ACIDRain: Concurrency-Related Attacks on Database-Backed Web Applications

ACM SIGMOD 2017
http://www.bailis.org/papers/acidrain-sigmod2017.pdf
https://github.com/stanford-futuredata/acidrain

Transcript

1. 1 ACIDRain: Concurrency-Related Attacks on Database-Backed Web Applications Todd Warszawski, Peter Bailis Stanford University
2. 2 Explore Real World Transaction Usage • Do programmers use transactions correctly? • This paper: 22 new critical vulnerabilities due to incorrect transaction usage – Corrupt store inventory, overspend giftcards, steal items • 50% of eCommerce sites (2M+) at risk
3. 3 Analyzed Popular Sites
4. 5 Analyzed Popular Sites Plus 9 more!
5. 6 Companies Using These Applications
9. 10 What do these vulnerabilities look like?
10. 11 LIVE DEMO HERE Invite Todd to talk at your organization!
13. 14 “By sending thousands of simultaneous requests, the attacker was able to ‘move’ coins from one user account to another until the sending account was overdrawn, before balances were updated.”
14. 15 What's Happening? • Race condition – application exhibits behavior under concurrent execution not possible under serial execution • Can we exploit these behaviors? • Yes! We call this exploitation of non- serializable API behavior an ACIDRain attack
15. 16 Overview • Problem setup • New method for detecting latent potential for non-serializable behavior • Evaluation – analysis of 12 eCommerce platforms
16. 17 Problem Setup: Attacking Websites http POST request SELECT ... UPDATE ... SELECT ... http GET request Application Server Database
17. 18 Problem Setup: Attacking Websites http POST request SELECT ... UPDATE ... SELECT ... http GET request Application Server Database
18. 19 Problem Setup: Attacking Websites http POST request SELECT ... UPDATE ... SELECT ... http GET request Application Server Database
19. 20 Problem Setup: Attacking Websites http POST request SELECT ... UPDATE ... SELECT ... http GET request Application Server Database
20. 21 Problem Setup: Attacking Websites http POST request SELECT ... UPDATE ... SELECT ... http GET request Application Server Application Server Database
21. 22 Problem Setup: Attacking Websites http POST request SELECT ... UPDATE ... SELECT ... http GET request Database Application Server
22. 23 Problem Setup: Attacking Websites http POST request SELECT ... UPDATE ... SELECT ... http GET request Serializability of API Requests Serializability of Database Transactions Application Server Database
23. 24 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY
24. 25 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 0 Application Server Database
25. 26 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 0 Application Server Database
26. 27 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 0 Application Server Database
27. 28 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 1 Application Server Database
28. 29 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 1 Application Server Database
29. 30 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 1 Application Server Database
30. 31 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 0 Application Server Database
31. 32 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 0 Application Server Database
32. 33 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 0 Application Server Database
33. 34 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 0 Application Server Database
34. 35 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 1 Application Server Database
35. 36 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 1 Application Server Database
36. 37 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT
37. 38 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
38. 39 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
39. 40 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
40. 41 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
41. 42 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
42. 43 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
43. 44 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 1 Database Application Server
44. 45 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 1 Database Application Server
45. 46 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 1 Database Application Server
46. 47 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 1 Database Application Server
47. 48 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 1 Database Application Server Will one of the transactions fail? It depends
48. 49 = prevents anomaly = exhibits anomaly Many Databases Allow This Anomaly Database Default Isolation Maximum Isolation Actian Ingres 10.0/10S Aerospike Akiban Persistit Clustrix CLX 4100 Greenplum 4.1 IBM DB2 10 for z/OS MySQL 5.6 MemSQL 1b MS SQL Server 2012 NuoDB Oracle 11g Oracle Berkeley DB Oracle Berkeley DB JE Postgres 9.2.2 SAP HANA ScaleDB 1.02 VoltDB
49. 50 Two Sources of Vulnerabilities • Databases providing weak isolation may exhibit non-serializable behavior def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) • Programmers may code transactions incorrectly
50. 51 Overview • Problem setup • New method for detecting latent potential for non-serializable behavior • Evaluation – analysis of 12 eCommerce platforms
51. 52 Analysis Challenges • Want to analyze web applications written in multiple languages and frameworks • Anomalies only occur under concurrent execution, but website activity is often serial
52. 53 Approach: Abstract Anomaly Detection (2AD) Collect (possibly serial) logs from database Build compact representation of history (abstract history graph) Search abstract history for cycles to generate possible anomalous API calls 1. 2. a 3.
53. Approach: Abstract Anomaly Detection (2AD)
54. Approach: Abstract Anomaly Detection (2AD)
55. Approach: Abstract Anomaly Detection (2AD)
56. Approach: Abstract Anomaly Detection (2AD)
57. Approach: Abstract Anomaly Detection (2AD)
58. 59 Approach: Abstract Anomaly Detection (2AD)
59. 60 Approach: Abstract Anomaly Detection (2AD) Collect (possibly serial) logs from database Build compact representation of history (abstract history graph) Search abstract history for cycles to generate possible anomalous API calls 1. 2. a 3.
60. 61 Abstract History Graph def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT
61. 62 Abstract History Graph BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT
62. 63 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation Add node for each operation 1.
63. 64 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction Add node for each operation Add supernode for each transaction 1. 2.
64. 65 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction = API Call Add node for each operation Add supernode for each transaction Add super-supernode for each API call 1. 2. 3.
65. 66 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction = API Call = Conflict Add node for each operation Add supernode for each transaction Add super-supernode for each API call Add edge for each conflict 1. 2. 3. 4.
66. 67 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction = API Call = Conflict Add node for each operation Add supernode for each transaction Add super-supernode for each API call Add edge for each conflict 1. 2. 3. 4.
67. 68 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction = API Call = Conflict Add node for each operation Add supernode for each transaction Add super-supernode for each API call Add edge for each conflict 1. 2. 3. 4.
68. 69 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction = API Call = Conflict Add node for each operation Add supernode for each transaction Add super-supernode for each API call Add edge for each conflict Search for cycles in the graph 1. 2. 3. 4. 5.
69. 70 Abstract History Graph r(voucher) w(voucher) = Operation = Transaction = API Call = Conflict BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Add node for each operation Add supernode for each transaction Add super-supernode for each API call Add edge for each conflict Search for cycles in the graph 1. 2. 3. 4. 5. r(voucher) w(voucher)
70. 71 Completeness Guarantees • Completeness: if there is a potential anomalous execution, this approach will find it • Soundness: discussion in paper Thm: Given a set of API calls, there exists an anomalous execution of the API calls if and only if there is a cycle in the abstract history.
71. 72 Limitations • Does not take into account user level (i.e., "feral" [Bailis et al. 2015]) concurrency control def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit()
72. 73 Limitations • Does not take into account user level (i.e., "feral" [Bailis et al. 2015]) concurrency control def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() def checkVoucher(code): appLock.lock() usage = readUsage(code) if (usage == 0): markUsed(code) appLock.release()
73. 74 Overview • Problem setup • New method for detecting latent potential for non-serializable behavior • Evaluation – analysis of 12 eCommerce platforms
74. 75 Ecommerce Platforms
75. 76 Ecommerce Platforms Interested in 3 key invariants: 1. Inventory 2. Voucher 3. Cart
76. 77 Inventory Invariant Stock should not go below 0 and should reflect all orders placed
77. 78 Inventory Invariant Stock should not go below 0 and should reflect all orders placed
78. 79 Inventory Invariant Stock should not go below 0 and should reflect all orders placed
79. 80 Voucher Invariant Vouchers should not be spent past their intended limit
80. 81 Voucher Invariant Vouchers should not be spent past their intended limit
81. 82 Voucher Invariant Vouchers should not be spent past their intended limit
82. 83 Cart Invariant Total charged for an order should be equal to the value of items associated with the order
83. 84 Cart Invariant Total charged for an order should be equal to the value of items associated with the order
84. 85 Cart Invariant Total charged for an order should be equal to the value of items associated with the order
85. 86 Analysis Results Application Language Inventory Voucher Cart Opencart PHP ✗ ✗ ✔ Prestashop PHP ✗ ✗ ✔ Magento PHP ✗ ✗ ✔ WooCommerce PHP ✗ ✗ ✔ Spree Ruby on Rails ✔ ✔ ✔ Ror_ecommerce Ruby on Rails ✗ N/A ✗ Shoppe Ruby on Rails ✗ N/A ✗ Oscar Python (Django) ✗ ✗ ✔ LFS Python (Django) ✗ ✗ ✗ Saleor Python (Django) ✗ ✗ N/A Broadleaf Java (Spring) N/A ✗ ✗ Shopizer Java (Spring) N/A N/A ✗ ✗ = vulnerable, ✔ = not vulnerable 22 new vulnerabilities!
86. 87 Analysis Results Application Language Inventory Voucher Cart Opencart PHP ✗ ✗ ✔ Prestashop PHP ✗ ✗ ✔ Magento PHP ✗ ✗ ✔ WooCommerce PHP ✗ ✗ ✔ Spree Ruby on Rails ✔ ✔ ✔ Ror_ecommerce Ruby on Rails ✗ N/A ✗ Shoppe Ruby on Rails ✗ N/A ✗ Oscar Python (Django) ✗ ✗ ✔ LFS Python (Django) ✗ ✗ ✗ Saleor Python (Django) ✗ ✗ N/A Broadleaf Java (Spring) N/A ✗ ✗ Shopizer Java (Spring) N/A N/A ✗ ✗ = vulnerable, ✔ = not vulnerable 22 new vulnerabilities! 2M+ sites at risk
87. 88 Analysis Results Application Language Inventory Voucher Cart Opencart PHP ✗ ✗ ✔ Prestashop PHP ✗ ✗ ✔ Magento PHP ✗ ✗ ✔ WooCommerce PHP ✗ ✗ ✔ Spree Ruby on Rails ✔ ✔ ✔ Ror_ecommerce Ruby on Rails ✗ N/A ✗ Shoppe Ruby on Rails ✗ N/A ✗ Oscar Python (Django) ✗ ✗ ✔ LFS Python (Django) ✗ ✗ ✗ Saleor Python (Django) ✗ ✗ N/A Broadleaf Java (Spring) N/A ✗ ✗ Shopizer Java (Spring) N/A N/A ✗ ✗ = vulnerable, ✔ = not vulnerable 22 new vulnerabilities! 2M+ sites at risk 4 different languages
88. 89 Analysis Results Application Language Inventory Voucher Cart Opencart PHP ✗ ✗ ✔ Prestashop PHP ✗ ✗ ✔ Magento PHP ✗ ✗ ✔ WooCommerce PHP ✗ ✗ ✔ Spree Ruby on Rails ✔ ✔ ✔ Ror_ecommerce Ruby on Rails ✗ N/A ✗ Shoppe Ruby on Rails ✗ N/A ✗ Oscar Python (Django) ✗ ✗ ✔ LFS Python (Django) ✗ ✗ ✗ Saleor Python (Django) ✗ ✗ N/A Broadleaf Java (Spring) N/A ✗ ✗ Shopizer Java (Spring) N/A N/A ✗ ✗ = vulnerable, ✔ = not vulnerable 22 new vulnerabilities! 2M+ sites at risk 4 different languages 5 errors due to DB default isolation
89. 90 Analysis Results Application Language Inventory Voucher Cart Opencart PHP ✗ ✗ ✔ Prestashop PHP ✗ ✗ ✔ Magento PHP ✗ ✗ ✔ WooCommerce PHP ✗ ✗ ✔ Spree Ruby on Rails ✔ ✔ ✔ Ror_ecommerce Ruby on Rails ✗ N/A ✗ Shoppe Ruby on Rails ✗ N/A ✗ Oscar Python (Django) ✗ ✗ ✔ LFS Python (Django) ✗ ✗ ✗ Saleor Python (Django) ✗ ✗ N/A Broadleaf Java (Spring) N/A ✗ ✗ Shopizer Java (Spring) N/A N/A ✗ ✗ = vulnerable, ✔ = not vulnerable 22 new vulnerabilities! 2M+ sites at risk 4 different languages 5 errors due to DB default isolation 17 errors due to improper transaction usage
90. 91 Developer Response 8 confirmed
91. 92 Developer Response 8 confirmed
92. 93 Developer Response 8 confirmed
93. 94 Developer Response 8 confirmed
94. 95 Developer Response 8 confirmed
95. 96 Developer Response 8 confirmed
98. 99 Developer Response
99. 100 Developer Response
100. 101 Related Work • [Bailis et al. 2015] Study user level (Feral) invariants in Ruby on Rails applications • [Jorwekar et al. 2007] Provide analysis methods for detecting potential anomalies in transaction programs for Snapshot Isolation • [Fekete et al. 2009] Quantify Read Committed and Snapshot Isolation anomalies • Our focus is on any non-serializable behavior in API based web applications as observed in practice
101. 102 Conclusions • Many popular eCommerce applications do not use transactions correctly • 2AD: a new, cross-language analysis tool to check for potential anomalies • Using 2AD, we find 22 new vulnerabilities due to incorrect transaction usage affecting up to 2M+ eCommerce sites
102. 103 Conclusions • Many popular eCommerce applications do not use transactions correctly • 2AD: a new, cross-language analysis tool to check for potential anomalies • Using 2AD, we find 22 new vulnerabilities due to incorrect transaction usage affecting up to 2M+ eCommerce sites Thanks! twarszaw@stanford.edu https://github.com/stanford-futuredata/acidrain