APISan: Sanitizing API Usages through Semantic Cross-checking Insu - PowerPoint PPT Presentation

APISan: Sanitizing API Usages through Semantic Cross-checking Insu Yun, Changwoo Min, Xujie Si, Yeongjin Jang, Taesoo Kim, Mayur Naik Georgia Institute of Technology 1

APIs in today’s software are plentiful yet complex • Example: OpenSSL - 3841 3841 APIs in [v1.0.2h] - 3718 in [v1.0.1t] -> 3841 in [v1.0.2h] ( +1 +123 APIs) - OpenSSH uses 158 158 APIs of OpenSSL 2

Complex APIs result in programmers’ mistakes • Problems in documentation - Incomplete: e.g., low details in hostname verification - Long: e.g., 43K lines in OpenSSL documentation - Lack: e.g., internal APIs • Lack of automatic tool support - e.g., missing formal specification and precise semantics 3

Problem: API misuse can cause security problems 4

Problem: API misuse can cause security problems à MITM 5

Problem: API misuse can cause security problems à Code execution 6

Problem: API misuse can cause security problems à Privilege Escalation 7

Today’s practices to help programmers • Formal method - Problem: lack of specification • Model checking - Problem: manual, lack of semantic context • Symbolic execution - Problem : failed to scale for large software 8

Promising approach: finding bugs by using existing code • “Bugs as deviant behavior”[OSDI01] - Syntactic template: e.g., check NULL on malloc() • “Juxta”[SOSP15] - Inferring correct semantics from multiple of implementations - File system specific bug finding tool 9

Promising approach: finding bugs by using existing code • “Bugs as deviant behavior”[OSDI01] - Syntactic template: e.g., check NULL on malloc() • “Juxta”[SOSP15] Research goal: can we apply this method to - Inferring correct semantics from multiple of implementations any kind of software without manual efforts ? - File system specific bug finding tool 10

Our idea: comparing API usages in various implementation • Example: finding OpenSSL API misuses … curl nginx nmap hexchat curl curl curl curl nginx nginx curl nmap APISan Majority uses Deviant uses ( Likely correct ) ( Likely bug) 11

Our idea: comparing API usages in various implementation • Example: finding OpenSSL API misuses … curl nginx nmap hexchat curl curl curl curl nginx nginx curl nmap APISan Majority uses Deviant uses ( Likely correct ) ( Likely bug) 12

Our idea: comparing API usages in various implementation • Example: finding OpenSSL API misuses … curl nginx nmap hexchat curl curl curl curl nginx nginx curl nmap APISan Majority uses Deviant uses ( Likely correct ) ( Likely bug) 13

Our idea: comparing API usages in various implementation • Example: finding OpenSSL API misuses … curl nginx nmap hexchat curl curl curl curl nginx nginx curl nmap APISan Majority uses Deviant uses ( Likely correct ) ( Likely bug) 14

Our approach is very promising • Effective in finding API misuses - 76 new bugs • Scale to large, complex software - Linux kernel, OpenSSL, PHP, Python, etc. - Debian packages 15

Technical Challenges • API uses are too different from impl. to impl. • Subtle semantics of the correct API uses • Large, complex code using APIs 16

Example: OpenSSL API uses • SSL_get_verify_result() - Get result of peer certificate verification if (SSL_get_verify_result() == X509_V_OK) { … } 17

Example: OpenSSL API uses • SSL_get_verify_result() - Get result of peer certificate verification - no no peer ce certificate à alw always retu turns X509_V_ V_OK OK if (SSL_get_verify_result() == X509_V_OK) { … } 18

Example: OpenSSL API uses • SSL_get_verify_result() - Get result of peer certificate verification - no no peer ce certificate à alw always retu turns X509_V_ V_OK OK if (SSL_get_verify_result() == X509_V_OK && SSL_get_peer_certificate() != NULL ) { … } 19

Example: a correct implementation using OpenSSL API cert = SSL_get_peer_certificate(handle); if (!cert) {…} if err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } if cu curl 20

Example: a correct implementation using OpenSSL API cert = SSL_get_peer_certificate(handle); if (!cert) {…} if err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } if cu curl 21

Example: a correct implementation using OpenSSL API cert = SSL_get_peer_certificate(handle); if (!cert) {…} if err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } if cu curl 22

Example: a correct implementation using OpenSSL API cert = SSL_get_peer_certificate(handle); if (!cert) {…} if err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } if cu curl 23

Example: a correct implementation using OpenSSL API cert = SSL_get_peer_certificate(handle); if (!cert) {…} if err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } if cu curl 24

Example: a correct implementation using OpenSSL API Semantically same with correct usage cert = SSL_get_peer_certificate(handle); if (!cert) {…} if err = SSL_get_verify_result(handle); if (SSL_get_verify_result() == X509_V_OK if (err == X509_V_OK) { … } if && SSL_get_peer_certificate() != NULL ) { … } cu curl 25

Example: a correct implementation using OpenSSL API Correct cert = SSL_get_peer_certificate(handle); if (!cert) {…} if err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } if cu curl 26

Example: providing various implementations using OpenSSL Correct cert = SSL_get_peer_certificate(handle); if (SSL_get_verify_result(conn) != X509_V_OK) if (!cert) {…} return NGX_OK; err = SSL_get_verify_result(handle); cert = SSL_get_peer_certificate(conn); if (err == X509_V_OK) { … } if (cert) { … } ng ngin inx curl cu err = SSL_get_verify_result(ssl); cert = SSL_get_peer_certificate(ssl); switch(err) { if (cert == NULL) case X509_V_OK: return 0; cert = SSL_get_peer_certificate(ssl); if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap he hexcha hat 27

Example: providing various implementations using OpenSSL Correct cert = SSL_get_peer_certificate(handle); if (SSL_get_verify_result(conn) != X509_V_OK) if (!cert) {…} return NGX_OK; err = SSL_get_verify_result(handle); cert = SSL_get_peer_certificate(conn); if (err == X509_V_OK) { … } if (cert) { … } ng ngin inx curl cu err = SSL_get_verify_result(ssl); cert = SSL_get_peer_certificate(ssl); switch(err) { if (cert == NULL) case X509_V_OK: return 0; cert = SSL_get_peer_certificate(ssl); if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap he hexcha hat 28

Example: providing various implementations using OpenSSL Correct Correct cert = SSL_get_peer_certificate(handle); if (SSL_get_verify_result(conn) != X509_V_OK) if (!cert) {…} return NGX_OK; err = SSL_get_verify_result(handle); cert = SSL_get_peer_certificate(conn); if (err == X509_V_OK) { … } if (cert) { … } ngin ng inx curl cu err = SSL_get_verify_result(ssl); cert = SSL_get_peer_certificate(ssl); switch(err) { if (cert == NULL) case X509_V_OK: return 0; cert = SSL_get_peer_certificate(ssl); if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap he hexcha hat 29

Example: providing various implementations using OpenSSL Correct Correct cert = SSL_get_peer_certificate(handle); if (SSL_get_verify_result(conn) != X509_V_OK) if (!cert) {…} return NGX_OK; err = SSL_get_verify_result(handle); cert = SSL_get_peer_certificate(conn); if (err == X509_V_OK) { … } if (cert) { … } ngin ng inx curl cu err = SSL_get_verify_result(ssl); cert = SSL_get_peer_certificate(ssl); switch(err) { if (cert == NULL) case X509_V_OK: return 0; cert = SSL_get_peer_certificate(ssl); if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap he hexcha hat 30

Example: providing various implementations using OpenSSL Correct Correct cert = SSL_get_peer_certificate(handle); if (SSL_get_verify_result(conn) != X509_V_OK) if (!cert) {…} return NGX_OK; err = SSL_get_verify_result(handle); cert = SSL_get_peer_certificate(conn); if (err == X509_V_OK) { … } if (cert) { … } ng ngin inx cu curl Correct err = SSL_get_verify_result(ssl); cert = SSL_get_peer_certificate(ssl); switch(err) { if (cert == NULL) case X509_V_OK: return 0; cert = SSL_get_peer_certificate(ssl); if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap he hexcha hat 31

Example: providing various implementations using OpenSSL Correct Correct cert = SSL_get_peer_certificate(handle); if (SSL_get_verify_result(conn) != X509_V_OK) if (!cert) {…} return NGX_OK; err = SSL_get_verify_result(handle); cert = SSL_get_peer_certificate(conn); if (err == X509_V_OK) { … } if (cert) { … } ng ngin inx curl cu Correct err = SSL_get_verify_result(ssl); cert = SSL_get_peer_certificate(ssl); switch(err) { if (cert == NULL) case X509_V_OK: return 0; cert = SSL_get_peer_certificate(ssl); if (SSL_get_verify_result(ssl) != X509_V_OK) {…} // // if (cer cert) is missed ed nmap nmap he hexcha hat 32