Abstract:Memory corruption attacks remain the primary threat for computer security. Information flow tracking or taint analysis has been proven to be effective against most memory corruption attacks. However, there are two shortcomings with current taint analysis based techniques. First, these techniques cause application slowdown by about 76% thereby limiting their practicality. Second, these techniques cannot handle non-control data attacks i.e., attacks that do not overwrite control data such as return address, but instead overwrite critical application configuration data or user identity data. In this work, to address these problems, we describe a coarse-grained taint analysis technique that uses information flow tracking at the level of application data objects. We propagate a one-bit taint over each application object that is modified by untrusted data thereby reducing the taint management overhead considerably. We performed extensive experimental evaluation of our approach and show that it can detect all critical attacks such as buffer overflows, and format string attacks, including non-control data attacks. Unlike the currently known approaches that can detect such a wide range of attacks, our approach does not require the source code or any hardware extensions. Run-time performance overhead evaluation shows that, on an average, our approach causes application slowdown by only 37% which is an order of magnitude improvement over existing approaches. Finally, since our approach performs run-time binary instrumentation, it is easier to integrate it with existing applications and systems.

Dynamic Taint Analysis of Concurrent Program Based on Symbolic Execution

Tell you a Definite Answer: Whether Your Data is Tainted During Thread Scheduling

Dytaint: the Implementation of a Novel Lightweight 3-State Dynamic Taint Analysis Framework for X86 Binary Programs.

TaintSE: Dynamic Taint Analysis Combined with Symbolic Execution and Constraint Association

Review on Dynamic Taint Analysis of Binary Programs

Coarse-grained Dynamic Taint Analysis for Defeating Control and Non-control Data Attacks

Implementation of an Effective Dynamic Concolic Execution Framework for Analyzing Binary Programs.

Dynamic Taint Analysis Based on Virtual Technology

Static program analysis assisted dynamic taint tracking for software vulnerability discovery

DepTaint

Constructing a Hybrid Taint Analysis Framework for Diagnosing Attacks on Binary Programs

Dynamic taint analysis for vulnerability exploits detection

Dynamic Analysis and Debugging of Binary Code for Security Applications

OFFDTAN: A New Approach of Offline Dynamic Taint Analysis for Binaries

Sdft: A PDG-based Summarization for Efficient Dynamic Data Flow Tracking

WEB VULNERABILITY DETECTION BASED ON TAINT ANALYSIS AND SYMBOLIC EXECUTION

P-DATA: A Task-Level Parallel Framework for Dependency-Aware Value Flow Taint Analysis

Dynamic Symbolic Execution Based Defect Detection System for Binary Programs

Combining Static and Dynamic Analysis to Discover Software Vulnerabilities

Directed Symbolic Execution for Binary Vulnerability Mining

Dynamic Taint Tracking of Web Application Based on Static Code Analysis