Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis...
Transcript of Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis...
![Page 1: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/1.jpg)
Dytan: A Generic Dynamic Taint Analysis
FrameworkJames Clause, Wanchun (Paul) Li,
and Alessandro OrsoCollege of Computing
Georgia Institute of Technology
Partially supported by:NSF awards CCF-0541080 and CCR-0205422 to Georgia Tech,
DHS and US Air Force Contract No. FA8750-05-2-0214
![Page 2: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/2.jpg)
C
A
B Z
C
A
B
31
2
Z
C
A
B
31
2
Z
3
Dynamic taint analysis(aka dynamic information-flow analysis)
![Page 3: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/3.jpg)
Dynamic tainting applications
Information policy enforcement
Attack detection / prevention
Testing
Data lifetime / scope
![Page 4: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/4.jpg)
Dynamic tainting applications
Information policy enforcement
Attack detection / prevention
Testing
Data lifetime / scope
Attack detection / preventionDetect / prevent attacks such as SQL injection, buffer overruns,
stack smashing, cross site scriptinge.g., Suh et al. 04, Newsome and Song 05,
Halfond et al. 06, Kong et al. 06, Qin et al. 06
![Page 5: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/5.jpg)
Dynamic tainting applications
Information policy enforcement
Attack detection / prevention
Testing
Data lifetime / scope
Information policy enforcementensure classified information does not leak outside the system
e.g.,Vachharajani et al. 04, McCamant and Ernst 06
![Page 6: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/6.jpg)
Dynamic tainting applications
Information policy enforcement
Attack detection / prevention
Testing
Data lifetime / scope
TestingCoverage metrics, test data generation heuristic, ...
e.g., Masri et al 05, Leek et al. 07
![Page 7: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/7.jpg)
Dynamic tainting applications
Information policy enforcement
Attack detection / prevention
Testing
Data lifetime / scopeData lifetime / scopetrack how long sensitive data, such as passwords or account
numbers, remain in the applicatione.g., Chow et al. 04
![Page 8: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/8.jpg)
MotivationAd-hoc taint analysis
implementationResults
Ad-hoc taint analysis implementation
Ad-hoc taint analysis implementation
Results
Results
Ad-hoc taint analysis implementation
Results
![Page 9: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/9.jpg)
Motivation
•Flexible
• Easy to use
•Accurate
Configuration
Dytan Generic Framework
Custom Dynamic Taint Analysis Results
![Page 10: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/10.jpg)
Outline
! Motivation & overview
• Framework (Dytan)
• flexibility
• ease of use
• accuracy
• Empirical evaluation
• Conclusions
![Page 11: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/11.jpg)
Framework: flexibility
Taint
sources
Propagation
policy
Taint
sinksConfiguration
![Page 12: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/12.jpg)
Framework: flexibility
Taint
sources
Propagation
policy
Taint
sinks
![Page 13: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/13.jpg)
Framework: flexibility
Taint
sources
Taint
sources
Propagation
policy
Taint
sinks
Which data to tag, and how to tag it
![Page 14: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/14.jpg)
Framework: flexibility
Propagation
policy
Taint
sources
Propagation
policy
Taint
sinks
How tags should be propagated at runtime
![Page 15: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/15.jpg)
Framework: flexibility
Taint
sinks
Taint
sources
Propagation
policy
Taint
sinks
Where and how tags should be checked
![Page 16: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/16.jpg)
Taint sources
What to tag How to tagIdentify what program data should be assigned tags
• Variables (local or global)
• Function parameters
• Function return values
• Data from an input streamnetwork, filesystem, keyboard, ...
• Specific input stream141.195.121.134:80, a.txt,...
Describe how tags should be assigned for identified data
• Single tag
• One tag per source
• Multiple tags per source
• ...
![Page 17: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/17.jpg)
a.txta.txt
Taint sourcesWhat to tag: a.txt
How to tag: single tag
a.txt
1 1 1 1 1 1
![Page 18: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/18.jpg)
a.txta.txt
Taint sourcesWhat to tag: a.txt
a.txt
1 1 1 1 1 12 31 4 5 n
How to tag: multiple tags
![Page 19: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/19.jpg)
Affecting data Mapping functionData that affects the outcome of a statement through
• Data dependencies
• Control dependencies
A policy can consider both or only data dependencies
Define how tags associated with affecting data should be combined
• Union
• Max
• ...
Propagation policy
3
B
A
12
3C
![Page 20: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/20.jpg)
3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence
union
max
![Page 21: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/21.jpg)
3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence!
union
max!
!
1 2
![Page 22: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/22.jpg)
3
if(X) {
C = A + B;
}
1 2
Propagation policy
Affecting data:
control dependence
Mapping function:
data dependence!
union
max
!
!
3
![Page 23: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/23.jpg)
Where to check What to checkLocation in the program to perform a check
• Function entry / exit
• Statement type
• Specific program point
The data whose tags should be checked
• Variables
• Function parameters
• Function return value
Taint Sinks
How to checkSet of conditions to check and a set of actions to perform if the conditions are not met.
• validate presence of tags (exit or log)
• ensure absence of tags (exit or log)
• ...
![Page 24: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/24.jpg)
Taint Sinks
cmd = read(file);
args = read(socket);
cmd = trim(cmd + args);
...
tok[] = parse(cmd);
exec(tok[0], tok[1]);
2
3
![Page 25: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/25.jpg)
validate presence of:
validate absence of:
Taint Sinks
function: exec, param: 0
Where / what to check:
How to check:
Result:
cmd = read(file);
args = read(socket);
cmd = trim(cmd + args);
...
tok[] = parse(cmd);
exec(tok[0], tok[1]);
23
2
3
![Page 26: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/26.jpg)
validate presence of:
validate absence of:
Taint Sinks
function: exec, param: 0
Where / what to check:
How to check:
Result:
cmd = read(file);
args = read(socket);
cmd = trim(cmd + args);
...
tok[] = parse(cmd);
exec(tok[0], tok[1]);
"
23
2
3
2 3
![Page 27: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/27.jpg)
Framework: ease of use
• Basic
• Select sources, propagation policies, and sinks from a set of predefined options
• XML based configuration
• Advanced
• Suitable for more esoteric applications
• Extend OO implementation
Provide two ways to configure the framework
![Page 28: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/28.jpg)
Framework: accuracy
• Dytan operates at the binary level
• consider the actual program semantics
• transparently handle libraries
• Dytan accounts for both data- and control-flow dependencies
![Page 29: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/29.jpg)
• Address Generators
add %eax, %ebx // A = A + Bconsumed: %eax, [%ebx] , %ebx
Two common examples:
• Implicit operands
add %eax, %ebx // A = A + Bproduced: %eax , %eflags
Framework: accuracyThe most common source of inaccuracy is
incorrectly identifying the informationproduced and consumed by a statement
[ ] *
![Page 30: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/30.jpg)
Outline
! Motivation & overview
! Framework
! flexibility
! ease of use
! accuracy
• Empirical evaluation
• Conclusions
![Page 31: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/31.jpg)
Empirical evaluation
• RQ1: Can Dytan be used to (easily) implement existing dynamic taint analyses?
• RQ2: How do inaccurate propagation policies affect the analysis results?
• In addition: discussion on performance
![Page 32: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/32.jpg)
RQ1: flexibility
• Selected two techniques:
• Overwrite attack detection [Qin et al. 04]
• SQL injection detection [Halfond et al. 06]
• Used Dytan to re-implement both techniques
• Measure implementation time
• Validate against the original implementation
Goal: show that Dytan can be used to (easily) implement existing dynamic taint analyses
![Page 33: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/33.jpg)
RQ1: results
• Implementation time:
• Overwrite attack detection: < 1 hour
• SQL injection detection: < 1 day
• Comparison with original implementations:
• Successfully stopped same attacks as the original implementations
![Page 34: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/34.jpg)
RQ2: accuracy impact
• Selected two subjects:
• Gzip (75kb w/o libraries)
• Firefox (850kb w/o libraries)
• Use Dytan to taint program inputs and measure the amount of heap data tainted at program exit
• Compare Dytan against inaccurate policies
• no implicit operands (no IM)
• no address generators (no AG)
• no implicit operands, no address generators (no IM, no AG)
Goal: measure the effect of inaccurate propagation policies on analysis results
![Page 35: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/35.jpg)
RQ2: results
0%
25%
50%
75%
100%
Firefox (1 page) Firefox (3 pages) Gzip
Dytan No IM No AG No IM, no IG
![Page 36: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/36.jpg)
Performance
• In line with existing implementations
• Designed for experimentation
• Favors flexibility over performance
• Implementation can be further optimized
• Measured for gzip:
!30x for data flow
!50x for data and control flow
• High overhead, but...
![Page 37: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/37.jpg)
Related work
• Existing dynamic tainting approaches [Suh et al. 04, Newsome and Song 05, Halfond et al. 06, Kong et al. 06, ...]
• Ad-hoc
• Other dynamic taint analysis frameworks [Xu et al. 06 and Lam and Chiueh 06]
• Focused on security applications
• Single taint mark
• No control-flow propagation
• Operate at the source code level
![Page 38: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/38.jpg)
Conclusions
• Dytan
• a general framework for dynamic tainting
• allows for instantiating and experimenting with different dynamic taint analysis approaches
• Initial evaluation
• flexible
• easy to use
• accurate
![Page 39: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/39.jpg)
Future directions
• Tool release (documentation, code cleanup)
http://www.cc.gatech.edu/~clause/dytan/
(pre-release on request)
• Optimization (general and specific)
• Applications
• Memory protection
• Debugging
![Page 40: Dytan: A Generic Dynamic Taint Anal ysis Frame w ork...Dytan: A Generic Dynamic Taint Anal ysis Frame w ork James Clause , W anchun (Paul) Li, and Alessandr o Orso College of Computing](https://reader033.fdocuments.net/reader033/viewer/2022053118/609bdb981ca6137dba7be23a/html5/thumbnails/40.jpg)
Questions?
http://www.cc.gatech.edu/~clause/dytan/