using positive tainting and syntax aware evaluation to
play

Using Positive Tainting and Syntax-Aware Evaluation to Counter SQL - PowerPoint PPT Presentation

Apr 02, 2023 •329 likes •678 views

Using Positive Tainting and Syntax-Aware Evaluation to Counter SQL Injection Attacks William G.J. Halfond Alessandro Orso Panagiotis Manolios Georgia Institute of Technology Supported by NSF awards CCR-0205422 and CCR-0306372 to GA Tech and

  1. Using Positive Tainting and Syntax-Aware Evaluation to Counter SQL Injection Attacks William G.J. Halfond Alessandro Orso Panagiotis Manolios Georgia Institute of Technology Supported by NSF awards CCR-0205422 and CCR-0306372 to GA Tech and by DHS and US Air Force under Contract No. FA8750-05-C-0179. Group Group

  2. Introduction DB Internet End Users Web Server Other Systems Deployment context of a typical Web application. William Halfond – FSE 2006 – November 8 th , 2006 – Slide 2 Group Group

  3. Introduction DB Internet End Users Web Server Other Systems Deployment context of a typical Web application. William Halfond – FSE 2006 – November 8 th , 2006 – Slide 3 Group Group

  4. SQL Injection Attacks Easy to create a database query – hard to do it securely. • Open Web Application Security Project (OWASP) lists SQLIA in its top ten most critical web application security vulnerabilities • David Aucsmith (CTO of Security and Business Unit, Microsoft) defined SQLIA as one of the most serious threats to web apps • Successful attacks on Guess Inc., Travelocity, FTD.com, Tower Records, RIAA, … • Companies have built their business on detecting SQLIAs William Halfond – FSE 2006 – November 8 th , 2006 – Slide 4 Group Group

  5. Example of an SQLIA public Login(request, response) { String login = request.getParameter(“login”); String passwd = request.getParameter(“passwd”); String query = "SELECT info FROM userTable WHERE "; if ((! login.equals("")) && (! password.equals(""))) query += "login='"+login+"' AND pass='"+passwd +"'" else query+="login='guest'"; ResultSet result = stmt.executeQuery(query); if (result != null) displayAccount(result); else sendAuthFailed(); } William Halfond – FSE 2006 – November 8 th , 2006 – Slide 5 Group Group

  6. Example of an SQLIA public Login(request, response) { String login = request.getParameter(“login”); String passwd = request.getParameter(“passwd”); String query = "SELECT info FROM userTable WHERE "; if ((! login.equals("")) && (! password.equals(""))) query += "login='"+login+"' AND pass='"+passwd +"'" else query+="login='guest'"; ResultSet result = stmt.executeQuery(query); if (result != null) displayAccount(result); else sendAuthFailed(); } Normal Usage  User submits login “ doe ” and passwd “ xyz ”  SELECT info FROM users WHERE login= ` doe ’ AND pass= ‘ xyz’ William Halfond – FSE 2006 – November 8 th , 2006 – Slide 6 Group Group

  7. Example of an SQLIA public Login(request, response) { String login = request.getParameter(“login”); String passwd = request.getParameter(“passwd”); String query = "SELECT info FROM userTable WHERE "; if ((! login.equals("")) && (! password.equals(""))) query += "login='"+login+"' AND pass='"+passwd +"'" else query+="login='guest'"; ResultSet result = stmt.executeQuery(query); if (result != null) displayAccount(result); else sendAuthFailed(); } Malicious Usage  Attacker submits “ admin’ -- ” and passwd of “0”  SELECT info FROM users WHERE login=‘ admin’ -- ’ AND pass=‘0’ William Halfond – FSE 2006 – November 8 th , 2006 – Slide 7 Group Group

  8. Presentation Outline • Our Technique • Positive tainting • Syntax-aware evaluation • Implementation -- WASP • Evaluation • Related work • Conclusions and future work William Halfond – FSE 2006 – November 8 th , 2006 – Slide 8 Group Group

  9. Our Technique Basic approach => Only allow developer- trusted strings to form sensitive parts of a query Solution: 1. Positive tainting : Identify and mark developer- trusted strings. Propagate taint markings at runtime 2. Syntax-Aware Evaluation : Check that all keywords and operators in a query were formed using marked strings William Halfond – FSE 2006 – November 8 th , 2006 – Slide 9 Group Group

  10. Example: Positive vs. Negative Tainting public Login(request, response) { String login = request.getParameter(“login”); String passwd = request.getParameter(“passwd”); String query = "SELECT info FROM userTable WHERE "; if ((! login.equals("")) && (! password.equals(""))) query += "login='"+login+"' AND pass='"+passwd + "'" else query+="login='guest'"; ResultSet result = stmt.executeQuery(query); if (result != null) displayAccount(result); else sendAuthFailed(); } Identify and mark trusted data instead of untrusted data. Negative tainting. Positive tainting. William Halfond – FSE 2006 – November 8 th , 2006 – Slide 10 Group Group

  11. Benefits of Positive Tainting ⇒ Increased safety: Incompleteness leads to easy-to-eliminate false positives ⇒ Normal in-house testing causes set of trusted data to converge to complete set ⇒ Implements security principle of “fail-safe defaults” [Saltzer and Schroeder] ⇒ Increased automation: Trusted data readily identifiable in Web applications William Halfond – FSE 2006 – November 8 th , 2006 – Slide 11 Group Group

  12. Syntax-aware Evaluation • Cannot simply forbid the use of untrusted data in queries • Dependence on filtering rules requires unsafe assumptions ⇒ Syntax-aware evaluation • Performed right before the query is sent to the database • Consider the context in which trusted and untrusted data is used William Halfond – FSE 2006 – November 8 th , 2006 – Slide 12 Group Group

  13. Complete Example 1. String queryString = "SELECT info FROM userTable WHERE "; 2. if ((! login.equals("")) && (! password.equals(""))) { 3. queryString += "login='" + login + "' AND pass='" + password + "'"; } else { 4. queryString+="login='guest'"; } 5. ResultSet tempSet = stmt.executeQuery(queryString); login -> “doe”, password -> “xyz” William Halfond – FSE 2006 – November 8 th , 2006 – Slide 13 Group Group

  14. Complete Example 1. String queryString = "SELECT info FROM userTable WHERE "; 2. if ((! login.equals("")) && (! password.equals(""))) { 3. queryString += "login='" + login + "' AND pass='" + password + "'"; } else { 4. queryString+="login='guest'"; } 5. ResultSet tempSet = stmt.executeQuery(queryString); login -> “doe”, password -> “xyz” queryString [ S ][ E ][ L ][ E ][ C ][ T ] … [ W ][ H ][ E ][ R ][ E ][] William Halfond – FSE 2006 – November 8 th , 2006 – Slide 14 Group Group

  15. Complete Example 1. String queryString = "SELECT info FROM userTable WHERE "; 2. if ((! login.equals("")) && (! password.equals(""))) { 3. queryString += "login='" + login + "' AND pass='" + password + "'"; } else { 4. queryString+="login='guest'"; } 5. ResultSet tempSet = stmt.executeQuery(queryString); login -> “doe”, password -> “xyz” queryString [ S ][ E ][ L ][ E ][ C ][ T ] … [ W ][ H ][ E ][ R ][ E ][] tmp0 tmp1 tmp2 [ l ][ o ][ g ][ i ][ n ][ = ][ ‘ ] [ d ][ o ][ e ] [ ‘ ][][ A ][ N ][ D ][][ p ][ a ][ s ][ s ][ = ][ ‘ ] tmp4 tmp3 [ x ][ y ][ z ] [ ‘ ] William Halfond – FSE 2006 – November 8 th , 2006 – Slide 15 Group Group

  16. Complete Example 1. String queryString = "SELECT info FROM userTable WHERE "; 2. if ((! login.equals("")) && (! password.equals(""))) { 3. queryString += "login='" + login + "' AND pass='" + password + "'"; } else { 4. queryString+="login='guest'"; } 5. ResultSet tempSet = stmt.executeQuery(queryString); login -> “doe”, password -> “xyz” queryString … [ W ][ H ][ E ][ R ][ E ][][ l ][ o ][ g ][ i ][ n ][ = ][ ‘ ][ d ][ o ][ e ][ ‘ ][ A ][ N ][ D ][][ p ][ a ][ s ][ s ][ = ][ ‘ ][ x ][ y ][ z ][ ‘ ] William Halfond – FSE 2006 – November 8 th , 2006 – Slide 16 Group Group

  17. Complete Example 1. String queryString = "SELECT info FROM userTable WHERE "; 2. if ((! login.equals("")) && (! password.equals(""))) { 3. queryString += "login='" + login + "' AND pass='" + password + "'"; } else { 4. queryString+="login='guest'"; } 5. ResultSet tempSet = stmt.executeQuery(queryString); login -> “doe”, password -> “xyz” SELECT info FROM userTable WHERE login=‘doe‘ AND pass=‘xyz‘ William Halfond – FSE 2006 – November 8 th , 2006 – Slide 17 Group Group

  18. Complete Example 1. String queryString = "SELECT info FROM userTable WHERE "; 2. if ((! login.equals("")) && (! password.equals(""))) { 3. queryString += "login='" + login + "' AND pass='" + password + "'"; } else { 4. queryString+="login='guest'"; } 5. ResultSet tempSet = stmt.executeQuery(queryString); login -> “doe”, password -> “xyz” ✔ doe SELECT info FROM userTable WHERE login = pass xyz ‘ ‘ AND = ‘ ‘ William Halfond – FSE 2006 – November 8 th , 2006 – Slide 18 Group Group

Recommend

Plan for Today Review main idea syntax-directed evaluation and translation Recall syntax-directed

Plan for Today Review main idea syntax-directed evaluation and translation Recall syntax-directed

Plan for Today Review main idea syntax-directed evaluation and translation Recall syntax-directed interpretation in recursive descent parsers Syntax-directed evaluation and translation in shift-reduce parser Performs a right-most derivation

414 views • 7 slides
Improved Neural Machine Translation with a Syntax-Aware Encoder and Decoder Huadong Chen ! ,

Improved Neural Machine Translation with a Syntax-Aware Encoder and Decoder Huadong Chen ! ,

Improved Neural Machine Translation with a Syntax-Aware Encoder and Decoder Huadong Chen ! , Shujian Huang ! , David Chiang " , Jiajun Chen ! {chenhd,huangsj,chenjj}@nlp.nju.edu.cn dchiang@nd.edu 1. State Key Laboratory of Novel Software

555 views • 30 slides
Performance Evaluation of Performance Evaluation of Security- -Aware Routing Protocols Aware

Performance Evaluation of Performance Evaluation of Security- -Aware Routing Protocols Aware

Performance Evaluation of Performance Evaluation of Security- -Aware Routing Protocols Aware Routing Protocols Security for Clustered Mobile Ad Hoc for Clustered Mobile Ad Hoc Networks Networks Gregory S. Yovanof - - Kerem Kerem Ericsi

1.16k views • 26 slides
Verification of Data-Aware Processes Boundaries of Decidability: Positive Results Diego

Verification of Data-Aware Processes Boundaries of Decidability: Positive Results Diego

Verification of Data-Aware Processes Boundaries of Decidability: Positive Results Diego Calvanese, Marco Montali Research Centre for Knowledge and Data (KRDB) Free University of Bozen-Bolzano, Italy KRDB 1 29th European Summer School in

626 views • 41 slides
Incorporating Quotation and Evaluation Into Churchs Type Theory: Syntax and Semantics William

Incorporating Quotation and Evaluation Into Churchs Type Theory: Syntax and Semantics William

CICM 2016 Incorporating Quotation and Evaluation Into Churchs Type Theory: Syntax and Semantics William M. Farmer Department of Computing and Software McMaster University 26 July 2016 Outline Motivation. Syntax and semantics of ctt qe .

319 views • 27 slides
Effective Memory Protection Using Dynamic Tainting James Clause Ioanis Doudalis and Alessandro

Effective Memory Protection Using Dynamic Tainting James Clause Ioanis Doudalis and Alessandro

Effective Memory Protection Using Dynamic Tainting James Clause Ioanis Doudalis and Alessandro Orso Milos Prvulovic (software) (hardware) College of Computing Georgia Institute of Technology Supported in part by: NSF awards CCF-0541080

1.87k views • 119 slides
Ev Evaluation Benchmarks and Learning Criteria fo for Di Discou ourse-Aw Aware Sente ntence

Ev Evaluation Benchmarks and Learning Criteria fo for Di Discou ourse-Aw Aware Sente ntence

Ev Evaluation Benchmarks and Learning Criteria fo for Di Discou ourse-Aw Aware Sente ntence Represent ntations Mingda Chen Joint work with Zewei Chu and Kevin Gimpel Prior work on evaluation benchmarks Focus on capabilities of

650 views • 39 slides
Test Positive Aware Network Rogers Park Edgewater Uptown Michelle Randall-English

Test Positive Aware Network Rogers Park Edgewater Uptown Michelle Randall-English

PHIMC - PSS QUALITY IMPROVEMENT PSS ASSESSMENT FORM IMPLEMENTATION Test Positive Aware Network Rogers Park Edgewater Uptown Michelle Randall-English Centricity Database Manager & Quality Analyst J ANUARY 2018 A W orld P ositively A

176 views • 5 slides
Using collaborative approaches to program evaluation to promote positive leadership in schools

Using collaborative approaches to program evaluation to promote positive leadership in schools

Using collaborative approaches to program evaluation to promote positive leadership in schools September 2019 Program evaluation is the gathering and analysis of evidence on a program in order to provide insights to inform decision-making

389 views • 16 slides
log ( parseProb ) (Alex) log ( parseProb / trigramProb ) (Anoop) Result: worse than

log ( parseProb ) (Alex) log ( parseProb / trigramProb ) (Anoop) Result: worse than

Features Implicit Syntax Shallow Syntax (POS, chunks) Deep Syntax (trees) Tricky Syntax (tree fragments) Syntax for Statistical MT JHU 2003 WS Deep Syntax What is deep? use of parser output Why parser?

194 views • 16 slides
Scalability Evaluation of an Energy- Aware Resource Management System for Clusters of Web Servers

Scalability Evaluation of an Energy- Aware Resource Management System for Clusters of Web Servers

Scalability Evaluation of an Energy- Aware Resource Management System for Clusters of Web Servers 2015-07-27 SPECTS15 Simon Kiertscher , Bettina Schnor University of Potsdam Before we start 2 Outline Motivation Energy Saving

793 views • 40 slides
DSI:iEval Data Scene Investigation ASK THE EVALUATOR POSITIVE If a client does not have the

DSI:iEval Data Scene Investigation ASK THE EVALUATOR POSITIVE If a client does not have the

HAVING FUN WITH EVALUATION! Wendy L. Tackett, Ph.D. Michigan Association for Evaluation May 2019 DSI:iEval Data Scene Investigation ASK THE EVALUATOR POSITIVE If a client does not have the budget to successfully implement the changes

302 views • 5 slides
Abbreviated syntax The abbreviated syntax is more economical and often (but not always!) more

Abbreviated syntax The abbreviated syntax is more economical and often (but not always!) more

Inf1-DA 20102011 II: 64 / 118 Abbreviated syntax The abbreviated syntax is more economical and often (but not always!) more intuitive. The XPath abbreviations are: The syntax child:: may be omitted from a location step altogether. (The

854 views • 19 slides
Maryland Positive Behavior Supports (PBD): Developing an Evaluation Plan Dr. Meg DePasquale,

Maryland Positive Behavior Supports (PBD): Developing an Evaluation Plan Dr. Meg DePasquale,

Maryland Positive Behavior Supports (PBD): Developing an Evaluation Plan Dr. Meg DePasquale, Director of Clinical Services, Developmental Disabilities Administration (DDA) Dr. Jennifer Jeffery-Pearsall, Director of PBIS Training and Technical

552 views • 13 slides
Morsel-Driven Parallelism: A NUMA-Aware Query Evaluation Framework for the Many-Core Age Viktor

Morsel-Driven Parallelism: A NUMA-Aware Query Evaluation Framework for the Many-Core Age Viktor

Morsel-Driven Parallelism: A NUMA-Aware Query Evaluation Framework for the Many-Core Age Viktor Leis, Peter Boncz*, Alfons Kemper, Thomas Neumann Technische Universitt Mnchen *CWI with some modifications by: S. Sudarshan Viktor Leis 1 /

736 views • 24 slides
SI485i : NLP Set 7 Syntax and Parsing Syntax Grammar, or syntax: The kind of implicit

SI485i : NLP Set 7 Syntax and Parsing Syntax Grammar, or syntax: The kind of implicit

SI485i : NLP Set 7 Syntax and Parsing Syntax Grammar, or syntax: The kind of implicit knowledge of your native language that you had mastered by the time you were 3 years old Not the kind of stuff you were later taught in

963 views • 56 slides
SI425 : NLP Set 7 Syntax and Parsing Syntax Grammar, or syntax: The kind of implicit

SI425 : NLP Set 7 Syntax and Parsing Syntax Grammar, or syntax: The kind of implicit

SI425 : NLP Set 7 Syntax and Parsing Syntax Grammar, or syntax: The kind of implicit knowledge of your native language that you had mastered by the time you were 3 years old Not the kind of stuff you were later taught in

677 views • 57 slides
Design and performance evaluation of NUMA-aware RDMA-based end-to-end data transfer systems Yufei

Design and performance evaluation of NUMA-aware RDMA-based end-to-end data transfer systems Yufei

Design and performance evaluation of NUMA-aware RDMA-based end-to-end data transfer systems Yufei Ren, Tan Li, Dantong Yu, Shudong Jin, Thomas G. Robertazzi Presented by Zach Yannes Introduction Need to transfer large amounts of data long

384 views • 27 slides
Introduction to Machine Learning Evaluation: Measures for Binary Classification: ROC

Introduction to Machine Learning Evaluation: Measures for Binary Classification: ROC

Introduction to Machine Learning Evaluation: Measures for Binary Classification: ROC visualization compstat-lmu.github.io/lecture_i2ml LABELS: ROC SPACE Plot True Positive Rate and False Positive Rate: 1.00 True Class y C2 +

596 views • 17 slides
Introduction to English Linguistics 4: Grammar and Syntax I Grammar and Syntax Grammar The

Introduction to English Linguistics 4: Grammar and Syntax I Grammar and Syntax Grammar The

Introduction to English Linguistics 4: Grammar and Syntax I Grammar and Syntax Grammar The rules of language, comprising syntax and inflectional morphology Syntax The hierarchical structure of language Lexical Words (Open Class) Noun

539 views • 31 slides
Discrete Event Simulation And Discrete Event Simulation And Evaluation Of A Firewall Aware

Discrete Event Simulation And Discrete Event Simulation And Evaluation Of A Firewall Aware

Discrete Event Simulation And Discrete Event Simulation And Evaluation Of A Firewall Aware Evaluation Of A Firewall Aware Architecture For Mobile IP Architecture For Mobile IP Artur Hecker Artur Hecker Supervisors: Supervisors: Prof. Dr.

260 views • 22 slides
SI425 : NLP Set 10 Syntax and Parsing Fall 2020 : Chambers Syntax Grammar, or syntax:

SI425 : NLP Set 10 Syntax and Parsing Fall 2020 : Chambers Syntax Grammar, or syntax:

SI425 : NLP Set 10 Syntax and Parsing Fall 2020 : Chambers Syntax Grammar, or syntax: The kind of implicit knowledge of your native language that you had mastered by the time you were 3 years old Not the kind of stuff you were later

854 views • 57 slides
Defining Program Syntax Chapter Two Modern Programming Languages, 2nd ed. 1 Syntax And

Defining Program Syntax Chapter Two Modern Programming Languages, 2nd ed. 1 Syntax And

Defining Program Syntax Chapter Two Modern Programming Languages, 2nd ed. 1 Syntax And Semantics Programming language syntax: how programs look, their form and structure Syntax is defined using a kind of formal grammar Programming

870 views • 49 slides
Defining Program Syntax Chapter Two Modern Programming Languages, 2nd ed. 1 Syntax And

Defining Program Syntax Chapter Two Modern Programming Languages, 2nd ed. 1 Syntax And

Defining Program Syntax Chapter Two Modern Programming Languages, 2nd ed. 1 Syntax And Semantics Programming language syntax: how programs look, their form and structure Syntax is defined using a kind of formal grammar Programming

605 views • 48 slides

More recommend