1. Merlin: Inferring Specifications for Explicit Information Flow Problems Ben Livshits Aditya Nori Sriram Rajamani Anindya Banerjee

2. Web application vulnerabilities are a serious threat addressed by static analysis tools Microsoft C AT.N ET

3. M OTIVATION & P ROJECT G OALS

4. When it comes to static analysis tools, specification quality affects result quality More specification more bugs Better specification fewer false positives

5. A typical specification includes dozens of sources, sinks, and sanitizers TypeCountRevisions Sources2711 Sanitizers72 Sinks7710 Specification  Sources: start taint  Sinks: taint not allowed  Sanitizers: untaint data = 111= 23

6. Tools are only as good as the specification and good specification is hard to come by This example  ReadData1, ReadData2 – source?  Cleanse – sanitizer?  WriteData – sink? Large scale  Libraries with their own APIs  Specification particular to application 1. void ProcessRequest() 2. { 3. string s1 = ReadData1("name"); 4. string s2 = ReadData2("encoding"); 5. string s3 = Cleanse(s1); 6. WriteData("Parameter " + s1); 7. WriteData("Header " + s2); 8. }

7. A LGORITHMS

8. Merlin Processing Initial specification Program Final specification Merlin inference Merlin inference Prop. graph construction Factor graph construction Probabilistic inference Static analysis Vulnerabilities 1 1 2 2 3 3

9. We convert the propagation graph we get from CAT.NET to a reduced propagation graph

10. ReadData1, Cleanse, WriteData ReadData2

11. ReadData1, ReadData2, WriteData Cleanse

12. ReadData1, ReadData2, Cleanse WriteData

13. Avoid source wrappers: Prop1 is not a source

14. Avoid sink wrappers: Cleanse is not a sink

15. Avoid double sanitizers: Prop1 is not a sanitizer

16. We derive probabilistic constraints from the reduced propagation graph

17. We approximate path constraints with triple constraints 2N2N N3N3

18. Direct constraint representation is way too big. Factor graph is a compressed representation.

19. Probabilistic inference SourceSanitizerSinks ReadData1.95.001 ReadData2.5 Cleanse.5 WriteData.5.85 … SourceSanitizerSinks ReadData1.95.001 ReadData2.5 Cleanse.01.997.03 WriteData.5.85 …

20. Direct constraint representation is too big. Factor graphs to the rescue.

21. Factor graph inference TODO

22. E XPERIMENTAL R ESULTS

23. We have chosen 10 line-of-business applications written in C# using ASP.NET.

24. Summary of Discovered Specifications

25. Summary of Discovered Vulnerabilities

26. Analyze This: a routine from one of our benchmarks that shows how Merlin affects vulnerabilities. known sink

27. Starting with an initial specification really helps, but Merlin can work with no specification at all.

28. Executive summary of experimental results. 10 large Web apps in.NET New specs: 167 New vulnerabilities: 302 False positives removed: 3 Final false positive rate for Cat.Net after Merlin <1%

29. Related work Explicit information flow Analysis of Web apps (WebSSARI, Griffin, etc.) and Fortify, Cat.Net Asbestos, HiStar Hardware support Mining sec. specifications AutoISES – security-sensitive data structures in Linux kernel Ganapathy Specification mining Kremenek (belief inf. for malloc / free ) Perracotta, DynaMine, Dyckon, Weimer