Abstract:Memory corruption attacks remain the primary threat for computer security. Information flow tracking or taint analysis has been proven to be effective against most memory corruption attacks. However, there are two shortcomings with current taint analysis based techniques. First, these techniques cause application slowdown by about 76% thereby limiting their practicality. Second, these techniques cannot handle non-control data attacks i.e., attacks that do not overwrite control data such as return address, but instead overwrite critical application configuration data or user identity data. In this work, to address these problems, we describe a coarse-grained taint analysis technique that uses information flow tracking at the level of application data objects. We propagate a one-bit taint over each application object that is modified by untrusted data thereby reducing the taint management overhead considerably. We performed extensive experimental evaluation of our approach and show that it can detect all critical attacks such as buffer overflows, and format string attacks, including non-control data attacks. Unlike the currently known approaches that can detect such a wide range of attacks, our approach does not require the source code or any hardware extensions. Run-time performance overhead evaluation shows that, on an average, our approach causes application slowdown by only 37% which is an order of magnitude improvement over existing approaches. Finally, since our approach performs run-time binary instrumentation, it is easier to integrate it with existing applications and systems.

Review on Dynamic Taint Analysis of Binary Programs

Dynamic taint analysis for vulnerability exploits detection

Taint Propagation Analysis Algorithm for Vulnerability Exploits Detection

Dynamic Information Flow Analysis for Vulnerability Exploits Detection

Dynamic Taint Analysis Based on Virtual Technology

Constructing a Hybrid Taint Analysis Framework for Diagnosing Attacks on Binary Programs

Using Dynamic Taint Approach for Malware Threat

Dynamic Taint Tracking of Web Application Based on Static Code Analysis

WEB VULNERABILITY DETECTION BASED ON TAINT ANALYSIS AND SYMBOLIC EXECUTION

Static program analysis assisted dynamic taint tracking for software vulnerability discovery

Dytaint: the Implementation of a Novel Lightweight 3-State Dynamic Taint Analysis Framework for X86 Binary Programs.

Coarse-grained Dynamic Taint Analysis for Defeating Control and Non-control Data Attacks

Research on Java Source Code Static Analysis Based on Taint Tracking

Dynamic Analysis and Debugging of Binary Code for Security Applications

OFFDTAN: A New Approach of Offline Dynamic Taint Analysis for Binaries

Method of binary oriented fuzzy testing based on dynamic taint analysis

A Practical Taint-Based Malware Detection

HYBit: A Hybrid Taint Analyzing Framework for Binary Programs.

Dynamic Taint Analysis of Concurrent Program Based on Symbolic Execution

Source Code Vulnerability Detection Technology Based on Taint Analysis

Directed Fuzzing Based on Dynamic Taint Analysis for Binary Software