Abstract:Memory corruption attacks remain the primary threat for computer security. Information flow tracking or taint analysis has been proven to be effective against most memory corruption attacks. However, there are two shortcomings with current taint analysis based techniques. First, these techniques cause application slowdown by about 76% thereby limiting their practicality. Second, these techniques cannot handle non-control data attacks i.e., attacks that do not overwrite control data such as return address, but instead overwrite critical application configuration data or user identity data. In this work, to address these problems, we describe a coarse-grained taint analysis technique that uses information flow tracking at the level of application data objects. We propagate a one-bit taint over each application object that is modified by untrusted data thereby reducing the taint management overhead considerably. We performed extensive experimental evaluation of our approach and show that it can detect all critical attacks such as buffer overflows, and format string attacks, including non-control data attacks. Unlike the currently known approaches that can detect such a wide range of attacks, our approach does not require the source code or any hardware extensions. Run-time performance overhead evaluation shows that, on an average, our approach causes application slowdown by only 37% which is an order of magnitude improvement over existing approaches. Finally, since our approach performs run-time binary instrumentation, it is easier to integrate it with existing applications and systems.

Transparent run-time prevention of format-string attacks via dynamic taint and flexible validation

Securing c programs by dynamic type checking

Adaptive Call-Site Sensitive Control Flow Integrity

Dytaint: the Implementation of a Novel Lightweight 3-State Dynamic Taint Analysis Framework for X86 Binary Programs.

Coarse-grained Dynamic Taint Analysis for Defeating Control and Non-control Data Attacks

Static program analysis assisted dynamic taint tracking for software vulnerability discovery

Proactive Vulnerability Finding Via Information Flow Tracking

An Effective Taint‐based Software Vulnerability Miner

VTint: Protecting Virtual Function Tables' Integrity.

LibsafeXP: A Practical and Transparent Tool for Run-time Buffer Overflow Preventions

Combining Static and Dynamic Analysis to Discover Software Vulnerabilities

HYBit: A Hybrid Taint Analyzing Framework for Binary Programs.

Source Code Vulnerability Detection Technology Based on Taint Analysis

Harnessing the Power of LLM to Support Binary Taint Analysis

Poster: Tracevirt: A Framework For Detecting The Non-Tampering Attacks In The Virtual Machine

Memory-related Vulnerabilities Localization Technology Based on Dynamic Tainting

Runtime Code Reuse Attacks: A Dynamic Framework Bypassing Fine-Grained Address Space Layout Randomization.

New Approach of Vulnerability Finding for File-reading Applications Based on Taint Analysis

TMAC: Taint-based memory protection via access control

Using Dynamic Taint Approach for Malware Threat

SafeBird:A Dynamic and Transparent Toolkit for Run-Time Buffer Overflow Preventions