End-to-end Protection of Web Services. Tracking. Hao Chen and Benjamin Davis UC Davis. Web services are highly attractive targets

of Web Services

with Information Flow

with Information Flow

Tracking

H

Ch

d B j

i D i

Hao Chen and Benjamin Davis

UC Davis

MURI Final Review Briefing

June 13, 2012

Helix MURI Project -- http://helix.cs.virginia.edu



Web services are highly attractive targets

Over 60% of attacks target Web applications

O e 60% o attac s ta get eb app cat o s

Over 80% of vulnerabilities found are in Web

<h1>Latest Comment</h1>

<p>

</p>

<h1>Latest Comment</h1>

<p>

This is <b>great!</b>

<h1>Latest Comment</h1>

<p>

<script>

steal(document.cookie);

</script>

</script>

</p>

Information Flow Tracking System Application   Input !! 7 7   Information Flow Tracking System Application  

Information Flow Tracking System Application   !! 9 9  !!  Information Flow Tracking System Application   !!  !!  Output !!

Information Flow Tracking System Application   !!

X

X



Language-based “taint mode”

◦

_Perl

◦

_Ruby



Adding support to language structures

◦

_{Java [Chin, Wagner 09]}

◦

_{PHP [Venema]}

Information Flow Tracking System Web Application Input Database Interface Database 13 13 Output Information Flow Tracking System Web Application Input Database Interface Database   !! Output  

Information Flow Tracking System Web Application Input Database Interface Database   15 15 Output  !!  Information Flow Tracking System Input Database Interface Database   !!

Information Flow Tracking System Web Application Input Database Interface Database   !! 17 17 Output   Information Flow Tracking System Web Application Input Database Interface Database   ? Output  

Information Flow Tracking System Web Application Input Database Interface Database   ? 19 19 Output   Information Flow Tracking System Input Database Interface Database   ?



What if you have multiple applications?

How to treat data from the database?

o to t eat data o t e database

◦

_{All tainted -> false positives}

◦

_{All untainted -> false negatives}

◦

_{Require manual annotation?}

◦

_{Application-specific decisions?}

21

21



Taint tracking through the entire system

◦

_{[Asbestos, 05]}

◦

_{[HiStar, 06]}

Implemented in

◦

_Hardware

◦

_OS

◦

_VMM/emulator

Web Application Input Database Interface Database !! 23 23 Output Input Database Interface Database

Web Application Input Database Interface Database !! 25 25 Output Web Application Input Database Interface Database Output



Low level/fine granularity

◦

_{Hardware mechanism [Suh, Lee, Devadas 04]}

◦

_{Minos [Crandall, Chong, 04]}



Lacks high-level database semantics

◦

_{Aggregate functions}

◦

_{Comparisons, SELECT DISTINCT}

27

27



End-to-end taint tracking

◦

_{Across Web applications and databases}



Leverage existing single-application

information flow tracking engines



Compatible with existing Web services

DB Interface W b A li i Database Engine SQL 29 29 Web Application DBT i DB Interface W b A li i Database Engine SQL DBTaint Web Application



Store taint data in database composite types

◦

_{Tuple of form: (<value>, <taint_value>)}



Store/retrieve taint values via SQL

◦

_{No additional mechanisms needed in the database}

◦

_{No change to underlying database data structures}

Id Status (19 0) (‘ l d’ 1) Id Status 19 ‘ l d’ 31 31 (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32, 0) (‘pending, 1) 19 ‘closed’ 27 ‘open’ 32 ‘pending’

Before DBTaint With DBTaint



Create functions that operate on composite

types

yp

◦

_{Comparison operators (=, !=, <, …)}

◦

_{Arithmetic operations (+, -, …)}

◦

_{Text operations (upper, lower, …)}

◦

_{Aggregate functions (MAX, MIN, SUM, …)}



Arithmetic operations

(4 0) + (5 1) (9 ?)

(4, 0) + (5, 1) = (9, ?)

Arithmetic operations

(4 0) + (5 1) (9 ?)

(4, 0) + (5, 1) = (9, ?)



Arithmetic operations

(4 0) + (5 1) (9 1)

(4, 0) + (5, 1) = (9, 1)

untainted tainted tainted

35

35



MAX

{(2 0) (3 1) (5 0)} = (5 ?)

{(2, 0), (3, 1), (5, 0)} = (5, ?)



MAX

{(2 0) (3 1) (5 0)} = (5 ?)

{(2, 0), (3, 1), (5, 0)} = (5, ?)

untainted tainted untainted

37

37



Untainted: trusted source

◦

_{Web application defaults}

◦

_{Values generated entirely by the Web application}



Tainted: from untrusted source, or unknown

◦

_{User input}



Explicit information flow

b

d l

l f



Database returns untainted value only if



MAX

{(2 0) (3 1) (5 0)} = (5 ?)

{(2, 0), (3, 1), (5, 0)} = (5, ?)

untainted tainted untainted

39

39



MAX

{(2 0) (3 1) (5 0)} = (5 0)

{(2, 0), (3, 1), (5, 0)} = (5, 0)



Equality

(3 0)

?

(3 1)

(3, 0) = (3, 1)

?

Equality

3

3

3 == 3



Equality

(3 0)

(3 1)

(3, 0) == (3, 1)

untainted tainted

43



Adopt notion of backwards-compatibility

[Chin, Wagner 09]

MAX

{(5 1) (5 0)} (5 ?)

{(5, 1), (5, 0)} = (5, ?)



MAX

{5 5} 5

{5, 5} = 5

MAX

{5 5} 5

{5, 5} = 5

OR



MAX

{(5 1) (5 0)} (5 ?)

{(5, 1), (5, 0)} = (5, ?)

OR

MAX

{(5 1) (5 0)} (5 0)

{(5, 1), (5, 0)} = (5, 0)

DB Interface Database Table Id Status 19 ‘closed’ 27 ‘open’ 32 ‘ di ’ 49 49 WebApp 32 ‘pending’

DB Interface Database Table

x = DB.get(id=27) Id₁₉ Status_‘closed’

27 ‘open’

32 ‘ di ’

WebApp

DB Interface Database Table x = DB.get(id=27) Id₁₉ Status_‘closed’

27 ‘open’ 32 ‘ di ’ 51 51 WebApp 32 ‘pending’

DB Interface Database Table

DB Interface Database Table x = “open” Id Status 19 ‘closed’ 27 ‘open’ 32 ‘ di ’ 53 53 WebApp 32 ‘pending’ DBTaint

DB Interface Database Table

Id Status (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32 0) (‘pending 1) DBTaint WebApp (32, 0) (‘pending, 1)

DBTaint Database Table Id Status (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32 0) (‘pending 1) x = DB.get(id=27) DB Interface DBTaint 55 55 WebApp (32, 0) (‘pending, 1) DBTaint Database Table

Rewritten query Id Status

(19, 0) (‘closed’, 1) DB Interface

DBTaint

Database Table

Result tuples Id Status

(19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32 0) (‘pending 1) DB Interface DBTaint 57 57 WebApp (32, 0) (‘pending, 1) DBTaint Database Table Id Status (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32 0) (‘pending 1) DB Interface DBTaint Collapse tuples and taint appropriatel y WebApp (32, 0) (‘pending, 1) y

DBTaint Database Table x = “open” // x is tainted Id Status (19, 0) (‘closed’, 1) (27, 0) (‘open’, 1) (32 0) (‘pending 1) DB Interface DBTaint 59 59 WebApp (32, 0) (‘pending, 1)



Account for composite types in SQL queries

Collapse and taint result tuples as needed

Co apse a d ta t esu t tup es as eeded

These changes are:

◦

_{Transparent to web application}

◦

_{High-level, portable}



Parameterized queries

Prepare:

epa e

◦

_{INSERT … (id, status) VALUES (?, ?)}

◦

_Execute

◦

_{(27, ‘open’)}

Parameterized queries

Prepare:

epa e

◦

_{INSERT … (id, status) VALUES (?, ?)}

◦

_{// with DBTaint:}



Parameterized queries

Prepare:

epa e

◦

_{INSERT … (id, status) VALUES (?, ?)}

◦

_{// with DBTaint:}

◦

_{INSERT … (id, status) VALUES (}

_{ROW(?, ?)}

_,

_{ROW(?, ?)}

₎

◦

_Execute

(27 ‘

’) // 27 i

t i t d ‘

’ i t i t d

63

63

◦

_{(27, ‘open’) // 27 is untainted, ‘open’ is tainted}

◦

_{// with DBTaint:}

◦

_(27,

₀

_{, ‘open’,}

₁

₎



Prepare phase:

◦

_{Queries are passed with placeholders for data}



Execute phase:

◦

_{Data values are passed separately, independently}



Taint tracking engine requirement:



Leverage existing single-application

information flow tracking systems

g y



No changes to Web application

DBTaint 65 65 DB Interface Web Application Single-application information flow 

Languages

◦

_Perl

◦

_Java

Database Interfaces

◦

_{Perl DataBase Interface (DBI)}

◦

_{Java Database Connectivity (JDBC)}

D t b



Database



RT: Request Tracker (ticket tracking system)

◦

_{60,000+ lines of Perl}

◦

_{Perl DBI (DataBase Interface) API}

◦

_{Perl taint mode}



JForum (discussion board system)

◦

_{30,000+ lines of Java}

◦

_{Java Database Connectivity (JDBC) API}

◦

_{Character-level taint engine [Chin Wagner ’09]}

67

◦

_{Character level taint engine [Chin, Wagner 09]}

67

requests/second

RT



Cross-application information flow tracking

Persistent taint tracking

e s ste t ta t t ac

g



Multiple Web applications, multiple Databases

69

69



End-to-end information flow through Web

services



Compatible with existing Web services

◦

_{Requires no changes to Web applications}



Taint propagation through database