Data-flow Analysis of Programs with Associative Arrays

Dynamic programming languages, such as PHP, JavaScript, and Python, provide built-in data structures including associative arrays and objects with similar semantics-object properties can be created at run-time and accessed via arbitrary expressions. While a high level of security and safety of applications written in these languages can be of a particular importance (consider a web application storing sensitive data and providing its functionality worldwide), dynamic data structures pose significant challenges for data-flow analysis making traditional static verification methods both unsound and imprecise. In this paper, we propose a sound and precise approach for value and points-to analysis of programs with associative arrays-like data structures, upon which data-flow analyses can be built. We implemented our approach in a web-application domain-in an analyzer of PHP code.Comment: In Proceedings ESSS 2014, arXiv:1405.055

Automatic static analysis of software performance

Performance is a critical component of software quality. Software performance can have drastic repercussions on an application, frustrating its users, breaking the functionality of its components, or even rendering it defenseless against hackers. Unfortunately, unlike in the program verification domain, robust analysis techniques for software performance are almost non-existent. In this thesis we formalize important classes of performance-related bugs and security vulnerabilities, and implement novel static analysis techniques for automatically detecting them in widely used open-source applications. Our tools are able to uncover 92 performance bugs and 47 security vulnerabilities, while analyzing hundreds of thousands of lines of code and reporting a modest amount of false positives. Our work opens a new avenue for research: the development of rigorous automatic analyses for effective software performance understanding, inspired by traditional research in functional verification.Computer Science

Realistic vulnerability injections in PHP web applications

Tese de mestrado em Segurança Informática, apresentada à Universidade de Lisboa, através da Faculdade de Ciências, 2011A injecção de vulnerabilidades é uma área que recebeu relativamente pouca atenção da comunidade científica, provavelmente por o seu objectivo ser aparentemente contrário ao propósito de fazer as aplicações mais seguras. Esta pode no entanto ser usada em variadas áreas que a fazem merecedora de ser investigada, tais como a criação automática de exemplos educacionais de código vulnerável, testar mecanismos de segurança em profundidade, e a avaliação de detectores de vulnerabilidades e de equipas de segurança. Esta tese propõe uma arquitectura para uma ferramenta de injecção de vulnerabilidades genérica que permite a inserção de vulnerabilidades num programa, e aproveita a vasta investigação existente sobre detecção de vulnerabilidades. A arquitectura é também extensível, suportando a adição de novas vulnerabilidades para serem injectadas. Foi também implementado e avaliado um protótipo baseado nesta arquitectura por forma a perceber se a arquitectura era implementável. O protótipo consegue injectar a maior parte das vulnerabilidades da class taint-style, desde que em aplicações web desenvolvidas em PHP. Esta tese contém também um estudo sobre as vulnerabilidades presentes nas últimas versões de algumas aplicações PHP bem conhecidas, que permite perceber quais os tipos de vulnerabilidade mais comuns. Este estudo conclui que as vulnerabilidades que o protótipo permite já incluem a maioria das vulnerabilidades que aparecem habitualmente em aplicações PHP. Finalmente, várias aplicações PHP foram usadas na avaliação. O protótipo foi usado para injectar diversas vulnerabilidades sobre estas aplicações, e após isso as injecções foram analisadas à mão para verificar se uma vulnerabilidade tinha sido criada ou não. Os resultados mostram que o protótipo consegue não só injectar uma grande quantidade de vulnerabilidades mas também que estas são atacáveis e realistas.Vulnerability injection is a field that has received relatively little attention by the research community, probably because its objective is apparently contrary to the purpose of making applications more secure. It can however be used in a variety of areas that make it worthy of research, such as the automatic creation of educational examples of vulnerable code, testing defense in depth mechanisms, and the evaluation of both vulnerability scanners and security teams. This thesis proposes an architecture for a generic vulnerability injection tool that allows the insertion of vulnerabilities in a program, and leverages from the vast work available on vulnerability detection. The architecture is also extensible, supporting the addition of new vulnerabilities to inject. A prototype implementing the architecture was developed and evaluated to analyze the feasibility of the architecture. The prototype targets PHP web applications, and is able to inject most taintstyle type vulnerabilities. The thesis also contains a study on the vulnerabilities present in the latest versions of some well known PHP applications, providing a better understanding of which are the most common types of vulnerabilities. This study shows that the vulnerabilities that the prototype is able to inject already includes the majority of the vulnerabilities that appear in PHP web applications. Finally, several PHP applications were used in the evaluation. These were subject to injections using the prototype, after which they were analyzed by hand to see whether a vulnerability was created or not. The results show that the prototype can not only inject a great amount of vulnerabilities but that they are actually attackable

A Review: Implementation of Web Security Mechanisms using Vulnerability & Attack Injection

In this paper we propose a theory and a model mechanical assembly to survey web application security instruments. The methodology is in perspective of the prospect that mixing sensible Vulnerabilities in a web application and attacking them normally can be used to support the assessment of existing security frameworks and mechanical assemblies in custom setup circumstances. To give reliable with life comes to fruition, the proposed powerlessness and attack mixture technique relies on upon the examination of a sweeping number of vulnerabilities in authentic web applications. Despite the non-particular approach, the paper depicts the Vulnerability's utilization and Attack Injector Tool (VAIT) that allows the entire's robotization process. We used this instrument to run a game plan of trials that display the feasibility and the reasonability of the proposed methodology. The examinations join the appraisal of degree and false positives of an interference acknowledgment structure for SQL Injection strikes and the feasibility's assessment of two top business web application vulnerability scanners. Results show that the implantation of vulnerabilities and ambushes is to make certain a feasible way to deal with evaluate security segments and to raise their weaknesses and also courses for their change

Detecting and Preventing SQL Injection and XSS Attack using Web Security Mechanisms

In this paper we proposed a system prototype tool to evaluate web application security mechanisms. The methodology is based on the idea that injecting realistic vulnerabilities in a web application and attacking them automatically can be used to support the assessment of existing security mechanisms and tools in custom setup scenarios. To provide true to life results, the proposed vulnerability and attack injection methodology relies on the study of a large number of vulnerabilities in real web applications. To remove the vulnerabilities by implementing a concrete Vulnerability & Attack Injector Tool (VAIT) for securing web applications. To prevent various attacks like follows: 1. SQL Injection (SQLi) 2. Cross Site Scripting (XSS) 3. Brute Force Attack 4. Shoulder surfing Attack 5. Social Attack. 6. Dictionary Attac

Framework for Static Analysis of PHP Applications

Dynamic languages, such as PHP and JavaScript, are widespread and heavily used. They provide dynamic features such as dynamic type system, virtual and dynamic method calls, dynamic includes, and built-in dynamic data structures. This makes it hard to create static analyses, e.g., for automatic error discovery. Yet exploiting errors in such programs, especially in web applications, can have significant impacts. In this paper, we present static analysis framework for PHP, automatically resolving features common to dynamic languages and thus reducing the complexity of defining new static analyses. In particular, the framework enables defining value and heap analyses for dynamic languages independently and composing them automatically and soundly. We used the framework to implement static taint analysis for finding security vulnerabilities. The analysis has revealed previously unknown security problems in real application. Comparing to existing state-of-the-art analysis tools for PHP, it has found more real problems with a lower false-positive rate

Automated server-side model for recognition of security vulnerabilities in scripting languages

With the increase of global accessibility of web applications, maintaining a reasonable security level for both user data and server resources has become an extremely challenging issue. Therefore, static code analysis systems can help web developers to reduce time and cost. In this paper, a new static analysis model is proposed. This model is designed to discover the security problems in scripting languages. The proposed model is implemented in a prototype SCAT, which is a static code analysis Tool. SCAT applies the phases of the proposed model to catch security vulnerabilities in PHP 5.3. Empirical results attest that the proposed prototype is feasible and is able to contribute to the security of real-world web applications. SCAT managed to detect 94% of security vulnerabilities found in the testing benchmarks; this clearly indicates that the proposed model is able to provide an effective solution to complicated web systems by offering benefits of securing private data for users and maintaining web application stability for web applications providers

A compiler level intermediate representation based binary analysis system and its applications

Analyzing and optimizing programs from their executables has received a lot of attention recently in the research community. There has been a tremendous amount of activity in executable-level research targeting varied applications such as security vulnerability analysis, untrusted code analysis, malware analysis, program testing, and binary optimizations. The vision of this dissertation is to advance the field of static analysis of executables and bridge the gap between source-level analysis and executable analysis. The main thesis of this work is scalable static binary rewriting and analysis using compiler-level intermediate representation without relying on the presence of metadata information such as debug or symbolic information. In spite of a significant overlap in the overall goals of several source-code methods and executables-level techniques, several sophisticated transformations that are well-understood and implemented in source-level infrastructures have yet to become available in executable frameworks. It is a well known fact that a standalone executable without any meta data is less amenable to analysis than the source code. Nonetheless, we believe that one of the prime reasons behind the limitations of existing executable frameworks is that current executable frameworks define their own intermediate representations (IR) which are significantly more constrained than an IR used in a compiler. Intermediate representations used in existing binary frameworks lack high level features like abstract stack, variables, and symbols and are even machine dependent in some cases. This severely limits the application of well-understood compiler transformations to executables and necessitates new research to make them applicable. In the first part of this dissertation, we present techniques to convert the binaries to the same high-level intermediate representation that compilers use. We propose methods to segment the flat address space in an executable containing undifferentiated blocks of memory. We demonstrate the inadequacy of existing variable identification methods for their promotion to symbols and present our methods for symbol promotion. We also present methods to convert the physically addressed stack in an executable to an abstract stack. The proposed methods are practical since they do not employ symbolic, relocation, or debug information which are usually absent in deployed executables. We have integrated our techniques with a prototype x86 binary framework called \emph{SecondWrite} that uses LLVM as the IR. The robustness of the framework is demonstrated by handling executables totaling more than a million lines of source-code, including several real world programs. In the next part of this work, we demonstrate that several well-known source-level analysis frameworks such as symbolic analysis have limited effectiveness in the executable domain since executables typically lack higher-level semantics such as program variables. The IR should have a precise memory abstraction for an analysis to effectively reason about memory operations. Our first work of recovering a compiler-level representation addresses this limitation by recovering several higher-level semantics information from executables. In the next part of this work, we propose methods to handle the scenarios when such semantics cannot be recovered. First, we propose a hybrid static-dynamic mechanism for recovering a precise and correct memory model in executables in presence of executable-specific artifacts such as indirect control transfers. Next, the enhanced memory model is employed to define a novel symbolic analysis framework for executables that can perform the same types of program analysis as source-level tools. Frameworks hitherto fail to simultaneously maintain the properties of correct representation and precise memory model and ignore memory-allocated variables while defining symbolic analysis mechanisms. We exemplify that our framework is robust, efficient and it significantly improves the performance of various traditional analyses like global value numbering, alias analysis and dependence analysis for executables. Finally, the underlying representation and analysis framework is employed for two separate applications. First, the framework is extended to define a novel static analysis framework, \emph{DemandFlow}, for identifying information flow security violations in program executables. Unlike existing static vulnerability detection methods for executables, DemandFlow analyzes memory locations in addition to symbols, thus improving the precision of the analysis. DemandFlow proposes a novel demand-driven mechanism to identify and precisely analyze only those program locations and memory accesses which are relevant to a vulnerability, thus enhancing scalability. DemandFlow uncovers six previously undiscovered format string and directory traversal vulnerabilities in popular ftp and internet relay chat clients. Next, the framework is extended to implement a platform-specific optimization for embedded processors. Several embedded systems provide the facility of locking one or more lines in the cache. We devise the first method in literature that employs instruction cache locking as a mechanism for improving the average-case run-time of general embedded applications. We demonstrate that the optimal solution for instruction cache locking can be obtained in polynomial time. Since our scheme is implemented inside a binary framework, it successfully addresses the portability concern by enabling the implementation of cache locking at the time of deployment when all the details of the memory hierarchy are available