PEPM '08: Proceedings of the 2008 ACM SIGPLAN symp

PEPM '08: Proceedings of the 2008 ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation Year 2008 Peer-reviewed

BibTeX PDF

Web Security · Privacy

Securing web applications with static and dynamic information flow tracking

Monica S. Lam Michael Martin Benjamin Livshits John Whaley

2008

Publication year

PEPM

Venue

Peer-reviewed

Type

§ Abstract

Problem

SQL injection and cross-site scripting are two of the most common security vulnerabilities that plague web applications today. These and many others result from having unchecked data input reach security-sensitive operations. This paper describes a language called PQL (Program Query Language) that allows users to declare to specify information flow patterns succinctly and declaratively.

Approach

We have developed a static context-sensitive, but flow-insensitive information flow tracking analysis that can be used to find all the vulnerabilities in a program. In the event that the analysis generates too many warnings, the result can be used to drive a modelchecking system to analyze more precisely. Model checking is also used to automatically generate the input vectors that expose the vulnerability.

Results

Any remaining behavior these static analyses have not isolated may be checked dynamically. The results of the static analyses may be used to optimize these dynamic checks. Our experimental results indicate the language is expressive enough for describing a large number of vulnerabilities succinctly. We have analyzed over nine applications, detecting 30 serious security vulnerabilities.We were also able to automatically recover from attacks as they occurred using the dynamic checker.

Cite this paper — BibTeX

@inproceedings{pepm_keynote,
 author = {Monica S. Lam and Michael Martin and Benjamin Livshits and John Whaley},
 title = {Securing web applications with static and dynamic information flow tracking},
 booktitle = {PEPM '08: Proceedings of the 2008 ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation},
 year = {2008},
 isbn = {978-1-59593-977-7},
 location = {San Francisco, California, USA},
 doi = {http://doi.acm.org/10.1145/1328408.1328410},
 publisher = {ACM},
 address = {New York, NY, USA},
 }