Abstract:Fuzz testing has proven successful in finding security vulnerabilities in large programs. However, traditional fuzz testing tools have a well-known common drawback: they are ineffective if most generated inputs are rejected at the early stage of program running, especially when target programs employ checksum mechanisms to verify the integrity of inputs. This article presents TaintScope, an automatic fuzzing system using dynamic taint analysis and symbolic execution techniques, to tackle the above problem. TaintScope has several novel features: (1) TaintScope is a checksum-aware fuzzing tool. It can identify checksum fields in inputs, accurately locate checksum-based integrity checks by using branch profiling techniques, and bypass such checks via control flow alteration. Furthermore, it can fix checksum values in generated inputs using combined concrete and symbolic execution techniques. (2) TaintScope is a taint-based fuzzing tool working at the x86 binary level. Based on fine-grained dynamic taint tracing, TaintScope identifies the “hot bytes” in a well-formed input that are used in security-sensitive operations (e.g., invoking system/library calls), and then focuses on modifying such bytes with random or boundary values. (3) TaintScope is also a symbolic-execution-based fuzzing tool. It can symbolically evaluate a trace, reason about all possible values that can execute the trace, and then detect potential vulnerabilities on the trace. We evaluate TaintScope on a number of large real-world applications. Experimental results show that TaintScope can accurately locate the checksum checks in programs and dramatically improve the effectiveness of fuzz testing. TaintScope has already found 30 previously unknown vulnerabilities in several widely used applications, including Adobe Acrobat, Flash Player, Google Picasa, and Microsoft Paint. Most of these severe vulnerabilities have been confirmed by Secunia and oCERT, and assigned CVE identifiers (such as CVE-2009-1882, CVE-2009-2688). Vendor patches have been released or are in preparation based on our reports.

TaintSE: Dynamic Taint Analysis Combined with Symbolic Execution and Constraint Association

Effective code coverage in compositional systematic dynamic testing

Android Static Taint Analysis Based on Multi Branch Search Association

DepTaint

Dynamic Taint Analysis of Concurrent Program Based on Symbolic Execution

Dynamic Taint Analysis Based on Virtual Technology

Static program analysis assisted dynamic taint tracking for software vulnerability discovery

Sdft: A PDG-based Summarization for Efficient Dynamic Data Flow Tracking

Dytaint: the Implementation of a Novel Lightweight 3-State Dynamic Taint Analysis Framework for X86 Binary Programs.

Efficient Taint Analysis with Taint Behavior Summary

HardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing

Design and Implementation of an Efficient Container Tag Dynamic Taint Analysis

Automated Coverage-Driven Test Data Generation Using Dynamic Symbolic Execution

Checksum-Aware Fuzzing Combined with Dynamic Taint Analysis and Symbolic Execution.

Test Case Generation Assisted by Control Dependence Analysis

Analyst-Oriented Taint Analysis by Taint Path Slicing and Aggregation

WEB VULNERABILITY DETECTION BASED ON TAINT ANALYSIS AND SYMBOLIC EXECUTION

Taint Trace Analysis for Java Web Applications

ConfTainter: Static Taint Analysis for Configuration Options

Scaling static taint analysis to industrial SOA applications: a case study at Alibaba

TaintSQL: Dynamically Tracking Fine-Grained Implicit Flows for SQL Statements