Andromeda: Accurate and Scalable Security Analysis of Web Applications

Abstract

Abstract. Security auditing of industry-scale software systems mandates automation. Static taint analysis enables deep and exhaustive tracking of suspicious data flows for detection of potential leakage and integrity violations, such as cross-site scripting (XSS), SQL injection (SQLi) and log forging. Research in this area has taken two directions: program slicing and type systems. Both of these approaches suffer from a high rate of false findings, which limits the usability of analysis tools based on these techniques. Attempts to reduce the number of false findings have resulted in analyses that are either (i) unsound, suffering from the dual problem of false negatives, or (ii) too expensive due to their high precision, thereby failing to scale to real-world applications.In this paper, we investigate a novel approach for enabling precise yet scalable static taint analysis. The key observation informing our approach is that taint analysis is a demand-driven problem, which enables lazy computation of vulnerable information flows, instead of eagerly computing a complete data-flow solution, which is the reason for the traditional dichotomy between scalability and precision. We have implemented our approach in ANDROMEDA, an analysis tool that computes data-flow propagations on demand, in an efficient and accurate manner, and additionally features incremental analysis capabilities. ANDROMEDA is currently in use in a commercial product. It supports applications written in Java, .NET and JavaScript. Our extensive evaluation of ANDROMEDA on a suite of 16 production-level benchmarks shows ANDROMEDA to achieve high accuracy and compare favorably to a state-of-the-art tool that trades soundness for precision.

IccTA: Detecting Inter-Component Privacy Leaks in Android Apps

“…PiOS [16] uses program slicing and reachability analysis to detect the possible privacy leaks in iOS apps. TAJ [43] and Andromeda [42] uses the same taint analysis technique to identify privacy leaks in web applications.…”

Reviser: efficiently updating IDE-/IFDS-based data-flow analyses in response to incremental program changes

“…Much more sophisticated abstractions exist, in which facts can, for instance, model aliasing through sets of access paths [25] or even the abstract typestate of combinations of multiple objects [13]. The IFDS framework itself, however, is oblivious to the concrete abstraction being used; the abstraction is a free parameter to the framework.…”

“…Tripp et al [25] efficiently update data-flow results by replacing the whole-program control-flow graph and pointer analysis with local information computed on demand during the taint propagation. This removes the need of recomputing these data structures when the target changes.…”

Security slicing for auditing XML, XPath, and SQL injection vulnerabilities

“…Approaches based on taint analysis [13], [14], [15], [16], [17], [18] and symbolic execution [19], [20] help identify and locate potential vulnerabilities in program code, and thus, could help with the auditor's tasks. Though none of these approaches, except for the work reported in [16], seems to explicitly address XMLi and XPathi, they could be adapted to detect these vulnerabilities.…”

“…We define a specific security slicing approach for the auditing of security vulnerabilities in program source code. Like taint analysis, our approach also uses static program analysis techniques, which are known to be scalable [17]. However, our analysis additionally extracts control-dependency information, which is often important for security auditing of input validation and sanitization procedures.…”