.g. Android) Dynamic Analysis

II Information flow specifications

Static taint analysis Information Flow Report #LOCATION -> ! INTERNET S.T.A.M.P. Static #CONTACTS -> ! Analysis INTERNET #PHONE_NUM -> Human !INTERNET Auditor

Information flow specifications // Set-up SocketChannel socket = ...; CharBuffer buffer = ...; CharsetEncoder encoder = ...; TelephonyManager tMgr = ...; // Leak phone number // ( #PHONE_NUM -> !INTERNET ) String mPhoneNumber = tMgr.getLine1Number(); CharBuffer b1 = buffer.put(mPhoneNumber,0,10); ByteBuffer bytebuffer = encoder.encode(b1); socket.write(bytebuffer);

Information flow specifications // Set-up SocketChannel socket = ...; CharBuffer buffer = ...; CharsetEncoder encoder = ...; TelephonyManager tMgr = ...; // Leak phone number // ( #PHONE_NUM -> !INTERNET ) String mPhoneNumber = tMgr.getLine1Number(); CharBuffer b1 = buffer.put(mPhoneNumber,0,10); ByteBuffer bytebuffer = encoder.encode(b1); socket.write(bytebuffer); #PHONE_NUM ->

Information flow specifications // Set-up SocketChannel socket = ...; CharBuffer buffer = ...; CharsetEncoder encoder = ...; TelephonyManager tMgr = ...; // Leak phone number // ( #PHONE_NUM -> !INTERNET ) String mPhoneNumber = tMgr.getLine1Number(); CharBuffer b1 = buffer.put(mPhoneNumber,0,10); ByteBuffer bytebuffer = encoder.encode(b1); socket.write(bytebuffer); #PHONE_NUM -> ... -> ... -> ... -> !INTERNET

Information flow specifications // Set-up SocketChannel socket = ...; CharBuffer buffer = ...; CharsetEncoder encoder = ...; TelephonyManager tMgr = ...; // Leak phone number // ( #PHONE_NUM -> !INTERNET ) String mPhoneNumber = tMgr.getLine1Number(); CharBuffer b1 = buffer.put(mPhoneNumber,0,10); ByteBuffer bytebuffer = encoder.encode(b1); socket.write(bytebuffer);

Information flow specifications TelephonyManager.getLine1Number() // Set-up #PHONE_NUM -> return SocketChannel socket = ...; CharBuffer buffer = ...; CharsetEncoder encoder = ...; TelephonyManager tMgr = ...; // Leak phone number // ( #PHONE_NUM -> !INTERNET ) String mPhoneNumber = tMgr.getLine1Number(); CharBuffer b1 = buffer.put(mPhoneNumber,0,10); ByteBuffer bytebuffer = encoder.encode(b1); socket.write(bytebuffer); #PHONE_NUM -> mPhoneNumber

Information flow specifications TelephonyManager.getLine1Number() // Set-up #PHONE_NUM -> return SocketChannel socket = ...; CharBuffer buffer = ...; CharBuffer.put(String,int,int) CharsetEncoder encoder = ...; arg#1 -> this TelephonyManager tMgr = ...; arg#1 -> return this -> return // Leak phone number // ( #PHONE_NUM -> !INTERNET ) String mPhoneNumber = tMgr.getLine1Number(); CharBuffer b1 = buffer.put(mPhoneNumber,0,10); ByteBuffer bytebuffer = encoder.encode(b1); socket.write(bytebuffer); #PHONE_NUM -> mPhoneNumber -> b1

Information flow specifications TelephonyManager.getLine1Number() // Set-up #PHONE_NUM -> return SocketChannel socket = ...; CharBuffer buffer = ...; CharBuffer.put(String,int,int) CharsetEncoder encoder = ...; arg#1 -> this TelephonyManager tMgr = ...; arg#1 -> return this -> return // Leak phone number // ( #PHONE_NUM -> !INTERNET ) CharsetEncoder.encode(CharBuffer) String mPhoneNumber = tMgr.getLine1Number(); arg#1 -> return CharBuffer b1 = buffer.put(mPhoneNumber,0,10); ByteBuffer bytebuffer = encoder.encode(b1); socket.write(bytebuffer); #PHONE_NUM -> mPhoneNumber -> b1 -> bytebuffer

Information flow specifications TelephonyManager.getLine1Number() // Set-up #PHONE_NUM -> return SocketChannel socket = ...; CharBuffer buffer = ...; CharBuffer.put(String,int,int) CharsetEncoder encoder = ...; arg#1 -> this TelephonyManager tMgr = ...; arg#1 -> return this -> return // Leak phone number // ( #PHONE_NUM -> !INTERNET ) CharsetEncoder.encode(CharBuffer) String mPhoneNumber = tMgr.getLine1Number(); arg#1 -> return CharBuffer b1 = buffer.put(mPhoneNumber,0,10); ByteBuffer bytebuffer = encoder.encode(b1); SocketChannel.write(ByteBuffer) socket.write(bytebuffer); arg#1 -> !INTERNET #PHONE_NUM -> mPhoneNumber -> b1 -> bytebuffer -> !INTERNET

III Technique

Instrument, run, analyze Instrument Run Analyze

Instrument, run, analyze Instrument Run Analyze

Instrument, run, analyze Instrument Run Analyze

Instrument, run, analyze Instrument Run Analyze

Instrument, run, analyze Instrument Run Analyze

Method trace Definition:

Method trace Definition: Sequence of recorded operations between • method entry and return.

Method trace Definition: Sequence of recorded operations between • method entry and return. Including calls to other methods. •

Example o . m ( arg1 , arg2 ) : t = arg1 ⊗ arg2 o1 = o.f o2 = o1.g Initialization o3 = o.g o2.f = t return o

Example o . m ( arg1 , arg2 ) : t = arg1 ⊗ arg2 o1 = o.f o2 = o1.g Initialization o3 = o.g o2.f = t return o

Example o . m ( arg1 , arg2 ) : t = arg1 ⊗ arg2 o1 = o.f o2 = o1.g Initialization o3 = o.g o2.f = t return o

Example o . m ( arg1 , arg2 ) : t = arg1 ⊗ arg2 o1 = o.f o2 = o1.g Initialization o3 = o.g o2.f = t return o

Example o . m ( arg1 , arg2 ) : Spec: t = arg1 ⊗ arg2 arg1->this o1 = o.f arg2->this o2 = o1.g Initialization o3 = o.g o2.f = t return o

Example o . m ( arg1 , arg2 ) : Spec: t = arg1 ⊗ arg2 arg1->this o1 = o.f arg2->this o2 = o1.g Initialization this->return o3 = o.g o2.f = t return o

Example o . m ( arg1 , arg2 ) : Spec: t = arg1 ⊗ arg2 arg1->this o1 = o.f arg2->this o2 = o1.g Initialization this->return o3 = o.g o2.f = t arg1->return return o arg2-> return

Example: Initialization o . m ( arg1 , arg2 ) : ret = o . m ( arg1 , arg2 ) t = arg1 ⊗ arg2 o1 = o.f o2 = o1.g Initialization o3 = o.g o2.f = t return o

Example: Taint propagation o . m ( arg1 , arg2 ) : ret = o . m ( arg1 , arg2 ) t = arg1 ⊗ arg2 o1 = o.f o2 = o1.g Initialization t o3 = o.g o2.f = t return o

Example: Loads o . m ( arg1 , arg2 ) : ret = o . m ( arg1 , arg2 ) t = arg1 ⊗ arg2 o1 = o.f o2 = o1.g Initialization o1 o3 = o.g o2.f = t return o

Example: Loads o . m ( arg1 , arg2 ) : ret = o . m ( arg1 , arg2 ) t = arg1 ⊗ arg2 o1 = o.f o2 = o1.g Initialization o1 o3 = o.g o2.f = t o2 return o

Example: Loads o . m ( arg1 , arg2 ) : ret = o . m ( arg1 , arg2 ) t = arg1 ⊗ arg2 o1 = o.f o2 = o1.g Initialization o3 o3 = o.g o2.f = t return o

Example: Loads o . m ( arg1 , arg2 ) : ret = o . m ( arg1 , arg2 ) t = arg1 ⊗ arg2 o1 = o.f o2 = o1.g Initialization o3 = o.g o2.f = t return o

Example: Store o . m ( arg1 , arg2 ) : ret = o . m ( arg1 , arg2 ) t = arg1 ⊗ arg2 o1 = o.f o2 = o1.g Initialization o3 = o.g o2.f = t return o