E FFICIENT C HARACTER - LEVEL T AINT T RACKING FOR J AVA Erika Chin David Wagner UC Berkeley

W EB A PPLICATIONS 80% of all web applications are vulnerable to attack [1] Most are command injection attacks (mixed control and data channel): SQL injection XSS HTTP response splitting Path traversal Shell command injection [1] J. Grossman. WhiteHat website security statistics report, Aug

E XAMPLE – SQL INJECTION Query = “SELECT * FROM students WHERE name = ‘ ” + studentName + “ ’ ”; What if: studentName = Bobby “SELECT * FROM students WHERE name = ‘Bobby’ ” studentName = Bobby’; DROP TABLE students; -- “SELECT * FROM students WHERE name = ‘Bobby’; DROP TABLE students; --’ ” Inspired by XKCD: 3

C OMMAND I NJECTION A TTACKS Command Injection AttackCommand Elements SQL injection attackSQL keywords and operators XSSJavaScript HTTP response splittingNewlines (CR, LF) Path traversal‘/’, “..” Shell command injectionShell keywords and operators, meta-characters 4

A N ATURAL A PPROACH – T AINT T RACKING AT THE C HARACTER LEVEL Others have argued that taint tracking aids the detection of command injection attacks Taint tracking reveals what data gets touched by user input Attacks are injected into web applications in the form of strings, so we can limit the scope of tracking to strings Character-level information narrows the focus to specific portions of the string 5

O UR F OCUS We focus on taint tracking for Java web applications Many commercial enterprises use Java for their web services 6

C HARACTER - LEVEL T AINT T RACKING F OR J AVA 1. Source Tainting: Augment the Java Servlets implementation to mark user input as tainted (Tomcat 6) 2. Taint Propagation: Replace the string- related classes in the Java library with augmented classes that track taint status (IBM JDK6) 3. Sink Checking: At each sink, use the taint information to detect attacks by checking that control data is not tainted 7

We mark all information from the HTTP request as untrusted GET /results?search_query=rick+roll&search_type=&aq… Host: … Referrer: Cookie: use_hitbox=72c46ff6cddcb7c5585… S OURCE T AINTING Form Parameters Protocol Path HTTP Headers: Cookies, Session Id, etc. 8

S OURCE T AINTING : A UGMENTED C LASSES Replace the Tomcat Servlet classes with our own modified classes javax.servlet.http.HttpServletRequest javax.servlet.http.Cookie javax.servlet.http.HttpSession org.apache.catalina.connector.CoyoteReader 9

B ASIC T AINT P ROPAGATION Example code snippet: String city = request.GetParameter(“city”); String punctuation = “, ”; String state = “CA”; String temp = punctuation.concat( state ); String location = city.concat( temp ); 10

T AINT P ROPAGATION : O RIGINAL S TRING C LASS city char[] punctuation state temp = punctuation.concat( state ) city.concat( temp ) Berkeley, CA,CA 11 Berkeley,CA

12 T AINT P ROPAGATION : M ODIFIED S TRING C LASS city char[] boolean[] punctuation state temp = punctuation.concat( state ) city.concat( temp ) Berkeley, CA,CA Berkeley,CA TTTTTTTT FF FF FFFF TTTTTTTTFFFF

O PTIMIZED T AINT P ROPAGATION To reduce the overhead of taint tracking, only track taint when necessary Only allocate boolean taint array once the String contains a tainted character Reduces overhead by eliminating array copies for operations on fully untainted strings 13

FF FF FFFF O PTIMIZED T AINT P ROPAGATION city punctuation state temp = punctuation.concat( state ) city.concat( temp ) Berkeley, CA,CA TTTTTTTT null 14 Berkeley,CA TTTTTTTTFFFF

T AINT P ROPAGATION : A UGMENTED C LASSES java.lang.String java.lang.StringBuffer java.lang.StringBuilder 15

S INK C HECKING Sinks can use taint information to detect commands in user-supplied data SQL – instrument the JDBC to parse the SQL queries and check for SQL keywords and operators that contain tainted characters XSS – examine HTML for tainted JavaScript Details of how to do this are well- documented in the previous literature and not the focus of this work [2] [2] Su and Wassermann. The essence of command injection attacks in web applications. POPL ’06. 16

B ENEFITS Provides a basis to protect from command injection attacks Simple, easy to adopt and deploy Server-side change One-time modification No change to web application byte code No need for web application source code Works immediately with Java legacy applications Efficient 17

B ENEFITS C ON ’ T Handles web applications that call string methods reflectively Java reflection allows calls to methods selected at runtime Our approach can track the taint for these reflected calls 18

L IMITATIONS For backwards compatibility we do not record taint status in the serialized form May lose taint status via string operations with chars and char arrays Cannot hold taint status in primitives Does not defend against malicious web developers 19

P ERFORMANCE O VERHEAD : 0-15% 20

C ONTRIBUTIONS Efficient character-level taint tracking Runtime overhead <15% Works immediately for Java legacy code Easy to adopt and deploy 21

Thank you! Any questions? 22