ACIDRain: Concurrency-Related Attacks on Database-Backed Web Applications

ACIDRain: Concurrency-Related Attacks on Database-Backed Web Applications

Transcript

  1. 1 ACIDRain: Concurrency-Related Attacks on Database-Backed Web Applications Todd Warszawski,

    Peter Bailis Stanford University
  2. 2 Explore Real World Transaction Usage • Do programmers use

    transactions correctly? • This paper: 22 new critical vulnerabilities due to incorrect transaction usage – Corrupt store inventory, overspend giftcards, steal items • 50% of eCommerce sites (2M+) at risk
  3. 3 Analyzed Popular Sites

  4. 5 Analyzed Popular Sites Plus 9 more!

  5. 6 Companies Using These Applications

  6. 7

  7. 8

  8. 9

  9. 10 What do these vulnerabilities look like?

  10. 11 LIVE DEMO HERE Invite Todd to talk at your

    organization!
  11. 12

  12. 13

  13. 14 “By sending thousands of simultaneous requests, the attacker was

    able to ‘move’ coins from one user account to another until the sending account was overdrawn, before balances were updated.”
  14. 15 What's Happening? • Race condition – application exhibits behavior

    under concurrent execution not possible under serial execution • Can we exploit these behaviors? • Yes! We call this exploitation of non- serializable API behavior an ACIDRain attack
  15. 16 Overview • Problem setup • New method for detecting

    latent potential for non-serializable behavior • Evaluation – analysis of 12 eCommerce platforms
  16. 17 Problem Setup: Attacking Websites http POST request SELECT ...

    UPDATE ... SELECT ... http GET request Application Server Database
  17. 18 Problem Setup: Attacking Websites http POST request SELECT ...

    UPDATE ... SELECT ... http GET request Application Server Database
  18. 19 Problem Setup: Attacking Websites http POST request SELECT ...

    UPDATE ... SELECT ... http GET request Application Server Database
  19. 20 Problem Setup: Attacking Websites http POST request SELECT ...

    UPDATE ... SELECT ... http GET request Application Server Database
  20. 21 Problem Setup: Attacking Websites http POST request SELECT ...

    UPDATE ... SELECT ... http GET request Application Server Application Server Database
  21. 22 Problem Setup: Attacking Websites http POST request SELECT ...

    UPDATE ... SELECT ... http GET request Database Application Server
  22. 23 Problem Setup: Attacking Websites http POST request SELECT ...

    UPDATE ... SELECT ... http GET request Serializability of API Requests Serializability of Database Transactions Application Server Database
  23. 24 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY
  24. 25 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 0 Application Server Database
  25. 26 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 0 Application Server Database
  26. 27 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 0 Application Server Database
  27. 28 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 1 Application Server Database
  28. 29 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 1 Application Server Database
  29. 30 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 1 Bob Checkout usage = 1 Application Server Database
  30. 31 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 0 Application Server Database
  31. 32 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 0 Application Server Database
  32. 33 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 0 Application Server Database
  33. 34 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 0 Application Server Database
  34. 35 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 1 Application Server Database
  35. 36 Non-Transactional Implementation def checkVoucher(code): usage = readUsage(code) if (usage

    == 0): markUsed(code) SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE usage = 1 Application Server Database
  36. 37 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT
  37. 38 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
  38. 39 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
  39. 40 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
  40. 41 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
  41. 42 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
  42. 43 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 0 Database Application Server
  43. 44 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 1 Database Application Server
  44. 45 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 1 Database Application Server
  45. 46 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 1 Database Application Server
  46. 47 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 1 Database Application Server
  47. 48 Transactional Implementation def checkVoucher(code): beginTxn() usage = readUsage(code) if

    (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Alice Checkout SELECT 0 UPDATE SELECT 0 Bob Checkout UPDATE BEGIN BEGIN COMMIT COMMIT usage = 1 Database Application Server Will one of the transactions fail? It depends
  48. 49 = prevents anomaly = exhibits anomaly Many Databases Allow

    This Anomaly Database Default Isolation Maximum Isolation Actian Ingres 10.0/10S Aerospike Akiban Persistit Clustrix CLX 4100 Greenplum 4.1 IBM DB2 10 for z/OS MySQL 5.6 MemSQL 1b MS SQL Server 2012 NuoDB Oracle 11g Oracle Berkeley DB Oracle Berkeley DB JE Postgres 9.2.2 SAP HANA ScaleDB 1.02 VoltDB
  49. 50 Two Sources of Vulnerabilities • Databases providing weak isolation

    may exhibit non-serializable behavior def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() def checkVoucher(code): usage = readUsage(code) if (usage == 0): markUsed(code) • Programmers may code transactions incorrectly
  50. 51 Overview • Problem setup • New method for detecting

    latent potential for non-serializable behavior • Evaluation – analysis of 12 eCommerce platforms
  51. 52 Analysis Challenges • Want to analyze web applications written

    in multiple languages and frameworks • Anomalies only occur under concurrent execution, but website activity is often serial
  52. 53 Approach: Abstract Anomaly Detection (2AD) Collect (possibly serial) logs

    from database Build compact representation of history (abstract history graph) Search abstract history for cycles to generate possible anomalous API calls 1. 2. a 3.
  53. Approach: Abstract Anomaly Detection (2AD)

  54. Approach: Abstract Anomaly Detection (2AD)

  55. Approach: Abstract Anomaly Detection (2AD)

  56. Approach: Abstract Anomaly Detection (2AD)

  57. Approach: Abstract Anomaly Detection (2AD)

  58. 59 Approach: Abstract Anomaly Detection (2AD)

  59. 60 Approach: Abstract Anomaly Detection (2AD) Collect (possibly serial) logs

    from database Build compact representation of history (abstract history graph) Search abstract history for cycles to generate possible anomalous API calls 1. 2. a 3.
  60. 61 Abstract History Graph def checkVoucher(code): beginTxn() usage = readUsage(code)

    if (usage == 0): markUsed(code) commit() BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT
  61. 62 Abstract History Graph BEGIN TRANSACTION SELECT usage FROM voucher

    WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT
  62. 63 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION

    SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation Add node for each operation 1.
  63. 64 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION

    SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction Add node for each operation Add supernode for each transaction 1. 2.
  64. 65 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION

    SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction = API Call Add node for each operation Add supernode for each transaction Add super-supernode for each API call 1. 2. 3.
  65. 66 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION

    SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction = API Call = Conflict Add node for each operation Add supernode for each transaction Add super-supernode for each API call Add edge for each conflict 1. 2. 3. 4.
  66. 67 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION

    SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction = API Call = Conflict Add node for each operation Add supernode for each transaction Add super-supernode for each API call Add edge for each conflict 1. 2. 3. 4.
  67. 68 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION

    SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction = API Call = Conflict Add node for each operation Add supernode for each transaction Add super-supernode for each API call Add edge for each conflict 1. 2. 3. 4.
  68. 69 Abstract History Graph r(voucher) w(voucher) r(voucher) w(voucher) BEGIN TRANSACTION

    SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT = Operation = Transaction = API Call = Conflict Add node for each operation Add supernode for each transaction Add super-supernode for each API call Add edge for each conflict Search for cycles in the graph 1. 2. 3. 4. 5.
  69. 70 Abstract History Graph r(voucher) w(voucher) = Operation = Transaction

    = API Call = Conflict BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY BEGIN TRANSACTION SELECT usage FROM voucher WHERE code = HNUHY UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT UPDATE voucher SET usage = 1 WHERE code = HNUHY COMMIT Add node for each operation Add supernode for each transaction Add super-supernode for each API call Add edge for each conflict Search for cycles in the graph 1. 2. 3. 4. 5. r(voucher) w(voucher)
  70. 71 Completeness Guarantees • Completeness: if there is a potential

    anomalous execution, this approach will find it • Soundness: discussion in paper Thm: Given a set of API calls, there exists an anomalous execution of the API calls if and only if there is a cycle in the abstract history.
  71. 72 Limitations • Does not take into account user level

    (i.e., "feral" [Bailis et al. 2015]) concurrency control def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit()
  72. 73 Limitations • Does not take into account user level

    (i.e., "feral" [Bailis et al. 2015]) concurrency control def checkVoucher(code): beginTxn() usage = readUsage(code) if (usage == 0): markUsed(code) commit() def checkVoucher(code): appLock.lock() usage = readUsage(code) if (usage == 0): markUsed(code) appLock.release()
  73. 74 Overview • Problem setup • New method for detecting

    latent potential for non-serializable behavior • Evaluation – analysis of 12 eCommerce platforms
  74. 75 Ecommerce Platforms

  75. 76 Ecommerce Platforms Interested in 3 key invariants: 1. Inventory

    2. Voucher 3. Cart
  76. 77 Inventory Invariant Stock should not go below 0 and

    should reflect all orders placed
  77. 78 Inventory Invariant Stock should not go below 0 and

    should reflect all orders placed
  78. 79 Inventory Invariant Stock should not go below 0 and

    should reflect all orders placed
  79. 80 Voucher Invariant Vouchers should not be spent past their

    intended limit
  80. 81 Voucher Invariant Vouchers should not be spent past their

    intended limit
  81. 82 Voucher Invariant Vouchers should not be spent past their

    intended limit
  82. 83 Cart Invariant Total charged for an order should be

    equal to the value of items associated with the order
  83. 84 Cart Invariant Total charged for an order should be

    equal to the value of items associated with the order
  84. 85 Cart Invariant Total charged for an order should be

    equal to the value of items associated with the order
  85. 86 Analysis Results Application Language Inventory Voucher Cart Opencart PHP

    ✗ ✗ ✔ Prestashop PHP ✗ ✗ ✔ Magento PHP ✗ ✗ ✔ WooCommerce PHP ✗ ✗ ✔ Spree Ruby on Rails ✔ ✔ ✔ Ror_ecommerce Ruby on Rails ✗ N/A ✗ Shoppe Ruby on Rails ✗ N/A ✗ Oscar Python (Django) ✗ ✗ ✔ LFS Python (Django) ✗ ✗ ✗ Saleor Python (Django) ✗ ✗ N/A Broadleaf Java (Spring) N/A ✗ ✗ Shopizer Java (Spring) N/A N/A ✗ ✗ = vulnerable, ✔ = not vulnerable 22 new vulnerabilities!
  86. 87 Analysis Results Application Language Inventory Voucher Cart Opencart PHP

    ✗ ✗ ✔ Prestashop PHP ✗ ✗ ✔ Magento PHP ✗ ✗ ✔ WooCommerce PHP ✗ ✗ ✔ Spree Ruby on Rails ✔ ✔ ✔ Ror_ecommerce Ruby on Rails ✗ N/A ✗ Shoppe Ruby on Rails ✗ N/A ✗ Oscar Python (Django) ✗ ✗ ✔ LFS Python (Django) ✗ ✗ ✗ Saleor Python (Django) ✗ ✗ N/A Broadleaf Java (Spring) N/A ✗ ✗ Shopizer Java (Spring) N/A N/A ✗ ✗ = vulnerable, ✔ = not vulnerable 22 new vulnerabilities! 2M+ sites at risk
  87. 88 Analysis Results Application Language Inventory Voucher Cart Opencart PHP

    ✗ ✗ ✔ Prestashop PHP ✗ ✗ ✔ Magento PHP ✗ ✗ ✔ WooCommerce PHP ✗ ✗ ✔ Spree Ruby on Rails ✔ ✔ ✔ Ror_ecommerce Ruby on Rails ✗ N/A ✗ Shoppe Ruby on Rails ✗ N/A ✗ Oscar Python (Django) ✗ ✗ ✔ LFS Python (Django) ✗ ✗ ✗ Saleor Python (Django) ✗ ✗ N/A Broadleaf Java (Spring) N/A ✗ ✗ Shopizer Java (Spring) N/A N/A ✗ ✗ = vulnerable, ✔ = not vulnerable 22 new vulnerabilities! 2M+ sites at risk 4 different languages
  88. 89 Analysis Results Application Language Inventory Voucher Cart Opencart PHP

    ✗ ✗ ✔ Prestashop PHP ✗ ✗ ✔ Magento PHP ✗ ✗ ✔ WooCommerce PHP ✗ ✗ ✔ Spree Ruby on Rails ✔ ✔ ✔ Ror_ecommerce Ruby on Rails ✗ N/A ✗ Shoppe Ruby on Rails ✗ N/A ✗ Oscar Python (Django) ✗ ✗ ✔ LFS Python (Django) ✗ ✗ ✗ Saleor Python (Django) ✗ ✗ N/A Broadleaf Java (Spring) N/A ✗ ✗ Shopizer Java (Spring) N/A N/A ✗ ✗ = vulnerable, ✔ = not vulnerable 22 new vulnerabilities! 2M+ sites at risk 4 different languages 5 errors due to DB default isolation
  89. 90 Analysis Results Application Language Inventory Voucher Cart Opencart PHP

    ✗ ✗ ✔ Prestashop PHP ✗ ✗ ✔ Magento PHP ✗ ✗ ✔ WooCommerce PHP ✗ ✗ ✔ Spree Ruby on Rails ✔ ✔ ✔ Ror_ecommerce Ruby on Rails ✗ N/A ✗ Shoppe Ruby on Rails ✗ N/A ✗ Oscar Python (Django) ✗ ✗ ✔ LFS Python (Django) ✗ ✗ ✗ Saleor Python (Django) ✗ ✗ N/A Broadleaf Java (Spring) N/A ✗ ✗ Shopizer Java (Spring) N/A N/A ✗ ✗ = vulnerable, ✔ = not vulnerable 22 new vulnerabilities! 2M+ sites at risk 4 different languages 5 errors due to DB default isolation 17 errors due to improper transaction usage
  90. 91 Developer Response 8 confirmed

  91. 92 Developer Response 8 confirmed

  92. 93 Developer Response 8 confirmed

  93. 94 Developer Response 8 confirmed

  94. 95 Developer Response 8 confirmed

  95. 96 Developer Response 8 confirmed

  96. 97

  97. 98

  98. 99 Developer Response

  99. 100 Developer Response

  100. 101 Related Work • [Bailis et al. 2015] Study user

    level (Feral) invariants in Ruby on Rails applications • [Jorwekar et al. 2007] Provide analysis methods for detecting potential anomalies in transaction programs for Snapshot Isolation • [Fekete et al. 2009] Quantify Read Committed and Snapshot Isolation anomalies • Our focus is on any non-serializable behavior in API based web applications as observed in practice
  101. 102 Conclusions • Many popular eCommerce applications do not use

    transactions correctly • 2AD: a new, cross-language analysis tool to check for potential anomalies • Using 2AD, we find 22 new vulnerabilities due to incorrect transaction usage affecting up to 2M+ eCommerce sites
  102. 103 Conclusions • Many popular eCommerce applications do not use

    transactions correctly • 2AD: a new, cross-language analysis tool to check for potential anomalies • Using 2AD, we find 22 new vulnerabilities due to incorrect transaction usage affecting up to 2M+ eCommerce sites Thanks! twarszaw@stanford.edu https://github.com/stanford-futuredata/acidrain