FlowTwist: efficient context-sensitive inside-out taint analysis for large codebases

Abstract

Over the past years, widely used platforms such as the Java Class Library have been under constant attack through vulnerabilities that involve a combination of two taint-analysis problems: an integrity problem allowing attackers to trigger sensitive operations within the platform, and a confidentiality problem allowing the attacker to retrieve sensitive information or pointers from the results of those operations. While existing static taint analyses are good at solving either of those problems, we show that they scale prohibitively badly when being applied to situations that require the exploitation of both an integrity and confidentiality problem in combination. The main problem is the huge attack surface of libraries such as the Java Class Library, which exposes thousands of methods potentially controllable by an attacker.In this work we thus present FlowTwist, a novel taintanalysis approach that works inside-out, i.e., tracks data flows from potentially vulnerable calls to the outer level of the API which the attacker might control. This inside-out analysis requires a careful, context-sensitive coordination of both a backward and a forward taint analysis. In this work, we expose a design of the analysis approach based on the IFDS algorithm, and explain several extensions to IFDS that enable not only this coordination but also a helpful reporting of error situations to security analysts.Experiments with the Java Class Library show that, while a simple forward taint-analysis approach does not scale even with much machine power, FlowTwist's algorithm is able to fully analyze the library within 10 minutes.

Design your analysis: a case study on implementation reusability of data-flow functions

“…We found this to be the case while developing FlowTwist [6], a taint-flow analysis for the detection of so-called Confused Deputies in Java. In this paper we therefore contribute a design approach that effectively separates different analysis aspects and implementations that are otherwise often interwoven.…”

I'd Like to Have an Argument, Please: Using Dialectic for Effective App Security

“…The approach is promising, but obviously requires programmers to adopt the tools; also no papers are yet available validating their effectiveness. Others, such as Near and Jackson, and Lerch et al, [31,36] have code analysis tools to detect security defects; these work but provide only limited feedback to developers.…”

JoanAudit: a tool for auditing common injection vulnerabilities

“…The main static analysis tools and frameworks which can be used for security analysis of Java Web applications are FindBugs [3,13], SFlow [14], FlowTwist [21], LAPSE+ [30], TAJ [42], Andromeda [41], Indus [17], Soot [43], Joana [11], Wala [15]; for a more comprehensive list see [28].…”

“…Challenges 1 and 2 are addressed by approaches based on taint analysis [14,18,21,23,30,41,42]. However, reports generated by these approaches typically contain data-flow analysis traces and lack control-dependency information (challenge 3), which is essential for security auditing.…”