Security Testing Checking for what shouldnt happen Azqa Nadeem PhD - - PowerPoint PPT Presentation

▶
security testing
SMART_READER_LITE
LIVE PREVIEW

Security Testing Checking for what shouldnt happen Azqa Nadeem PhD - - PowerPoint PPT Presentation

Jan 11, 2023 172 likes •2.02k views

Security Testing Checking for what shouldnt happen Azqa Nadeem PhD Student @ Cyber Security Group The Cyber Security lecture series 1 Agenda for today Part I Latest security news Security vulnerabilities in Java

slide-1
SLIDE 1

1

Security Testing

Checking for what shouldn’t happen

Azqa Nadeem

PhD Student @ Cyber Security Group

The Cyber Security lecture series

slide-2
SLIDE 2

2

Agenda for today

  • Part I

– Latest security news – Security vulnerabilities in Java – Types of Security testing

  • SAST vs. DAST
  • Part II

– SAST under the hood

  • Pattern Matching
  • Control Flow Analysis
  • Data Flow Analysis

– SAST Tools performance

slide-3
SLIDE 3

3

Announcements

  • Assignment 2 – Security module
  • Exam questions
slide-4
SLIDE 4

4

slide-5
SLIDE 5

5

Agenda for today

  • Part I

– Latest security news – Security vulnerabilities in Java – Types of Security testing

  • SAST vs. DAST
  • Part II

– SAST under the hood

  • Pattern Matching
  • Control Flow Analysis
  • Data Flow Analysis

– SAST Tools performance

slide-6
SLIDE 6

6

Software testing vs. Security testing

slide-7
SLIDE 7

7

Impact – Stolen chats

https://ivan.barreraoro.com.ar/signal-desktop-html-tag-injection/

slide-8
SLIDE 8

8

Impact – Stolen chats

https://ivan.barreraoro.com.ar/signal-desktop-html-tag-injection/

slide-9
SLIDE 9

9

Impact – Github down

https://thehackernews.com/2018/03/biggest-ddos-attack-github.html

slide-10
SLIDE 10

10

Impact – Github down

https://thehackernews.com/2018/03/biggest-ddos-attack-github.html

Caused by misconfigured Memcached servers

slide-11
SLIDE 11

11

Is Java Secure?

  • Secure from memory corruption
  • … but not completely
  • Potential targets

– Java Virtual Machine – Libraries in native code

https://w3techs.com/technologies/details/pl-java/all/all

slide-12
SLIDE 12

12

Vulnerability databases

  • OWASP Top Ten project

– Awareness document – Web application security

  • NIST National Vulnerability Database

– U.S govt. repository – General security flaws

slide-13
SLIDE 13

13

JRE vulnerabilities

https://www.cvedetails.com/product/19116/Oracle-JDK.html?vendor_id=93

slide-14
SLIDE 14

14

JRE vulnerabilities

https://www.cvedetails.com/product/19116/Oracle-JDK.html?vendor_id=93

slide-15
SLIDE 15

15

Some Examples

slide-16
SLIDE 16

16

What’s wrong?

slide-17
SLIDE 17

17

Code Injection vulnerability

  • Execute code in unauthorized applications
  • Victim to Update Attack
slide-18
SLIDE 18

18

Code Injection vulnerability

  • Execute code in unauthorized applications
  • Victim to Update Attack
slide-19
SLIDE 19

19

Code Injection vulnerability

  • Execute code in unauthorized applications
  • Victim to Update Attack
slide-20
SLIDE 20

20

Code Injection vulnerability

  • Execute code in unauthorized applications
  • Victim to Update Attack
slide-21
SLIDE 21

21

Code Injection vulnerability

  • Execute code in unauthorized applications
  • Victim to Update Attack
slide-22
SLIDE 22

22

Code Injection vulnerability

  • Execute code in unauthorized applications
  • Victim to Update Attack
slide-23
SLIDE 23

23

Code Injection vulnerability

  • Execute code in unauthorized applications
  • Victim to Update Attack
  • Top vulnerability in OWASP Top 10
slide-24
SLIDE 24

24

Code Injection vulnerability

  • Execute code in unauthorized applications
  • Victim to Update Attack
  • Top vulnerability in OWASP Top 10
  • Tricky to fix

– Stop adding plugins – Limit privileges

slide-25
SLIDE 25

25

Type confusion vulnerability

https://www.thezdi.com/blog/2018/4/25/when-java-throws-you-a-lemon-make-limenade-sandbox-escape-by-type-confusion

slide-26
SLIDE 26

26

Type confusion vulnerability

https://www.thezdi.com/blog/2018/4/25/when-java-throws-you-a-lemon-make-limenade-sandbox-escape-by-type-confusion

slide-27
SLIDE 27

27

Bypassing Java Security Manager

  • Exploit Type confusion vulnerability

https://access.redhat.com/security/cve/cve-2014-3558

slide-28
SLIDE 28

28

Bypassing Java Security Manager

  • Exploit Type confusion vulnerability

https://access.redhat.com/security/cve/cve-2014-3558

Java Security Manager

slide-29
SLIDE 29

29

Bypassing Java Security Manager

  • Exploit Type confusion vulnerability

https://access.redhat.com/security/cve/cve-2014-3558

Java Security Manager

slide-30
SLIDE 30

30

Bypassing Java Security Manager

  • Exploit Type confusion vulnerability
  • Escalated privileges

https://access.redhat.com/security/cve/cve-2014-3558

Java Security Manager

slide-31
SLIDE 31

31

Bypassing Java Security Manager

  • Exploit Type confusion vulnerability
  • Escalated privileges

https://access.redhat.com/security/cve/cve-2014-3558

Java Security Manager

slide-32
SLIDE 32

32

Bypassing Java Security Manager

  • Exploit Type confusion vulnerability
  • Escalated privileges

– Set JSM to null

https://access.redhat.com/security/cve/cve-2014-3558

Java Security Manager

slide-33
SLIDE 33

33

Bypassing Java Security Manager

  • Vulnerable: Hibernate → Reflection helper
  • Exploit Type confusion vulnerability
  • Escalated privileges

– Set JSM to null

https://access.redhat.com/security/cve/cve-2014-3558

Java Security Manager

slide-34
SLIDE 34

34

Arbitrary Code Execution (ACE)

  • Vulnerable: XStream → Converts XML to Object
  • Deserialization vulnerability

https://access.redhat.com/security/cve/cve-2013-7285

slide-35
SLIDE 35

35

Arbitrary Code Execution (ACE)

  • Vulnerable: XStream → Converts XML to Object
  • Deserialization vulnerability

https://access.redhat.com/security/cve/cve-2013-7285

slide-36
SLIDE 36

36

Arbitrary Code Execution (ACE)

  • Vulnerable: XStream → Converts XML to Object
  • Deserialization vulnerability

https://access.redhat.com/security/cve/cve-2013-7285

slide-37
SLIDE 37

37

Arbitrary Code Execution (ACE)

  • Vulnerable: XStream → Converts XML to Object
  • Deserialization vulnerability

– Via malicious input XML

https://access.redhat.com/security/cve/cve-2013-7285

slide-38
SLIDE 38

38

Arbitrary Code Execution (ACE)

  • Vulnerable: XStream → Converts XML to Object
  • Deserialization vulnerability

– Via malicious input XML

https://access.redhat.com/security/cve/cve-2013-7285

slide-39
SLIDE 39

39

Remote Code Execution (RCE)

https://pivotal.io/security/cve-2018-1273

slide-40
SLIDE 40

40

Remote Code Execution (RCE)

https://pivotal.io/security/cve-2018-1273

slide-41
SLIDE 41

41

Remote Code Execution (RCE)

https://pivotal.io/security/cve-2018-1273

slide-42
SLIDE 42

42

Remote Code Execution (RCE)

  • Spring Data Commons → DB connections
  • Property binder vulnerability

– Via specially crafted request parameters

https://pivotal.io/security/cve-2018-1273

slide-43
SLIDE 43

43 https://www.waratek.com/alert-oracle-guidance-cpu-april-2018/

slide-44
SLIDE 44

44

Why test for security?

Attack surface Exploit

  • Security testing → Non-functional testing
  • Who’s job is to test for security?
slide-45
SLIDE 45

45 https://www.dignitasdigital.com/blog/easy-way-to-understand-sdlc/

When to test for security?

Risk assessment & Abuse cases Threat modelling Design for security Secure implementation Security testing & Code reviews Patching & Updating

SECURE

slide-46
SLIDE 46

46

Classes of Security Testing

  • Manual vs. Automated Testing

Manual Automated

slide-47
SLIDE 47

47

Classes of Security Testing

  • Manual vs. Automated Testing
  • Static vs. Dynamic Testing

Manual Automated Static Dynamic

slide-48
SLIDE 48

48

Classes of Security Testing

  • Manual vs. Automated Testing
  • Static vs. Dynamic Testing
  • Black vs. White box Testing

Manual Automated Static Dynamic Blackbox Whitebox

slide-49
SLIDE 49

49

Classes of Security Testing

  • Manual vs. Automated Testing
  • Static vs. Dynamic Testing
  • Black vs. White box Testing

Manual Automated Static Dynamic Blackbox Whitebox

Reverse Engineering Risk Analysis Code checking Tainting Fuzzing Dynamic validation Penetration testing

slide-50
SLIDE 50

50

Manual vs. Automated Testing

  • Manual

– Code reviews – Efficient use of human expertise – Labour intensive

slide-51
SLIDE 51

51

Manual vs. Automated Testing

  • Manual

– Code reviews – Efficient use of human expertise – Labour intensive

  • Automated

– Automated code checking – Can check MLOC in seconds – Incomparable to human expertise

slide-52
SLIDE 52

52

Classes of Security Testing

  • Manual vs. Automated Testing
  • Static vs. Dynamic Testing
  • Black vs. White box Testing

Manual Automated Static Dynamic Blackbox Whitebox

Reverse Engineering Risk Analysis Code checking Tainting Fuzzing Dynamic validation Penetration testing

slide-53
SLIDE 53

53

Static vs. Dynamic Testing

  • (Automated) Static analysis

– Code review by computers – Checks all possible code paths – Relatively easy to extract results – Limited capabilities

slide-54
SLIDE 54

54

Static vs. Dynamic Testing

  • (Automated) Static analysis

– Code review by computers – Checks all possible code paths – Relatively easy to extract results – Limited capabilities

  • Dynamic analysis

– Execute code and observe behaviour – Checks functional code paths only – Much advanced analysis – Difficult to set up

slide-55
SLIDE 55

55

Classes of Security Testing

  • Manual vs. Automated Testing
  • Static vs. Dynamic Testing
  • Black vs. White box Testing

Manual Automated Static Dynamic Blackbox Whitebox

Reverse Engineering Risk Analysis Code checking Tainting Fuzzing Dynamic validation Penetration testing

slide-56
SLIDE 56

56

Black vs. White box Testing

  • Black box

– Unknown internal structure – Study Input → Output correlation – Generic technique – Requires end-to-end system – May miss components

slide-57
SLIDE 57

57

Black vs. White box Testing

  • Black box

– Unknown internal structure – Study Input → Output correlation – Generic technique – Requires end-to-end system – May miss components

  • White box

– Known internal structure – Analysis of internal structure – GUI not necessarily required – Thorough testing and debugging – Time consuming

slide-58
SLIDE 58

58

Classes of Security Testing

  • Manual vs. Automated Testing
  • Static vs. Dynamic Testing
  • Black vs. White box Testing

Manual Automated Static Dynamic Blackbox Whitebox

Reverse Engineering Risk Analysis Code checking Tainting Fuzzing Dynamic validation Penetration testing

slide-59
SLIDE 59

59

Static Application Security Testing

  • Reverse engineering (System level)

– Disassemble application to extract internal structure – Black box to White box – Useful for gaining information

slide-60
SLIDE 60

60

Static Application Security Testing

  • Reverse engineering (System level)
  • Risk-based testing (Business level)

– Model worst case scenarios – Threat modelling for test case generation

slide-61
SLIDE 61

61

Static Application Security Testing

  • Reverse engineering (System level)
  • Risk-based testing (Business level)
  • Static code checker (Unit level)

– Checks for rule violations via code structure – Parsers, Control Flow graphs, Data flow analysis – Identifies bad coding practices, potential security issues, etc.

slide-62
SLIDE 62

62

Classes of Security Testing

  • Manual vs. Automated Testing
  • Static vs. Dynamic Testing
  • Black vs. White box Testing

Manual Automated Static Dynamic Blackbox Whitebox

Reverse Engineering Risk Analysis Code checking Tainting Fuzzing Dynamic validation Penetration testing

slide-63
SLIDE 63

63

Dynamic Application Security Testing

  • Taint analysis

– Tracking variable values controlled by user

  • Fuzzing

– Bombard with garbage data to cause crashes

  • Dynamic validation

– Functional testing based on requirements

  • Penetration testing

– End-to-end black box testing

Topic for next lecture

slide-64
SLIDE 64

64

Summary Part I

  • Java vulnerabilities have large attack surfaces
  • Crucial to adapt Secure SDLC
  • Threat modelling can drive test case generation
  • Static analysis checks code without executing it
  • Dynamic analysis executes code and observes behavior
slide-65
SLIDE 65

65

Quiz Time!

Which type of testing aims to convert a black box system to white box? Reverse Engineering

slide-66
SLIDE 66

66

Quiz Time!

Which vulnerability allows a remote attacker to change which instruction will be executed next? Remote Code Execution

slide-67
SLIDE 67

67

Quiz Time!

Why is Java safe from buffer overflows? It’s not!

slide-68
SLIDE 68

68

Agenda for today

  • Part I

– Latest security news – Security vulnerabilities in Java – Types of Security testing

  • SAST vs. DAST
  • Part II

– SAST under the hood

  • Pattern Matching
  • Control Flow Analysis
  • Data Flow Analysis

– SAST Tools performance

slide-69
SLIDE 69

69

Why doesn’t the perfect static analysis tool exist?

slide-70
SLIDE 70

70

Static Analysis

  • Soundness
  • Completeness
slide-71
SLIDE 71

71

Static Analysis

  • Soundness

– No missed vulnerability (0 FNs) – No alarm → no vulnerability exists

  • Completeness
slide-72
SLIDE 72

72

Static Analysis

  • Soundness

– No missed vulnerability (0 FNs) – No alarm → no vulnerability exists

  • Completeness

– No false alarms (0 FPs) – Raises an alarm → vulnerability found

slide-73
SLIDE 73

73

Static Analysis

  • Soundness

– No missed vulnerability (0 FNs) – No alarm → no vulnerability exists

  • Completeness

– No false alarms (0 FPs) – Raises an alarm → vulnerability found

  • Ideally: ↑Soundness + ↑Completeness
  • Reality: Compromise on FPs or FNs
slide-74
SLIDE 74

74

Usable SAST Tools

  • ↓ FPs vs. ↓ FNs
  • ↑ Interpretability
  • ↑ Scalability
slide-75
SLIDE 75

75

SAST under the hood

Pattern matching Regular expressions

slide-76
SLIDE 76

76

SAST under the hood

Pattern matching Syntax analysis Abstract Syntax Tree Control flow graph Data flow analysis Regular expressions

slide-77
SLIDE 77

77

Pattern Matching

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

slide-78
SLIDE 78

78

Pattern Matching

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g

slide-79
SLIDE 79

79

Pattern Matching

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g

bug

slide-80
SLIDE 80

80

Pattern Matching

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g

bug

slide-81
SLIDE 81

81

Pattern Matching

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g

bug

slide-82
SLIDE 82

82

Pattern Matching

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g

bug

slide-83
SLIDE 83

83

Pattern Matching

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g

bug

slide-84
SLIDE 84

84

Pattern Matching

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g

bug

Match!

slide-85
SLIDE 85

85

Pattern Matching via Regex

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g

bag

slide-86
SLIDE 86

86

Pattern Matching via Regex

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g

bag

slide-87
SLIDE 87

87

Pattern Matching via Regex

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g

bag

slide-88
SLIDE 88

88

Pattern Matching via Regex

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g

bag

slide-89
SLIDE 89

89

Pattern Matching via Regex

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “bug”

b u g !b !u !g No Match!

bag

slide-90
SLIDE 90

90

Pattern Matching via Regex

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “.*bug”

b u g !u !g !b

slide-91
SLIDE 91

91

Pattern Matching via Regex

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “.*bug”

b u g !u !g !b

slide-92
SLIDE 92

92

Pattern Matching via Regex

  • Look for predefined patterns in code

– Regular Expressions – Finite State Automata

  • Find all instances of “.*bug.*”

b u g !u !g !b anything

slide-93
SLIDE 93

93

Pattern Matching via Regex

  • Finds low hanging fruit

– Misconfigurations (port 22 open for everyone) – Bad imports (System.io.*) – Call to dangerous functions (strcpy, memcpy)

slide-94
SLIDE 94

94

Pattern Matching via Regex

  • Finds low hanging fruit

– Misconfigurations (port 22 open for everyone) – Bad imports (System.io.*) – Call to dangerous functions (strcpy, memcpy)

  • Shortcomings

– Lots of FPs – Limited support

slide-95
SLIDE 95

95

Pattern Matching via Regex

  • Finds low hanging fruit

– Misconfigurations (port 22 open for everyone) – Bad imports (System.io.*) – Call to dangerous functions (strcpy, memcpy)

  • Shortcomings

– Lots of FPs – Limited support

slide-96
SLIDE 96

96

Pattern Matching via Regex

  • Finds low hanging fruit

– Misconfigurations (port 22 open for everyone) – Bad imports (System.io.*) – Call to dangerous functions (strcpy, memcpy)

  • Shortcomings

– Lots of FPs – Limited support

slide-97
SLIDE 97

97

Syntactic Analysis

  • Performed via Parsers
  • Tokens → Hierarchal data structures

– Parse Tree – Concrete representation – Abstract Syntax Tree – Abstract representation

Lexer Parser

Stream Tokens Parse Tree

slide-98
SLIDE 98

98

Abstract Syntax Tree (AST)

slide-99
SLIDE 99

99

Abstract Syntax Tree (AST)

slide-100
SLIDE 100

100

Abstract Syntax Tree (AST)

5 1 SUB

slide-101
SLIDE 101

101

Abstract Syntax Tree (AST)

5 1 MUL 4 SUB

slide-102
SLIDE 102

102

Abstract Syntax Tree (AST)

5 1 MUL 4 SUM 2 SUB

slide-103
SLIDE 103

103

Abstract Syntax Tree (AST)

slide-104
SLIDE 104

104

Abstract Syntax Tree (AST)

slide-105
SLIDE 105

105

Abstract Syntax Tree (AST)

= DEBUG false

slide-106
SLIDE 106

106

Abstract Syntax Tree (AST)

if = DEBUG false

slide-107
SLIDE 107

107

Abstract Syntax Tree (AST)

if = DEBUG false cond EQ true DEBUG

slide-108
SLIDE 108

108

Abstract Syntax Tree (AST)

if = DEBUG false cond EQ true DEBUG body Println() Debug line 1 Println() Debug line 2 Println() Debug line 3

slide-109
SLIDE 109

109

Abstract Syntax Tree (AST)

if = DEBUG false cond EQ true DEBUG body Println() Debug line 1 Println() Debug line 2 Println() Debug line 3

slide-110
SLIDE 110

110

Syntactic Analysis via AST

SAST Tool

Errors AST Ruleset

slide-111
SLIDE 111

111

Syntactic Analysis via AST

SAST Tool

Errors

Rule # 1: Allow 3 methods

AST Ruleset

slide-112
SLIDE 112

112

Syntactic Analysis via AST

SAST Tool

Errors

Rule # 1: Allow 3 methods

AST Ruleset

slide-113
SLIDE 113

113

Syntactic Analysis via AST

SAST Tool

Errors xyz() abc() akw() blah() class methods members

Rule # 1: Allow 3 methods

AST Ruleset

slide-114
SLIDE 114

114

Syntactic Analysis via AST

SAST Tool

Errors xyz() abc() akw() blah() class methods members

Rule # 1: Allow 3 methods Error: Too many methods!

AST Ruleset

slide-115
SLIDE 115

115

Syntactic Analysis via AST

Rule # 2: printf(format_string, args_to_print) SAST Tool

Errors AST Ruleset

slide-116
SLIDE 116

116

Syntactic Analysis via AST

Rule # 2: printf(format_string, args_to_print) SAST Tool

Errors AST Ruleset

slide-117
SLIDE 117

117

Syntactic Analysis via AST

Rule # 2: printf(format_string, args_to_print)

func x printf = Hello World! x

SAST Tool

Errors AST Ruleset

slide-118
SLIDE 118

118

Syntactic Analysis via AST

Rule # 2: printf(format_string, args_to_print) Error: Missing param!

func x printf = Hello World! x

SAST Tool

Errors AST Ruleset

slide-119
SLIDE 119

119

Control Flow Graphs

  • Shows all execution paths a program might take
  • Trace execution without executing program
  • Nodes → Basic blocks
  • Transitions → Control transfers

https://dzone.com/articles/how-draw-control-flow-graph

slide-120
SLIDE 120

120

Control Flow Graphs

  • Shows all execution paths a program might take
  • Trace execution without executing program
  • Nodes → Basic blocks
  • Transitions → Control transfers

If-then-else while case

https://dzone.com/articles/how-draw-control-flow-graph

slide-121
SLIDE 121

121

Control Flow Graphs

slide-122
SLIDE 122

122

Control Flow Graphs

slide-123
SLIDE 123

123

Control Flow Graphs

slide-124
SLIDE 124

124

Control Flow Graphs

T

slide-125
SLIDE 125

125

Control Flow Graphs

T

slide-126
SLIDE 126

126

Control Flow Graphs

T F

slide-127
SLIDE 127

127

Control Flow Graphs

T F

n=?

Only traces control

slide-128
SLIDE 128

128

Control Flow Graphs

T F

n=?

Only traces control

slide-129
SLIDE 129

129

Control Flow Graphs

T F

n=?

Only traces control

slide-130
SLIDE 130

130

Control Flow Graphs

T F

n=?

Only traces control

slide-131
SLIDE 131

131

Control Flow Graphs

T F

n=?

Only traces control

slide-132
SLIDE 132

132

Control Flow Graphs

T F

n=?

Only traces control

slide-133
SLIDE 133

133

Control Flow Graphs

T F

n=?

Only traces control

slide-134
SLIDE 134

134

Control Flow Graphs

T F

n=?

Only traces control

slide-135
SLIDE 135

135

Data Flow Analysis

  • Tracks data values throughout program
  • Shows all values variables might have
  • User controlled variable (Source) → Tainted
  • Rest (Sink) → Untainted
slide-136
SLIDE 136

136

Data Flow Analysis

  • Prove that

– No untainted data is expected – No tainted data is used

slide-137
SLIDE 137

137

Data Flow Analysis

  • Prove that

– No untainted data is expected – No tainted data is used

SQL st. Sink: Database Source: Contact

slide-138
SLIDE 138

138

Data Flow Analysis

  • Prove that

– No untainted data is expected – No tainted data is used

SQL st. Sink: Database Source: Contact ‘ or 1=1#

slide-139
SLIDE 139

139

Source/Sink Clash

data is tainted println() expects untainted

slide-140
SLIDE 140

140

Data Flow Analysis

  • Reaching definitions

– Top-down approach – Possible values of a variable

slide-141
SLIDE 141

141

Data Flow Analysis

  • Reaching definitions

– Top-down approach – Possible values of a variable

slide-142
SLIDE 142

142

Data Flow Analysis

  • Reaching definitions

– Top-down approach – Possible values of a variable

slide-143
SLIDE 143

143

Data Flow Analysis

  • Reaching definitions

– Top-down approach – Possible values of a variable

slide-144
SLIDE 144

144

Data Flow Analysis

  • Reaching definitions

– Top-down approach – Possible values of a variable

slide-145
SLIDE 145

145

Data Flow Analysis

  • Reaching definitions

– Top-down approach – Possible values of a variable

slide-146
SLIDE 146

146

Data Flow Analysis

  • Reaching definitions

– Top-down approach – Possible values of a variable

slide-147
SLIDE 147

147

Data Flow Analysis

  • Reaching definitions

– Top-down approach – Possible values of a variable

slide-148
SLIDE 148

148

Data Flow Analysis

  • Reaching definitions

– Top-down approach – Possible values of a variable

slide-149
SLIDE 149

149

Data Flow Analysis

  • Reaching definitions

– Top-down approach – Possible values of a variable

slide-150
SLIDE 150

150

slide-151
SLIDE 151

151

b1 b2 b3 b4 b5 b6

slide-152
SLIDE 152

152

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

slide-153
SLIDE 153

153

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

slide-154
SLIDE 154

154

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

slide-155
SLIDE 155

155

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

slide-156
SLIDE 156

156

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

slide-157
SLIDE 157

157

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

slide-158
SLIDE 158

158

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

slide-159
SLIDE 159

159

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

a = {0, 1, 2, 3, …} b = {0, 10} c = {1, b} → {0, 1, 10} Data Flow Analysis

slide-160
SLIDE 160

160

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

a = {0, 1, 2, 3, …} b = {0, 10} c = {1, b} → {0, 1, 10} Data Flow Analysis

slide-161
SLIDE 161

161

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

a = {0, 1, 2, 3, …} b = {0, 10} c = {1, b} → {0, 1, 10} Data Flow Analysis

slide-162
SLIDE 162

162

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

a = {0, 1, 2, 3, …} b = {0, 10} c = {1, b} → {0, 1, 10} Data Flow Analysis

slide-163
SLIDE 163

163

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

a = {0, 1, 2, 3, …} b = {0, 10} c = {1, b} → {0, 1, 10} Data Flow Analysis

slide-164
SLIDE 164

164

a b c b1

  • 1

b2 0, a++

  • b3
  • b4
  • 10
  • b5
  • b

b6

  • b1

b2 b3 b4 b5 b6

a = {0, 1, 2, 3, …} b = {0, 10} c = {1, b} → {0, 1, 10} Data Flow Analysis Sound but imprecise

slide-165
SLIDE 165

165

Data Flow Analysis in Security

  • Source/Sink clash
slide-166
SLIDE 166

166

Data Flow Analysis in Security

  • Source/Sink clash

– Sanitization problems – Code injection (Update attack) – Deserialization vulnerability

slide-167
SLIDE 167

167

Data Flow Analysis in Security

  • Source/Sink clash

– Sanitization problems – Code injection (Update attack) – Deserialization vulnerability

  • Control and Data flow analysis
slide-168
SLIDE 168

168

Data Flow Analysis in Security

  • Source/Sink clash

– Sanitization problems – Code injection (Update attack) – Deserialization vulnerability

  • Control and Data flow analysis

– Type confusion vulnerability – Use-after-free vulnerability

slide-169
SLIDE 169

169

Data Flow Analysis in Security

  • Source/Sink clash

– Sanitization problems – Code injection (Update attack) – Deserialization vulnerability

  • Control and Data flow analysis

– Type confusion vulnerability – Use-after-free vulnerability

  • Denial of Service??
  • Crashes??
slide-170
SLIDE 170

170

  • Open source

– – – SpotBugs – FindSecBugs

  • Proprietary

– Coverity – CheckMarx

Static Analysis Tools

slide-171
SLIDE 171

171

  • Open source

–

  • Ruleset based code checker

–

  • Checks coding standards

– SpotBugs

  • Checks Java bytecode for bad practices, code style, and injections

– FindSecBugs

  • Checks for OWASP Top 10 vulnerabilities
  • Proprietary

– Coverity

  • SAST platform for defects and security vulnerabilities

– CheckMarx

  • Full fledge platform for static analysis and exposure management

Static Analysis Tools

slide-172
SLIDE 172

172

  • Open source

–

  • Ruleset based code checker

–

  • Checks coding standards

– SpotBugs

  • Checks Java bytecode for bad practices, code style, and injections

– FindSecBugs

  • Checks for OWASP Top 10 vulnerabilities
  • Proprietary

– Coverity

  • SAST platform for defects and security vulnerabilities

– CheckMarx

  • Full fledge platform for static analysis and exposure management

Static Analysis Tools

slide-173
SLIDE 173

173

SAST Tools Performance

  • Telenor Digital wants to incorporate security into SDLC
  • Investigate developer perceptions of SAST tools
slide-174
SLIDE 174

174

SAST Tools Performance

  • Using Juliet Test Suite – 24,000 test cases
  • Precision – Ability to guess correct type of flaw
slide-175
SLIDE 175

175

SAST Tools Performance

  • Using Juliet Test Suite – 24,000 test cases
  • Precision – Ability to guess correct type of flaw
  • Recall – Ability to find flaws
slide-176
SLIDE 176

176

SAST Tools Performance

  • Using Juliet Test Suite – 24,000 test cases
  • Precision – Ability to guess correct type of flaw
  • Recall – Ability to find flaws
slide-177
SLIDE 177

177

SAST Dev Perceptions

  • “. . . Making the things actually work, that usually is the worst
  • thing. The hassle-factor is not to be underestimated. . . ”
  • “. . . At least from my experience with the Sonar tool is that it

sometimes complains about issues that are not really issues...”

  • “. . . And of course in itself is not productive, nobody gives you a

hug after fixing SonarQube reports...”

slide-178
SLIDE 178

178

SAST Dev Perceptions

  • “. . . Making the things actually work, that usually is the worst
  • thing. The hassle-factor is not to be underestimated. . . ”
  • “. . . At least from my experience with the Sonar tool is that it

sometimes complains about issues that are not really issues...”

  • “. . . And of course in itself is not productive, nobody gives you a

hug after fixing SonarQube reports...”

  • Using one SAST tool is not enough
  • Low capability of SAST tools in general.
  • Commercial tool not an exception
slide-179
SLIDE 179

179

Summary Part II

  • Perfect static analysis is not possible
  • Pattern matching can find limited but easy to find

problems

  • ASTs make code structure analysis easy
  • Control and Data FGs are better at finding security

vulnerabilities

  • Current SAST Tools are

– Useful – Difficult to integrate – Limited in capabilities

slide-180
SLIDE 180

180

Additional Material

  • https://www.theserverside.com/feature/Stay-ahead-of-Java-security-issues-like-

SQL-and-LDAP-injections

  • https://www.upguard.com/articles/top-10-java-vulnerabilities-and-how-to-fix-

them

  • https://en.wikipedia.org/wiki/Static_program_analysis
  • https://youtu.be/Heor8BVa4A0
  • https://youtu.be/7KCMK-LY-WM
  • Aktas, Kursat, and Sevil Sen. "UpDroid: Updated Android Malware and Its

Familial Classification." Nordic Conference on Secure IT Systems. Springer, Cham, 2018.

Icons courtesy: www.flaticons.com by FlatIcons, FreePik, SmashIcons, Eucalyp, Monkik

slide-181
SLIDE 181

181

Time for questions

slide-182
SLIDE 182

182

Data Flow Analysis

Control

slide-183
SLIDE 183

183

Data Flow Analysis

Control Data

slide-184
SLIDE 184

184

Data Flow Analysis

Control Data a ← {0} a ← {7} a ← {0, 7}

slide-185
SLIDE 185

185

Overflow vulnerability

  • This vulnerability allows remote attackers to execute arbitrary

code on vulnerable installations of Oracle Java. The user must visit a malicious page or open a malicious file to exploit this vulnerability.

  • The flaw exists within the handling of image data. The issue lies

in insufficient validation of supplied image data inside the native function readImage(). An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process.

https://www.zerodayinitiative.com/advisories/ZDI-16-032/