Group meeting: TaintPipe - Pipelined Symbolic Taint Analysis

Paper (USENIX Security '15): https://www.usenix.org/node/190954

Transcript

1. TaintPipe: Pipelined Symbolic Taint Analysis Jiang Ming, Dinghao Wu, Gaoyao Xiao, Jun Wang, and Peng Liu The Pennsylvania State University USENIX Security ‘15
2. Outline • Introduction • Background • Design and Implementation • Experimental Evaluation • Discussions and Limitations
3. Introduction
4. Taint analysis • Basic idea: keep track of tags derived from user input Taint seeds Taint propagation Taint sinks
5. Taint analysis • Static taint analysis (STA) • performed prior to execution • no impact on runtime performance • under-tainting or over-tainting • Dynamic taint analysis (DTA) • more accurate • high runtime overhead (Pin: > 6X slowdown)
6. Problems of DTA • high runtime overhead (6X~30X) • 6~8 extra instructions to propagate a taint tag in shadow memory • strict coupling of program execution and data flow tracking logic • frequent “context-switches” • register spilling • data cache pollution
7. Previous work • Hardware-assisted approach • customized hardware for logging a program trace and delivering it to other idle cores for inspection • hardware first-in first-out buffer for speeding up communication between cores • Software-only methods • rely on dynamic binary instrumentation (DBI) • decouple dynamic taint analysis from program execution • ShadowReplica: “primary & secondary” thread model
8. TaintPipe • parallel data flow tracking using pipelined symbolic taint analysis • segmented symbolic taint analysis • symbolic taint state resolution
9. Background
10. Inlined Analysis vs. TaintPipe • instrumented application thread: lightweight online logging • multiple worker threads: symbolic taint analysis
11. Inlined Analysis vs. TaintPipe • (a) code segment • (b) symbolic taint states, the input value size and num are labeled as symbol1 and symbol2 • (c) resolving symbolic taint states when size is tainted as tag1 and num is a constant value (num = 0xffffffff)
12. TaintPipe • record compact control flow information to reconstruct straight-line code • targets of direct and indirect jumps have been resolved • most addresses of memory operations can be inferred from the straight-line code • pipelining design (asynchronous) • may detect an attack some time after the real attack has happened
13. Design & Implementation
14. Architecture • built on top of a dynamic binary instrumentation tool • work with unmodified program binaries
15. Implementation • online logging and pipelining framework • dynamic binary instrumentation framework Pin • 3,100 lines of C/C++ code • taint analysis engine • binary analysis platform BAP • based on BAP’s symbolic execution module • 4,400 lines of OCaml code
16. Logging • Logged data • control flow profile (in compact format) • concrete execution state when taint seeds are first introduced, including registers and memory (e.g., CR0~CR4, EFLAGS and addresses of initial taint seeds)
17. Lightweight Online Logging • control flow profile: sequence of basic blocks executed • Detailed Execution Profile (DEP) • 2-byte profile structure to represent 4-byte basic block address on x86-32 machine • H-tag, L-tag, and special tag (0x0000) • optimization for REP-prefix instructions
19. Straight-line Code Construction Control flow profile Basic block entry address x86 instructions Intermediate language
20. N-way Buffering Scheme • “one producer, multiple consumers” model • buffering thread pool
21. Symbolic Taint Analysis • BIL, a RISC-like intermediate language • symbolic memory index, value set analysis
22. Taint Operation Generation • taint basic block, cached for efficiency • function summary
23. Experimental Evaluation
24. Optimal configuration • Determine the optimal values for two factors • control flow profile buffer size • number of worker threads • Experiment setup • 2x Intel Xeon E5-2690 • 128GB RAM • 250GB SSD • Ubuntu 12.04
25. Performance (SPEC CPU2006) On average, the instrumented application thread enforces a 2.60X slowdown to native execution, while the overall slowdown of TaintPipe is 4.14X.
26. Effects of Optimizations • O1: function summary • O2: O1 + taint basic block cache • O3: O2 + intra-block optimization
27. Security Applications
28. Discussions and Limitations • asynchronous taint check • provide synchronous policy enforcement at critical points • malicious self-modifying code