Introduction

TaintPolicy provides a practical fine-grained (byte-level) dynamic taint analysis for attack detection. By combining expressive security policies with fine-grained taint information, this approach can be applied to detect a wide range of common attacks, including buffer overflows, format-string attacks, SQL injection, cross-site scripting, command and shell-code injection, and directory traversal.

TaintPolicy is developed based on two important observations:

• Need for fine-grained taint information. With coarser granularity (e.g. variable level or file level) of taint information, we would not be able to detect most of the attacks mentioned above. For instance, in the case of SQL injection, an SQL query string is usually constructed from a trusted SQL template and several untrusted input values. Without fine-grained taint information, the entire SQL query string would be always marked as tainted, therefore we cannot distinguish between legitimate SQL queries from an SQL injection attack.


• Need for taint-enhanced policies. It is not possible to prevent these attacks by enforcing conventional access control policies. For instance, in the case of SQL injection in web applications, one cannot use a policy that uniformly prevents the use of SQL meta-characters and commands. Such a policy would prelude any use of the back-end database, and cause the web application to fail.

TaintPolicy instruments C programs through a source-to-source transformation to perform runtime taint tracking. Taint originates at specified input functions, e.g. a read or recv function used by a server to read network inputs. In the transformed program, each byte of memory is associated with one tag of taint information. As data propagates through memory, the associated taint information is propagated as well. TaintPolicy can track explicit information flows that take place through assignments as well as limited forms of implicit information flows that take place through control flows. User-provided taint-enhanced policies that can distinguish between benign uses of untrusted (tainted) data from attacks are applied right before each call to security-critical functions, e.g. popen.

TaintPolicy ensures that the taint tracking is correct even in the presence of memory errors, aliasing, type casts, and so on. It also employs a number of optimizations to significantly reduce the performance overheads associated with the maintenance of taint information.

TaintPolicy is directly applicable to programs written in C, and several other scripting languages (e.g. PHP, Bash) whose interpreters are implemented in C.

TaintPolicy is implemented in Objective Caml (http://caml.inria.fr) and uses CIL (http://manju.cs.berkeley.edu/cil/) as the front end to manipulate C constructs.

Download

Coming soon.

Acknowledgments

This work is supported in part by an ONR grant N000140110967 and NSF grants CNS-0208877 and CCR-0205376.