PHP Aspis: Using Partial Taint Tracking To Protect Against Injection Attacks Ioannis Papagiannis , Matteo Migliavacca, Peter Pietzuch Department of Computing, Imperial College London USENIX WebApps 2011 Portland, OR, USA
Injection Vulnerability Example <?php $name=$GET[„name‟]; $sql = “SELECT * FROM USERS WHERE user=”. $name; mysql_query($sql); ?> USENIX WebApps 2011 2
Injection Vulnerability Example http://…?name= <?php $name=$GET[„name‟]; $sql = “SELECT * FROM USERS WHERE user=”. ; mysql_query($sql); ?> USENIX WebApps 2011 3
Sanitisation http://…?name= Yiannis <?php $name=$GET[„name‟]; $sql = “ SELECT * FROM USERS WHERE user=”. ; mysql_query($sql); ?> USENIX WebApps 2011 4
Taint Tracking <?php 1 taint data in entry points $name=$GET[„name‟]; $sql = “SELECT * FROM USERS propagate taint 2 WHERE user=”. $name; use taint to guide sanitisation 3 mysql_query($sql); ?> USENIX WebApps 2011 5
Taint Tracking in PHP No support taint 1. Suggested but ignored tracking [Venema06] 2. Custom research interpreters [Yip09, Pietraszek06] “modifications to the Zend engine should be avoided. Changes here result in incompatibilities with the rest of the world, and hardly anyone will ever adapt to specially patched Zend engines. … Therefore, this method is generally considered bad practice” The PHP Manual USENIX WebApps 2011 6
PHP is popular data provided by langpop.com USENIX WebApps 2011 7
PHP Aspis Contributions taint tracking! 1 Source-to-source transformations 2 Partial Taint Tracking USENIX WebApps 2011 8
PHP Aspis Contributions taint tracking! 1 Source-to-source transformations 2 Partial Taint Tracking USENIX WebApps 2011 9
Why source transformations? 1 Adopt officially • Custom Runtime • Source code transformations • On demand Portable USENIX WebApps 2011 10
Why source transformations? 1 Adopt officially • Custom Runtime • Source code transformations • On demand Portable Challenges: 1. Not everything is an object (how can you attach taint to strings?) 2. The interpreter cannot be edited (no metaprogramming) USENIX WebApps 2011 11
What is the performance overhead? 2 Partial taint tracking: Code is not equally vulnerable Third-party plugin code WordPress year WordPress Plugins 2009 2 13 2010 2 10 CVE WordPress-Platform Injection Vulnerabilities Code that handles user data CVE # Functionality 2009-2851 Display user comments 2009-3891 File upload handler 2010-4257 Trackback handling 2010-4536 Display user comments CVE WordPress-Core Injection Vulnerabilities USENIX WebApps 2011 12
1. Introduction 2. DESIGN 3. Implementation 4. Evaluation USENIX WebApps 2011 13
PHP Aspis Overview PHP Aspis Transformed Application Tracking Code PHP Statements Library Calls Sanitisation Operations Non Tracking Code USENIX WebApps 2011 14
PHP Aspis Overview PHP Aspis Transformed Application Tracking Code Input PHP Statements HTTP Request Library Calls “ Yiannis ” Sanitisation Operations Taint Non Tracking Code USENIX WebApps 2011 15
PHP Aspis Overview PHP Aspis Transformed Application Tracking Code HTML Output Input SQL Query PHP Statements HTTP Request Library Calls “ Yiannis ” Sanitisation Operations Eval Statement Taint Non Tracking Code USENIX WebApps 2011 16
PHP Aspis Overview WordPress WordPress plugin HTML Output Input SQL Query HTTP Request “ Yiannis ” Eval Statement Taint WordPress Core USENIX WebApps 2011 17
PHP Aspis Overview PHP Aspis Transformed Application Tracking Code HTML Output Input SQL Query PHP Statements HTTP Request Library Calls “ Yiannis ” Sanitisation Operations Eval Statement Taint 2 Vulnerability prevention 1 Taint meta-data Non Tracking Code USENIX WebApps 2011 18
PHP Aspis Overview PHP Aspis Transformed Application Tracking Code HTML Output Input SQL Query PHP Statements HTTP Request Library Calls “ Yiannis ” Sanitisation Operations Eval Statement Taint 2 Vulnerability prevention 1 Taint meta-data Non Tracking Code USENIX WebApps 2011 19
Taint Meta-data 1 untainted “ SELECT * “SELECT * tainted tainted FROM USERS FROM USERS WHERE user=yiannis ”; WHERE user=yiannis ”; Variable Level Character Level o o Leads to false positives Precise information USENIX WebApps 2011 20
Taint Meta-data 1 untainted “ SELECT * “SELECT * tainted tainted FROM USERS FROM USERS WHERE user=yiannis ”; WHERE user=yiannis ”; Variable Level Character Level o o Leads to false positives Precise information Partial sanitisation (e.g. ) untainted untainted “SELECT * (for SQL Injection) FROM USERS WHERE user=yiannis ”; More than 1 bit of taint meta-data is required USENIX WebApps 2011 21
Taint Categories 1 Taint Category Example SQL Injection XSS Eval Injection untainted untainted untainted tainted tainted “SELECT * FROM USERS WHERE user=yiannis ”; USENIX WebApps 2011 22
Taint Categories 1 Taint Category Example SQL Injection XSS Eval Injection untainted untainted untainted tainted tainted “SELECT * FROM USERS WHERE user=yiannis ”; Generic way to define: Sanitisation htmlentities() How an application is Functions htmlspecialchars() supposed to sanitise What to do if it doesn’t echo()→ AspisAntiXSS() Guarded print()→ AspisAntiXSS() Sinks … XSS taint category excerpt USENIX WebApps 2011 23
PHP Aspis Overview PHP Aspis Transformed Application Tracking Code HTML Output Input SQL Query PHP Statements HTTP Request Library Calls “ Yiannis ” Sanitisation Operations Eval Statement Taint 2 Vulnerability prevention 1 Taint meta-data Non Tracking Code USENIX WebApps 2011 24
PHP Aspis Overview PHP Aspis Transformed Application Tracking Code HTML Output Input SQL Query PHP Statements HTTP Request Library Calls “ Yiannis ” Sanitisation Operations Eval Statement Taint 2 Vulnerability prevention 1 Taint meta-data Non Tracking Code USENIX WebApps 2011 25
Which vulnerabilities can be prevented? 2 Possible Data Flows to Tracking Non Tracking from Tracking Non Tracking USENIX WebApps 2011 26
Tracking code only 2 PHP Aspis Transformed Application Tracking Code Input HTTP Request “ Yiannis ” Taint to Non Tracking Code Non Tracking Tracking from Tracking Non Tracking USENIX WebApps 2011 27
Non Tracking code only 2 PHP Aspis Transformed Application Tracking Code Input HTTP Request “ Yiannis ” Taint to Non Tracking Code Non Tracking Tracking from Tracking Non Tracking USENIX WebApps 2011 28
Non Tracking to Tracking 2 PHP Aspis Transformed Application Tracking Code Input HTTP Request “ Yiannis ” Taint to Non Tracking Code Non Tracking Tracking from Tracking Non Tracking USENIX WebApps 2011 29
Tracking/Non Tracking mixes 2 PHP Aspis Transformed Application Tracking Code Input HTTP Request “ Yiannis ” Taint to Non Tracking Code Non Tracking Tracking from Tracking Non Tracking USENIX WebApps 2011 30
Tracking to Non Tracking 2 PHP Aspis Transformed Application Tracking Code Input HTTP Request “ Yiannis ” Taint to Non Tracking Code Non Tracking Tracking from Tracking Non Tracking USENIX WebApps 2011 31
Tracking to Non Tracking 2 PHP Aspis Transformed Application Tracking Code Input HTTP Request “ Yiannis ” Taint to Non Tracking Code Non Tracking Tracking from Tracking Non Tracking USENIX WebApps 2011 32
Summary: Prevented Vulnerabilities 2 Vulnerabilities Prevented Vulnerabilities Not Prevented Tracking-code only Non Tracking-code only Tracking to non tracking Non Tracking to Tracking Tracking/Non Tracking mixes to to Non Non Tracking Tracking Tracking Tracking From from Tracking Tracking Non Non Tracking Tracking USENIX WebApps 2011 33
1. Introduction 2. Design 3. IMPLE LEMEN MENTAT ATION ON 4. Evaluation USENIX WebApps 2011 34
Storing Taint Meta-Data Store taint in place Interoperation with non-tracking code Use arrays 2-10x faster than object initialisation Scalar assignment semantics Original value Aspis-protected value array ( “Hello” “Hello” , TaintCats ) array ( 12 12 , TaintCats ) USENIX WebApps 2011 35
Taint Tracking Transformations Statements & Expressions must 1. operate with Aspis-protected values 2. propagate taint correctly 3. return Aspis-protected values Original expression Transformed Expression $s.$t concat($s,$t) if ($v) {} if ($v[0]) {} $j = postincr($i) $j = $i++ USENIX WebApps 2011 36
PHP Function Library Library functions do not work with Aspis-protected values use interceptors! Default Interceptor Custom Interceptors strip input taint guess the taint of the output substr() add empty output taint good as the default reimplement the function fclose(), fopen() sort() More custom interceptors, less false negatives o Default: drop taint, not abort the call o Support existing applications without developer intervention USENIX WebApps 2011 37
Recommend
More recommend
