Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

76
Michael Bond Varun Srivastava Kathryn McKinley Vitaly Shmatikov University of Texas at Austin

description

Michael Bond Varun Srivastava Kathryn McKinley Vitaly Shmatikov University of Texas at Austin. Efficient, Context-Sensitive Detection of Real-World Semantic Attacks. Real Semantic Exploits & Efficient, Context-Sensitive Detection. How an applet loads a class. - PowerPoint PPT Presentation

Transcript of Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Page 1: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Michael BondVarun SrivastavaKathryn McKinleyVitaly ShmatikovUniversity of Texas at Austin

Page 2: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Real Semantic Exploits&

Efficient, Context-Sensitive Detection

Page 3: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

How an applet loads a class

Page 4: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

Page 5: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

Access-control security

Page 6: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

Page 7: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...} SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

Page 8: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

classLoader.loadClass(“sun/applet/AppletClassLoader”);classLoader.loadClass(“sun/applet/AppletClassLoader”);

Sun Java Virtual Machine 1.3

Page 9: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

classLoader.loadClass(“sun/applet/AppletClassLoader”);classLoader.loadClass(“sun/applet/AppletClassLoader”);

Page 10: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“sun/applet/AppletClassLoader”);classLoader.loadClass(“sun/applet/AppletClassLoader”);

Page 11: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...} SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“sun/applet/AppletClassLoader”);classLoader.loadClass(“sun/applet/AppletClassLoader”);

Page 12: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...} SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“sun/applet/AppletClassLoader”);classLoader.loadClass(“sun/applet/AppletClassLoader”);

Semantic exploit

Examples:•Omitted security check•Untrusted code executes in wrong context•Misconfigured security policy

Page 13: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...} SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“sun/applet/AppletClassLoader”);classLoader.loadClass(“sun/applet/AppletClassLoader”);

How to detect this exploit?

Infeasible path detection?

Does not violate semantics

(e.g., type & memory safety,

control-flow integrity)

Page 14: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...} SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“sun/applet/AppletClassLoader”);classLoader.loadClass(“sun/applet/AppletClassLoader”);

How to detect this exploit?

Check against specification?

No specification available

Page 15: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...} SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“sun/applet/AppletClassLoader”);classLoader.loadClass(“sun/applet/AppletClassLoader”);

How to detect this exploit?

Infer specification from dynamic behavior?

Page 16: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

classLoader.loadClass(“sun/applet/AppletClassLoader”);classLoader.loadClass(“sun/applet/AppletClassLoader”);

Which dynamic behavior?

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

Page 17: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(“java.util.HashMap”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :121

File.exists()

loadClass(“sun/applet/AppletClassLoader”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :121

File.exists()

loadClass(“MyClass”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :139

File.exists()

Page 18: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(“java.util.HashMap”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :121

File.exists()

loadClass(“sun/applet/AppletClassLoader”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :121

File.exists()

loadClass(“MyClass”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :139

File.exists()

Train

Deploy

Page 19: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

classLoader.loadClass(“MyClass”);classLoader.loadClass(“MyClass”);

Page 20: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

classLoader.loadClass(“MyClass”);classLoader.loadClass(“MyClass”);

Page 21: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“MyClass”);classLoader.loadClass(“MyClass”);

Page 22: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...} SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“MyClass”);classLoader.loadClass(“MyClass”);

Page 23: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(“java.util.HashMap”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :121

File.exists()

loadClass(“sun/applet/AppletClassLoader”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :121

File.exists()

loadClass(“MyClass”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :139

File.exists()

Page 24: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(“java.util.HashMap”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :121

File.exists()

loadClass(“sun/applet/AppletClassLoader”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :121

File.exists()

loadClass(“MyClass”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :139

File.exists()

Page 25: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(“java.util.HashMap”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :121

File.exists()

loadClass(“sun/applet/AppletClassLoader”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :121

File.exists()

loadClass(“MyClass”);… SecurityManager.checkPackageAccess()…… FileURLLoader.getResource():73 walkPathComponents() :139

File.exists()

Train

Train

Deploy

Page 26: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

(Sampled & Reproduced)Real Semantic Exploits

Context sensitivity needed?

History sensitivity needed?

SlashPathMistakenly omitted security check

Yes Yes

XSLTUntrusted code executes in wrong (application) security context

Yes No

LiveConnectUntrusted code executes in wrong (applet) security context

No No

OperaPolicyMisconfigured security policy

No No

Page 27: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

ClassLoader.loadClass():312ClassLoader.loadClass():312

ClassLoader.loadClass():341ClassLoader.loadClass():341

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

FileURLLoader.walkPathComponents():121FileURLLoader.walkPathComponents():121

More

con

text

sen

siti

vit

y

Page 28: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

ClassLoader.loadClass():312ClassLoader.loadClass():312

ClassLoader.loadClass():341ClassLoader.loadClass():341

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

FileURLLoader.walkPathComponents():121FileURLLoader.walkPathComponents():121

Fals

e n

egati

ves

Fals

e p

osi

tives

More

con

text

sen

siti

vit

y

Page 29: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

ClassLoader.loadClass():312ClassLoader.loadClass():312

ClassLoader.loadClass():341ClassLoader.loadClass():341

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

FileURLLoader.walkPathComponents():121FileURLLoader.walkPathComponents():121

Fals

e n

egati

ves

Fals

e p

osi

tives

More

con

text

sen

siti

vit

y

Overh

ead

Page 30: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

Page 31: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

S ← walkStack ()check ( S )

S ← walkStack ()check ( S )

Page 32: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks
Page 33: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Proportional todepth & security

calls

High overhead at security calls

Page 34: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Efficient,Depth-Limited

Context Sensitivity

Page 35: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Represent calling context asprobabilistically unique integer

Page 36: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Compute value at every callUse value at security calls

Page 37: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Compute value at every callUse value at security calls

Always-available contextLow overhead at security calls

Page 38: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

Page 39: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

V1 ← f ( V0 , cs1 )

V0 ← 0

Page 40: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

V1 ← f ( V0 , cs1 )

V2 ← f ( V0 , cs2 )

V0 ← 0

Page 41: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

V1 ← f ( V0 , cs1 )

V2 ← f ( V0 , cs2 )V3 ← f ( V2 , cs3 )

V4 ← f ( V3 , cs4 )

V5 ← f ( V4 , cs5 )V6 ← f ( V5 , cs6 )

V7 ← f ( V6 , cs7 )

V0 ← 0

Page 42: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

V1 ← f ( V0 , cs1 )check ( V1 )

V2 ← f ( V0 , cs2 )V3 ← f ( V2 , cs3 )

V4 ← f ( V3 , cs4 )

V5 ← f ( V4 , cs5 )V6 ← f ( V5 , cs6 )

V7 ← f ( V6 , cs7 )check ( V7 )

V0 ← 0

Page 43: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

loadClass(name) { ... if (name.lastIndexOf(‘.’) != -1) securityManager.checkPackageAccess(name); ... super.loadClass();}

ClassLoader.loadClass():341ClassLoader.loadClass():341

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

walkPathComponents() { ...121: { ... if (file.exists()) ... } ...139: { ... if (file.exists()) ... } ...}

SecurityManager.checkRead()SecurityManager.checkRead()

File.checkRead():1485File.checkRead():1485

File.exists():268File.exists():268

FileURLLoader.getResource():73FileURLLoader.getResource():73

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“java.util.HashSet”);classLoader.loadClass(“java.util.HashSet”);

V1 ← f ( V0 , cs1 )check ( V1 )

V2 ← f ( V0 , cs2 )V3 ← f ( V2 , cs3 )

V4 ← f ( V3 , cs4 )

V5 ← f ( V4 , cs5 )V6 ← f ( V5 , cs6 )

V7 ← f ( V6 , cs7 )check ( V7 )

V0 ← 0

Historysensitivity

Page 44: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

f ( V , cs ) ≡ 3V + cs (mod 232)

Page 45: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

f ( V , cs ) ≡ 3V + cs (mod 232)

Motivated by MPI data-type hashing [Langou et al. ’05] [Gropp ’00]

Page 46: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

f ( V , cs ) ≡ 3V + cs (mod 232)

Encodes entire calling context

Page 47: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

f ( V , cs ) ≡ 2 32/k V + cs (mod 232)

Encodes last k call sites

Page 48: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

f ( V , cs ) ≡ 2 32/k V + cs (mod 232)

Cheap to compute

Page 49: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

f ( V , cs ) ≡ 2 32/k V + cs (mod 232)

Cheap to computeComposition cheap to compute

Page 50: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

f ( V , cs ) ≡ 2 32/k V + cs (mod 232)

Cheap to computeComposition cheap to computeNon-commutative

Page 51: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

f ( V , cs ) ≡ 2 32/k V + cs (mod 232)

Cheap to computeComposition cheap to computeNon-commutativeProbabilistically unique (?)

Page 52: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks
Page 53: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Not proportionalto depth

Low overhead at security calls

Page 54: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Detect all exploitswithout many false positives

Context sensitivity: 3History sensitivity: 1

Page 55: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Real Semantic Exploit

Context sensitivity needed?

History sensitivity needed?

SlashPathMistakenly omitted security check

Yes Yes

XSLTUntrusted code executes in wrong (application) security context

Yes No

LiveConnectUntrusted code executes in wrong (applet) security context

No No

OperaPolicyMisconfigured security policy

No No

Page 56: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Leave-one-out cross-validation on

12 benign applets8 benign XSLT inputs

Page 57: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Leave-one-out cross-validation on

12 benign applets8 benign XSLT inputs

Depth-limited context sensitivity needed

Page 58: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Context and history sensitivityfor unsafe languages [Forrest et al., Feng et

al.]

Context sensitivityfor anomalous paths [Inoue et al.]

Page 59: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Context & history sensitivityactually neededfor real exploits

Page 60: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Context & history sensitivityactually neededfor real exploits

Tension between false positives & negatives

Page 61: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks
Page 62: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

check(V) { H = h(V, lastV); checkHelper(H); lastV = V; }

Page 63: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

classLoader.loadClass(“java.util.HashSet”)classLoader.loadClass(“java.util.HashSet”)

SecurityManager.checkRead()SecurityManager.checkRead()SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

Page 64: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

classLoader.loadClass(“java.util.HashSet”)classLoader.loadClass(“java.util.HashSet”)

classLoader.loadClass(“sun/applet/AppletClassLoader”)classLoader.loadClass(“sun/applet/AppletClassLoader”)

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess() SecurityManager.checkRead()SecurityManager.checkRead()

SecurityManager.checkRead()SecurityManager.checkRead()SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

Page 65: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

classLoader.loadClass(“java.util.HashSet”)classLoader.loadClass(“java.util.HashSet”)

classLoader.loadClass(“sun/applet/AppletClassLoader”)classLoader.loadClass(“sun/applet/AppletClassLoader”)

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess() SecurityManager.checkRead()SecurityManager.checkRead()

SecurityManager.checkRead()SecurityManager.checkRead()SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

Train: observe behavior

Deploy: detect new behavior

Page 66: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

classLoader.loadClass(“java.util.HashSet”)classLoader.loadClass(“java.util.HashSet”)

classLoader.loadClass(“sun/applet/AppletClassLoader”)classLoader.loadClass(“sun/applet/AppletClassLoader”)

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess() SecurityManager.checkRead()SecurityManager.checkRead()

SecurityManager.checkRead()SecurityManager.checkRead()SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“MyClass”);classLoader.loadClass(“MyClass”);

SecurityManager.checkRead()SecurityManager.checkRead()SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

Page 67: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

classLoader.loadClass(“java.util.HashSet”)classLoader.loadClass(“java.util.HashSet”)

classLoader.loadClass(“sun/applet/AppletClassLoader”)classLoader.loadClass(“sun/applet/AppletClassLoader”)

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“MyClass”);classLoader.loadClass(“MyClass”);

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():139...

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():139...

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():121...

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():121...

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():121...

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():121...

Page 68: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

classLoader.loadClass(“java.util.HashSet”)classLoader.loadClass(“java.util.HashSet”)

classLoader.loadClass(“sun/applet/AppletClassLoader”)classLoader.loadClass(“sun/applet/AppletClassLoader”)

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

classLoader.loadClass(“MyClass”);classLoader.loadClass(“MyClass”);

SecurityManager.checkPackageAccess()SecurityManager.checkPackageAccess()

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():139...

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():139...

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():121...

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():121...

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():121...

SecurityManager.checkRead()...FileURLLoader.walkPathComponents():121...

Train: observe behavior

Deploy: detect new behavior

Train: observe behavior

Page 69: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

C3 H1

Context sensitivity History sensitivity

Page 70: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

C3 H1

Context sensitivity History sensitivity(applets only)

Page 71: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

C0 H0 C0 H1

C1 H0 C1 H1

C3 H0 C3 H1

CH0 CH1

Page 72: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Anomalies

(All)

C0H00 (35)

C1H00 (54)

C3H00 (110)

CH00 (194)

Anomalies

(All)

C0H10 (59)

C1H11 (90)

C3H12 (145)

CH12 (222)

Page 73: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Anomalies

(All)

C00 (20)

C10 (40)

C32 (42)

C222 (1,573)

Page 74: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

Leave-one-out cross-validation on

12 benign applets8 benign XSLT inputs

Page 75: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

ArcTest

AtomViewer

CardTest

DiffEq

DitherTest

DrawTest

C3H0 0 0 0 0 4 0

C3H1 1 9 0 1 7 0

CH0 32 113 0 125 77 10

CH1 40 61 10 131 94 5Euler Gas Matrix Puzzle ReflFrame StringWave

C3H0 2 0 0 0 4 0

C3H1 6 1 0 1 6 0

CH0 46 14 56 10 74 9

CH1 101 28 73 12 93 0

Page 76: Efficient, Context-Sensitive Detection of Real-World Semantic Attacks

ui resume testcase testcase2

C0 0 0 0 0

C1 1 0 0 2

C3 0 0 1 2

C 15 3 63 1,409

testcase3

testcase4

testcase5

testcase6

C0 0 0 0 0

C1 0 1 0 0

C3 0 1 0 0

C 6 2 49 1


SADA: Semantic Adversarial Diagnostic Attacks for Autonomous … · fabdullah.hamdi, matthias.mueller.2, bernard.ghanemg@kaust.edu.sa Abstract One major factor impeding more widespread

SADA: Semantic Adversarial Diagnostic Attacks for Autonomous … · fabdullah.hamdi, matthias.mueller.2, [email protected] Abstract One major factor impeding more widespread

Trust and Semantic Attacks - CyLab Usable Privacy and Security …cups.cs.cmu.edu/courses/ups-sp06/slides/060223.pdf · 2006. 3. 1. · Trust and Semantic Attacks - II Ponnurangam

Trust and Semantic Attacks - CyLab Usable Privacy and Security …cups.cs.cmu.edu/courses/ups-sp06/slides/060223.pdf · 2006. 3. 1. · Trust and Semantic Attacks - II Ponnurangam

Fully Convolutional Networks for Semantic …yjlee/teaching/ecs289g-fall...Fully Convolutional Networks for Semantic Segmentation By Jonathan Long* Evan Shelhamer* Trevor Darrell Instance-sensitive

Fully Convolutional Networks for Semantic …yjlee/teaching/ecs289g-fall...Fully Convolutional Networks for Semantic Segmentation By Jonathan Long* Evan Shelhamer* Trevor Darrell Instance-sensitive

A Critical Review of Physical Layer Security in Wireless ......divided into three categories: Jamming attacks, flooding attacks, and semantic attacks. A jamming attack is when the

A Critical Review of Physical Layer Security in Wireless ......divided into three categories: Jamming attacks, flooding attacks, and semantic attacks. A jamming attack is when the

FIGHTING THE NEXT GENERATION OF TARGETED BEC ATTACKS …€¦ · NEXT GENERATION OF TARGETED BEC ATTACKS. ... Analyze outbound email to see what sensitive ... proofpoint.com/email.

FIGHTING THE NEXT GENERATION OF TARGETED BEC ATTACKS …€¦ · NEXT GENERATION OF TARGETED BEC ATTACKS. ... Analyze outbound email to see what sensitive ... proofpoint.com/email.

Social Influence Analysis in Microblogging Platforms – A Topic ... - Semantic … · Social Influence Analysis in Microblogging Platforms – A Topic-Sensitive based Approach

Social Influence Analysis in Microblogging Platforms – A Topic ... - Semantic … · Social Influence Analysis in Microblogging Platforms – A Topic-Sensitive based Approach

Building Detail-Sensitive Semantic Segmentation Networks With …openaccess.thecvf.com/content_CVPR_2019/papers/Wei... · 2019-06-10 · Building Detail-Sensitive Semantic Segmentation

Building Detail-Sensitive Semantic Segmentation Networks With …openaccess.thecvf.com/content_CVPR_2019/papers/Wei... · 2019-06-10 · Building Detail-Sensitive Semantic Segmentation

Pupil dilation is sensitive to semantic ambiguity and ...RUNNING TITLE: ACOUSTIC AND LINGUISTIC EFFECTS ON PUPIL SIZE 1 Pupil dilation is sensitive to semantic ambiguity and acoustic

Pupil dilation is sensitive to semantic ambiguity and ...RUNNING TITLE: ACOUSTIC AND LINGUISTIC EFFECTS ON PUPIL SIZE 1 Pupil dilation is sensitive to semantic ambiguity and acoustic

Semantic Interoperation and Electronic Health Records ......Semantic Interoperation and Electronic Health Records: Context Sensitive Mapping from SNOMED CT to ICD-10 A collaborative

Semantic Interoperation and Electronic Health Records ......Semantic Interoperation and Electronic Health Records: Context Sensitive Mapping from SNOMED CT to ICD-10 A collaborative

How to Spot Phishing Attacks - MicroAge · How to Spot Phishing Attacks What is Spear Phishing? Like phishing ploys, spear phishing scams are designed to obtain sensitive information

How to Spot Phishing Attacks - MicroAge · How to Spot Phishing Attacks What is Spear Phishing? Like phishing ploys, spear phishing scams are designed to obtain sensitive information

Deep Semantic Hashing - Santa Clara Universitymwang2/projects/Mining_deepSemanticHashing_… · locality-sensitive hashing (LSH), a method used in similarity search which addresses

Deep Semantic Hashing - Santa Clara Universitymwang2/projects/Mining_deepSemanticHashing_… · locality-sensitive hashing (LSH), a method used in similarity search which addresses

E-spionage A BusinessWeek probe of rising attacks on America's most sensitive computer networks uncovers startling security gaps Cover Story March 21,

E-spionage A BusinessWeek probe of rising attacks on America's most sensitive computer networks uncovers startling security gaps Cover Story March 21,

Trust and Semantic Attacks- Phishing Hassan Takabi hatakabi@sis.pitt.edu October 20, 2009.

Trust and Semantic Attacks- Phishing Hassan Takabi [email protected] October 20, 2009.

Querying Dynamic and Context-Sensitive Metadata in Semantic Web Sergiy Nikitin Industrial Ontologies Group 1 University of Jyväskylä Finland Article Authors:Sergiy.

Querying Dynamic and Context-Sensitive Metadata in Semantic Web Sergiy Nikitin Industrial Ontologies Group 1 University of Jyväskylä Finland Article Authors:Sergiy.

Sensitive Rose and the Cross-media Era - Semantic Scholar · 2018. 12. 21. · Sensitive Rose and the Cross-media Era Martha Gabriel University of São Paulo Rua Ibaragui Nissui 115

Sensitive Rose and the Cross-media Era - Semantic Scholar · 2018. 12. 21. · Sensitive Rose and the Cross-media Era Martha Gabriel University of São Paulo Rua Ibaragui Nissui 115

A highly selective and sensitive probe for - Semantic Scholar · 1 Supporting Information A highly selective and sensitive probe for colorimetric and fluorogenic detection of Cd2+

A highly selective and sensitive probe for - Semantic Scholar · 1 Supporting Information A highly selective and sensitive probe for colorimetric and fluorogenic detection of Cd2+

Di erential Power Analysis Side-Channel Attacks in ...martin/MQP/hnathpettengill.pdf · 2.1 Side-Channel Attacks Side-channel cryptanalysis is a branch of cryptography in which sensitive

Di erential Power Analysis Side-Channel Attacks in ...martin/MQP/hnathpettengill.pdf · 2.1 Side-Channel Attacks Side-channel cryptanalysis is a branch of cryptography in which sensitive

Stroke Protocol and Patient Outcomes - Semantic Scholar · stroke protocol and patient outcomes 2 attacks, and 180,000 are recurrent attacks (Heart Disease and Stroke Statistics,

Stroke Protocol and Patient Outcomes - Semantic Scholar · stroke protocol and patient outcomes 2 attacks, and 180,000 are recurrent attacks (Heart Disease and Stroke Statistics,

Concept-Oriented Indexing of Video Databases: Towards Semantic Sensitive Retrieval and Browsing J.Fan, H.Luo, K.Ahmed Presented by Zeehasham Rasheed.

Concept-Oriented Indexing of Video Databases: Towards Semantic Sensitive Retrieval and Browsing J.Fan, H.Luo, K.Ahmed Presented by Zeehasham Rasheed.

2017 THALES DATA THREAT REPORT adoption is high use of sensitive data a concern top 5 data security concerns for iot. 30% - identifying which data is sensitive. 24% - impact of attacks

2017 THALES DATA THREAT REPORT adoption is high use of sensitive data a concern top 5 data security concerns for iot. 30% - identifying which data is sensitive. 24% - impact of attacks