Implicit Flows: Can’t Live with ‘Em, Can’t Live without ‘Em

Abstract

Abstract. Verifying that programs trusted to enforce security actually do so is a practical concern for programmers and administrators. However, there is a disconnect between the kinds of tools that have been successfully applied to real software systems (such as taint mode in Perl and Ruby), and information-flow compilers that enforce a variant of the stronger security property of noninterference. Tools that have been successfully used to find security violations have focused on explicit flows of information, where high-security information is directly leaked to output. Analysis tools that enforce noninterference also prevent implicit flows of information, where high-security information can be inferred from a program's flow of control. However, these tools have seen little use in practice, despite the stronger guarantees that they provide.To better understand why, this paper experimentally investigates the explicit and implicit flows identified by the standard algorithm for establishing noninterference. When applied to implementations of authentication and cryptographic functions, the standard algorithm discovers many real implicit flows of information, but also reports an extremely high number of false alarms, most of which are due to conservative handling of unchecked exceptions (e.g., null pointer exceptions). After a careful analysis of all sources of true and false alarms, due to both implicit and explicit flows, the paper concludes with some ideas to improve the false alarm rate, toward making stronger security analysis more practical.

Exploring and enforcing security guarantees via program dependence graphs

“…Indeed, the prevalence of taint-tracking mechanisms (e.g., Perl's taint mode, and numerous systems [2,32,56,61]) show that it is intuitive and appealing for developers to consider just explicit flows. Moreover, tracking only explicit flows leads to fewer false positives (albeit at the cost of more false negatives) [15,29].…”

Permissive dynamic information flow analysis

“…λ info is much simpler than JavaScript, allowing us to reason more easily about some of the challenges involved in correctly handling implicit flows. Although exceptions add important additional complexities to implicit flows [2,24], we leave them for future work.…”

“…Askarov et al [1] demonstrate that Denning-style analysis may leak more than one bit in the presence of intermediary output channels, but that any attack will be limited to a brute-force approach. Askarov and Sabelfeld [2] and King et al [24] discuss exception handling challenges. Livshits et al [25] design a system for inferring information flow policies to handle explicit flows.…”

Preliminary design of the SAFE platform

“…Others, including Safe, also track implicit flows [8]-situations where the program's control state depends on secret data. A benefit of dealing with implicit flows is that we get a crisp statement of the security guarantee provided by the information-flow tracking mechanism: a noninterference theorem [6], stating (roughly) that the sensitive inputs of a program cannot influence its public outputs.…”