Intrusion Recovery for Database-backed Web Applications Ramesh Chandra , Taesoo Kim, Meelap Shah, Neha Narula, Nickolai Zeldovich MIT CSAIL
Web applications routinely compromised
Web applications routinely compromised
Web applications routinely compromised
Recovering integrity is important ● Preventing intrusions is important, but compromises will still happen ● Vulnerabilities are common, and new bugs are constantly being found [CVE] – 3-4 new vulnerabilities found per day, on average for the past 4 years ● Administrators misconfigure policies, settings ● This talk: recovering integrity after attack
Cross-site scripting (XSS) bugs (simplified) Time Eve's browser Wiki pages table ID Text 5 Welcome!! Alice's browser Wiki Server
Cross-site scripting (XSS) bugs (simplified) Time Eve's browser Edit page: <script>httpReq(“/addAcl?u=Eve”) </script> Wiki pages table ID ID Text Text 5 5 Welcome!! <script>...</script> Alice's browser Wiki Server
Cross-site scripting (XSS) bugs (simplified) Time Eve's browser Wiki pages table ID ID Text Text <script> httpReq(“/addAcl?u=Eve”) 5 5 Welcome!! <script>...</script> </script> Alice's browser Wiki Server
Cross-site scripting (XSS) bugs (simplified) Time Eve's browser Wiki pages table ID ID Text Text <script> httpReq(“/addAcl?u=Eve”) 5 5 Welcome!! <script>...</script> </script> Alice's browser Wiki Server Attack code runs as Alice
Cross-site scripting (XSS) bugs (simplified) Time Eve's browser Wiki pages table ID ID Text Text <script> httpReq(“/addAcl?u=Eve”) 5 5 <script>...</script> Welcome!! </script> Legitimate Alice's requests browser Wiki Server Attack code Add Eve to ACL: runs as Alice /addAcl?u=Eve
Recovering web application integrity is hard ● Web apps store data in shared data store ● Multiple users data is commingled ● Users access each other's data ● Makes recovering from attack complicated: ● Attack propagates across users ● Attack can arbitrarily corrupt user data – e.g., financial information ● Attack can install backdoors – e.g., modify ACLs, install Google apps scripts
Limited recovery tools ● Backup-and-restore tools ● Attack may be detected days or weeks later ● Restoring from backup discards all users' changes ● Manual recovery ● Admin spends days or weeks tracking attack's effects ● Admin could miss a subtle backdoor or corruption
Contributions ● Warp: web application intrusion recovery ● Undoes effects of attack but keeps legitimate changes ● Works for real applications: MediaWiki, Drupal, Gallery2 ● Key ideas: ● Retroactive patching eliminates need to pinpoint attack ● Time-travel DB precisely tracks causal effects ● DOM-level replay preserves users' intended changes
High-level approach: rollback and re-execute ● Normal execution ● Record actions in system to a log ● Record causal dependencies between actions ● Record checkpoints system state ● Repair ● Identify attack action ● Rollback affected system state to before attack ● Replay all affected actions except attack action
Normal execution Time Eve's browser Eve's Req Wiki pages table ID Text 5 <script>...</script> ID Text 5 Welcome!! Dependencies Dependencies Alice's Req Alice's Warp logs browser Warp state … … Wiki Server
Normal execution Time Eve's browser Eve's Req Wiki pages table ID Text Log HTTP requests 5 <script>...</script> Log database ID Text queries 5 Welcome!! Server actions Server Server actions Dependencies Dependencies Alice's Req Alice's Warp logs browser Warp state … … Wiki Server
Normal execution Time Eve's browser Eve's Req Wiki pages table ID Text ID Text 5 Welcome!! Maintain 5 <script>...</script> ID Text checkpoints Checkpoints of database 5 Welcome!! Server actions Server actions Server Server Server actions Server actions Dependencies Dependencies Dependencies Dependencies Alice's Req Alice's Warp logs Warp logs browser Warp state Warp state … … Wiki Server
Normal execution Time Eve's browser Eve's Req Wiki pages table ID Text ID Text Record 5 Welcome!! 5 <script>...</script> user actions ID Text using a browser Checkpoints 5 Welcome!! extension Server actions Server Server actions Dependencies Dependencies Alice's Req Alice's Client actions Client actions Warp logs browser Warp state … … Wiki Server Client actions
Strawman repair Time Eve's browser Eve's Req Wiki pages table ID Text ID Text 5 Welcome!! 5 <script>...</script> ID Text Checkpoints 5 Welcome!! Server actions Server Server actions Dependencies Dependencies Alice's Req Alice's Warp client log Client actions Client actions Warp logs browser Warp state … … Wiki Server
Repair: identify attack Time Eve's browser Eve's Req Wiki pages table ID Text ID Text Attack action 5 Welcome!! 5 <script>...</script> ID Text Checkpoints 5 Welcome!! Server actions Dependencies Alice's Req Alice's Client actions browser Warp state … … Wiki Server
Repair: rollback to before attack Time Eve's browser Eve's Req Wiki pages table ID Text Rollback DB 5 Welcome!! ID Text Checkpoints 5 Welcome!! Server actions Server Server actions Dependencies Dependencies Alice's Req Alice's Warp client log Client actions Client actions Warp logs browser Warp state … … Wiki Server
Repair: skip attack action X Time Eve's X browser X Eve's Req X Wiki pages table ID Text 5 Welcome!! ID Text Checkpoints 5 Welcome!! Server actions Server Server actions Dependencies Dependencies Alice's Req Alice's Warp client log Client actions Client actions Warp logs browser Warp state … … Wiki Server
Repair: re-execute subsequent actions X Time Eve's X browser X Eve's Req X Wiki pages table ID Text Re-execute Alice's actions in 5 Welcome!! shadow browser Checkpoints Server actions Server Server actions Dependencies Dependencies Alice's Req Alice's Warp client log Client actions Client actions Warp logs browser Warp state … … Wiki Server Warp client log Client actions
Repair: re-execute subsequent actions X Time Eve's X browser X Eve's Req X Wiki pages table ID Text 5 Welcome!! New response: Welcome!! Checkpoints Server actions Server Server actions Dependencies Dependencies Alice's Req Alice's Warp client log Client actions Client actions Warp logs browser Warp state … … Wiki Server Warp client log Client actions No attack code
Repair: re-execute subsequent actions X Time Eve's X browser X Eve's Req X Wiki pages table ID Text 5 Welcome!! Checkpoints Server actions Server Server actions Preserve Dependencies Dependencies Alice's Req legitimate requests Alice's Warp client log Client actions Client actions Warp state browser Warp state X … … Wiki Server Client actions Skip attack requests
Challenges to intrusion recovery X Time Eve's X browser Wiki pages table ID Text ID Text 5 Welcome!! 5 Welcome!! Alice's browser X Wiki Server
Challenges to intrusion recovery X Time Eve's Must pinpoint X browser intrusion in a complex app Wiki pages table ID Text ID Text 5 Welcome!! 5 Welcome!! Alice's browser X Wiki Server
Challenges to intrusion recovery X Time Eve's Must pinpoint X browser intrusion in a complex app Bob's Wiki pages table Must reduce browser unnecessary ID Text ID Text re-execution 5 Welcome!! 5 Welcome!! Alice's browser X Wiki Server
Challenges to intrusion recovery X Time Eve's Must pinpoint X browser intrusion in a complex app Bob's Wiki pages table Must reduce browser unnecessary ID Text ID Text re-execution 5 Welcome!! 5 Welcome!! Alice's Must reduce browser X user involvement during repair Wiki Server
Challenge 1: intrusion detection is difficult Time Eve's browser Need expert Wiki pages table to pinpoint attack ID Text ID ID Text Text 5 Welcome!! 5 5 Welcome!! <script>...</script> Alice's browser Wiki Server
Idea: retroactive patching ● Key observation: patch renders attacks harmless ● Approach: ● Retroactively apply security patches back in time ● Re-execute all affected requests
Retroactive patching Time Eve's browser Eve's Req Wiki pages table ID Text ID Text 5 Welcome!! 5 <script>...</script> ID Text 5 Welcome!! Alice's Req Alice's browser … … Wiki Server
Retroactive patching: normal execution Time Eve's main.php browser Eve's Req Wiki pages table ID Text ID Text 5 Welcome!! 5 <script>...</script> ID Text 5 Welcome!! Alice's Req Alice's browser … … Wiki Server
Retroactive patching: repair Time Eve's main.php browser Eve's Req Wiki pages table ID Text ID Text 5 Welcome!! 5 <script>...</script> ID Text 5 Welcome!! Alice's Req Alice's browser … … Wiki Server
Recommend
More recommend
