One Engine To Serve 'em All: Inferring Taint Rules Without Architectural Semantics

Abstract

Dynamic binary taint analysis has wide applications in the security analysis of commercial-off-the-shelf (COTS) binaries. One of the key challenges in dynamic binary analysis is to specify the taint rules that capture how taint information propagates for each instruction on an architecture. Most of the existing solutions specify taint rules using a deductive approach by summarizing the rules manually after analyzing the instruction semantics. Intuitively, taint propagation reflects on how an instruction input affects its output, and thus can be observed from instruction executions. In this work, we propose an inductive method for taint propagation and develop a universal taint tracking engine that is architecture-agnostic. Our taint engine, TAINTINDUCE, can learn taint rules with minimal architectural knowledge by observing the execution behavior of instructions. To measure its correctness and guide taint rule generation, we define the precise notion of soundness for bit-level taint tracking in this novel setup. In our evaluation, we show that TAINTINDUCE automatically learns rules for 4 widely used architectures: x86, x64, AArch64, and MIPS-I. It can detect vulnerabilities for 24 CVEs in 15 applications on both Linux and Windows over millions of instructions and is comparable with other mature existing tools (TEMU [51], libdft [32], Triton [42]). TAINTINDUCE can be used as a stand-alone taint engine or be used to complement existing taint engines for unhandled instructions. Further, it can be used as a cross-referencing tool to uncover bugs in taint engines, emulation implementations and ISA documentations.

Asia's surging interest in binary analysis

“…This process requires tremendous engineering effort and thus, many researchers consider it too costly to investigate. TaintInduce (by the National University of Singapore and the Chinese Academy of Sciences) 5 is a project to automatically generate taint rules (or data-flow properties) without manual specifications; it infers taint rules based on observations of instruction executions. In addition, TaintInduce proposes a common definition and API for taint rules, enabling follow-up work to be built on a common knowledge base.…”

SoK: Enabling Security Analyses of Embedded Systems via Rehosting

“…There has been some encouraging recent work on automated synthesis of semantic specifications for specific ISAs such as x86 [34,39]. TaintInduce [14] shows that higher level semantics (i.e., taint propagation rules) can be dynamically inferred for an ISA. However, these approaches focus on simple instructions, such as arithmetic and basic logical operations.…”

Neutaint: Efficient Dynamic Taint Analysis with Neural Networks

“…These limitations of taint severely affect its applicability to real-world programs. A recent work TaintInduce [18] has proposed to learn the taint propagation rules instead of manually specifying them. This can increase the accuracy of individual rules, but the error accumulation and large overhead issues still remain, due to propagation-based design.…”

“…However, it incurs large overhead and suffers from overtaint and undertaint issues. To address these issues, TaintInduce [18] proposes to learn platform-specific taint propagation rules from (input, output) pairs of instructions. Their approach learns propagation rules based on a template, and uses an algorithm to reduce the task to learning different input sets and pre-conditions for propagating the taint tags.…”

“…Under-taint is a common issue for dynamic taint analysis. Since the taint propagation rules in dynamic taint analysis tools are neither sound nor complete, some taint labels are easily missed during the analysis process [18].…”