Taint Analysis Research Articles

TaintGuard: Preventing implicit privilege leakage in smart contract based on taint tracking at abstract syntax tree level

Solidity smart contracts play an important role in enabling interactions and collaborations among users in a decentralized blockchain-based community, and their security has received much attention in the industry. One of the most serious security issues faced by Solidity smart contracts is that the use of delegatecall to make cross-contract calls will tamper with contract privilege, which is difficult to detect. To improve the robustness of smart contract privilege control mechanisms at the level of source code, this paper designs and implements a new cross-contract static analysis tool called TaintGuard based on the abstract syntax tree of Solidity code and by combining taint analysis and instrumentation monitoring. TaintGuard uses solc to obtain the abstract syntax tree of the contract source code and then traverses the nodes of the tree to filter call relations that use delegatecall for cross-contract calls. Then, TaintGuard obtains the control flow graph within the target function, determines whether there are problematic paths in the control flow graph that may cause implicit leakage of contract privileges through static taint analysis, and instruments monitoring code in the corresponding position of the program. In this way, the contract status in the runtime stage is monitored to prevent the contract privileges from being tampered with by malicious callers. Finally, TaintGuard is evaluated against existing static analysis tools for Solidity smart contracts. The evaluation results indicate that TaintGuard outperforms other tools in terms of execution efficiency. Also, it can effectively fix the contract code with privilege leaks with a acceptable overhead.

DAISY: Dynamic-Analysis-Induced Source Discovery for Sensitive Data

Mobile apps are widely used and often process users’ sensitive data. Many taint analysis tools have been applied to analyze sensitive information flows and report data leaks in apps. These tools require a list of sources (where sensitive data is accessed) as input, and researchers have constructed such lists within the Android platform by identifying Android API methods that allow access to sensitive data. However, app developers may also define methods or use third-party library’s methods for accessing data. It is difficult to collect such source methods, because they are unique to the apps, and there are a large number of third-party libraries available on the market that evolve over time. To address this problem, we propose DAISY, a Dynamic-Analysis-Induced Source discoverY approach for identifying methods that return sensitive information from apps and third-party libraries. Trained on an automatically labeled dataset of methods and their calling context, DAISY identifies sensitive methods in unseen apps. We evaluated DAISY on real-world apps, and the results show that DAISY can achieve an overall precision of 77.9% when reporting the most confident results. Most of the identified sources and leaks cannot be detected by existing technologies.

Cryptocurrency Security Study based on Static Taint Analysis

Cryptocurrency represented by Bitcoin is a very popular topic in recent years. However, the prosperity of cryptocurrency drives an increasing number of applications published. Some malicious or vulnerable programs are also detected and reported these years. To do a deeper study into security of cryptocurrency application, this paper learns common vulnerabilities, threat models inside normal applications, and taint analysis, a useful vulnerability-detecting tool, concludes a common and useful methodology for threat detection in application programs, especially Android apps. This approach uses static taint analysis to detect vulnerabilities inside a given Android application, classify them into common vulnerability categories and then make conclusions. This paper does research in analyzing statistics of threats in common cryptocurrency apps in Google play store and draw conclusions on the status of cryptocurrency software as well. Finally, some suggestions are provided at the end of this paper. These recommendations apply to application programmers, app store administrators, scholars and experts in related area, government officer and users. This set of analysis process can be applied to analyze any type of application programs.

Android static taint analysis based on multi branch search association

Taint analysis is a method used to detect system security problems by tracking the flow of user input or information leakage through the system. In the taint analysis for Android applications, the complete taint propagation path is generally obtained by tracking the taint data. There is often a compromise between efficiency and analysis accuracy in the method of obtaining the taint propagation path, or false positives and false negatives due to the neglect of Android features. Given the problems, a novel multi-branch taint search association algorithm is proposed, which optimized the processing of Android component features in taint analysis. It directly finds taint related codes and associates them according to predefined rules. It has effective Android taint analysis ability including alias analysis and reduced the negative impact of taint unrelated codes on the performance of taint analysis. At the same time, the Android static taint analysis prototype tool TaintSA is implemented based on the multi-branch taint search association algorithm. The experimental results show that TaintSA can not only ensure the analysis results' accuracy but also reduce the time and space required for taint analysis. The accuracy rate of 91.5% and the recall rate of 75.6% on the DroidBench2.0 test set are better than the taint analysis tool FlowDroid. The time consumption and memory consumption of about 30% and 20% are reduced at the same time. In terms of the representation of taint propagation edges, compared with FlowDroid, the taint propagation path output by TaintSA does not contain intermediate variables, and the form is more concise. In addition, TaintSA can output the taint propagation path without taint leakage, which is helpful for further taint analysis.

A taint analysis framework applied to android applications in the packed state

In recent years, Android applications have caused personal privacy leaks frequently. In order to analyze the malicious behavior, taint analysis technology can be used to track the API call chain, build a control-flow graph of function, and determine whether there is a security risk. However, with the continuous escalation of offensive and defensive confrontation of source code, more and more applications use reinforcement technology to prevent security practitioners from performing reverse analysis, therefore it is impossible to analyze function-behavior from the source code. Thus, we design a framework of taint analysis that applied to the Android applications, which automatically unpacks the Android APKs, restores the real source code of the App, performs taint analysis, and generates a control-flow graph of function. Experimental tests showed that the system can cope with the current mainstream reinforcement technology and restore the real Dex file quickly. Simultaneously, compared with the number of nodes before packing, the generated control-flow graph had an explosive increase, which effectively assisted manual analysis of App with the privacy leakage behaviors.

Annotative Software Product Line Analysis Using Variability-Aware Datalog

Applying program analyses to Software Product Lines (SPLs) has been a fundamental research problem at the intersection of Product Line Engineering and software analysis. Different attempts have been made to “lift” particular product-level analyses to run on the entire product line. In this paper, we tackle the class of Datalog-based analyses (e.g., pointer and taint analyses), study the theoretical aspects of lifting Datalog inference, and implement a lifted inference algorithm inside the Soufflé Datalog engine. We evaluate our implementation on a set of Java and C-language benchmark annotative software product lines. We show significant savings in processing time and fact database size (billions of times faster on one of the benchmarks) compared to brute-force analysis of each product individually.

μDep: Mutation-Based Dependency Generation for Precise Taint Analysis on Android Native Code

The existence of native code in Android apps plays an important role in triggering inconspicuous propagation of secrets and circumventing malware detection. However, the state-of-the-art information-flow analysis tools for Android apps all have limited capabilities of analyzing native code. Due to the complexity of binary-level static analysis, most static analyzers choose to build conservative models for a selected portion of native code. Though the recent inter-language analysis improves the capability of tracking information flow in native code, it is still far from attaining similar effectiveness of the state-of-the-art information-flow analyzers that focus on non-native Java methods. To overcome the above constraints, we propose a new analysis framework, <inline-formula><tex-math notation="LaTeX">$\mu$</tex-math></inline-formula> Dep, to detect sensitive information flows of the Android apps containing native code. In this framework, we combine a control-flow based static binary analysis with a mutation-based dynamic analysis to model the tainting behaviors of native code in the apps. Based on the result of the analyses, <inline-formula><tex-math notation="LaTeX">$\mu$</tex-math></inline-formula> Dep conducts a stub generation for the related native functions to facilitate the state-of-the-art analyzer DroidSafe with fine-grained tainting behavior summaries of native code. The experimental results show that our framework is competitive on the accuracy, and effective in analyzing the information flows in real-world apps and malware compared with the state-of-the-art inter-language static analysis.

ErrHunter: Detecting Error-Handling Bugs in the Linux Kernel Through Systematic Static Analysis

Error handling is essential for operating systems, thus, there are many bugs in error-handling code, which could result in serious consequences. In this paper, we revisit the problem of error miss-handling bugs and analyze the root cause of the most common ones in the Linux kernel. Based on the analysis, we propose a systematic static taint-analysis-based approach, ErrHunter, to detect multiple kinds of error miss-handling bugs in the Linux kernel. An automated critical variable identification approach is proposed to identify critical variables in the error-handling paths. A static cross-control-flow taint analysis approach is proposed to construct critical-variable control flow graphs (CCFGs), which describe the processing of critical variables in separate control flows. Based on the CCFGs, ErrHunter can target the root cause of the most common error miss-handling bugs and detect the bugs in a systematic way. ErrHunter is designed for kernel bug detection, so it can handle many specific features of the Linux kernel, such as memory management mechanisms, etc.

An Enhanced Static Taint Analysis Approach to Detect Input Validation Vulnerability

The detection of feasible paths helps to minimize the false positive rate. However, the previous works did not consider the feasibility of the program paths during the analysis detection of input validation vulnerabilities, which led to false positive results. They also needed to validate the usage of the proper sanitization functions for each context of the user input. Therefore, we proposed an enhanced static taint analysis approach to analyse the source code and track the tainted inputs in the program. It started by examining the source code to find the feasibility of each path in the program. The tainted variables were tracked through the analysis until the sink statement, which executes the tainted variables. An algorithm was built to enhance the static analyzer to handle the variables handling functions in PHP. The proposed approach was evaluated with SARD datasets and large-scale PHP programs. The results indicated that the precision in detecting XSS vulnerability was approximately 44% better than WAP and 26% better than RIPS, and its precision in detecting SQL injection was about 10% better than WAP and 19% better than RIPS. Furthermore, the proposed approach outperformed previous symbolic execution studies regarding the number of detected vulnerabilities.

Single-Source-Single-Target Interleaved-Dyck Reachability via Integer Linear Programming

An interleaved-Dyck (InterDyck) language consists of the interleaving of two or more Dyck languages, where each Dyck language represents a set of strings of balanced parentheses.InterDyck-reachability is a fundamental framework for program analyzers that simultaneously track multiple properly-matched pairs of actions such as call/return, lock/unlock, or write-data/read-data.Existing InterDyck-reachability algorithms are based on the well-known tabulation technique. This paper presents a new perspective on solving InterDyck-reachability. Our key observation is that for the single-source-single-target InterDyck-reachability variant, it is feasible to summarize all paths from the source node to the target node based on path expressions . Therefore, InterDyck-reachability becomes an InterDyck-path-recognition problem over path expressions. Instead of computing summary edges as in traditional tabulation algorithms, this new perspective enables us to express InterDyck-reachability as a parenthesis-counting problem, which can be naturally formulated via integer linear programming (ILP). We implemented our ILP-based algorithm and performed extensive evaluations based on two client analyses (a reachability analysis for concurrent programs and a taint analysis). In particular, we evaluated our algorithm against two types of algorithms: (1) the general all-pairs InterDyck-reachability algorithms based on linear conjunctive language (LCL) reachability and synchronized pushdown system (SPDS) reachability, and (2) two domain-specific algorithms for both client analyses. The experimental results are encouraging. Our algorithm achieves 1.42×, 28.24×, and 11.76× speedup for the concurrency-analysis benchmarks compared to all-pair LCL-reachability, SPDS-reachability, and domain-specific tools, respectively; 1.2×, 69.9×, and 0.98× speedup for the taint-analysis benchmarks. Moreover, the algorithm also provides precision improvements, particularly for taint analysis, where it achieves 4.55%, 11.1%, and 6.8% improvement, respectively.

Execution Recording and Reconstruction for Detecting Information Flows in Android Apps

Security researchers utilize taint analyses to uncover suspicious behaviors in Android apps. Current static taint analyzers cannot handle ICC, reflection, and lifecycles dependably, increasing the result verification cost. On the other hand, current dynamic taint trackers accurately detect execution paths. However, they depend on specific Android versions and modified devices, reducing their usability and applicability. In addition, they require app exercise every time running the taint analysis. This paper presents a new dynamic taint tracker called T-Recs, tracking information flows by recording and reconstructing the app execution. First, before the taint analysis, the app’s runtime data are obtained by instrumenting logging code into the app’s bytecode and running the app to be independent of specific Android versions and devices. Then, T-Recs performs the taint analysis accurately with the logged data and separately from the app exercise. This paper is an extended version of our work published. Previously, T-Recs’ accuracy was mainly evaluated in privacy leak detection. The results show that T-Recs outperforms compared analyzers, which are FlowDroid (w/ and w/o IC3), Amandroid, DroidSafe, and TaintDroid (w/ and w/o IntelliDroid). This paper also involves DroidRA and IccTA. This paper shows that T-Recs detects ICC- and reflection-related leaks missed by FlowDroid in popular Google Play apps. The other static analyzers fail to analyze most of the apps. These experiments also indicate an advantage of T-Recs: its users can re-execute T-Recs’ taint analysis without re-exercising the app. T-Recs’ app-runtime overhead and parallel execution performance were also evaluated, and the results are acceptable.

Multi-path exploration guided by taint and probability against evasive malware

Static analysis is often impeded by malware obfuscation techniques, such as encryption and packing, whereas dynamic analysis tends to be more resistant to obfuscation by leveraging concrete execution information. Unfortunately, malware can employ evasive techniques to detect the analysis environment and alter its behavior accordingly. While known evasive techniques can be explicitly dismantled, the challenge lies in generically dismantling evasions without full knowledge of their conditions or implementations, such as logic bombs that rely on uncertain conditions, let alone unsupported evasive techniques, which contain evasions without corresponding dismantling strategies and those leveraging unknown implementations. In this paper, we present Antitoxin, a prototype for automatically exploring evasive malware. Antitoxin utilizes multi-path exploration guided by taint analysis and probability calculations to effectively dismantle evasive techniques. The probabilities of branch execution are derived from dynamic coverage, while taint analysis helps identify paths associated with evasive techniques that rely on uncertain conditions. Subsequently, Antitoxin prioritizes branches with lower execution probabilities and those influenced by taint analysis for multi-path exploration. This is achieved through forced execution, which forcefully sets the outcomes of branches on selected paths. Additionally, Antitoxin employs active anti-evasion countermeasures to dismantle known evasive techniques, thereby reducing exploration overhead. Furthermore, Antitoxin provides valuable insights into sensitive behaviors, facilitating deeper manual analysis. Our experiments on a set of highly evasive samples demonstrate that Antitoxin can effectively dismantle evasive techniques in a generic manner. The probability calculations guide the multi-path exploration of evasions without requiring prior knowledge of their conditions or implementations, enabling the dismantling of unsupported techniques such as C2 and significantly improving efficiency compared to linear exploration when dealing with complex control flows. Additionally, taint analysis can accurately identify branches related to logic bombs, facilitating preferential exploration.

IAFDroid: Demystifying Collusion Attacks in Android Ecosystem via Precise Inter-App Analysis

Inter-app communication mechanism allows app developers to improve Android apps’ usability and provide users with rich functions via interacting with exposed components or performing data sharing. However, this mechanism may be leveraged by malicious developers or unintentionally misused by inexperienced developers. For end users, this type of attack may cause privacy breaches or remote controls of personal phone, which have a great threat of the user’s data security. The key to analyzing whether there is a collusion attack is to analyze the existence of communication channels between apps. The existing static analysis tools have done some work in this area, but the comprehensiveness of the analysis is insufficient, and such research lacks a unified test standard. In this paper, we present collusion attacks using more concealed inter-app communication channels, which can bypass existing security detection mechanisms. To defend against the new attacks, we design IAFDroid, an analysis framework that combines static and taint analysis. By examining 20K real-world apps, IAFDroid found that 94.4% of the most exposed components of Android may be leveraged to perform collusion attacks. Furthermore, the evaluation showed that the feature set extracted by IAFDroid could be used to promote the accuracy of Android malware detection. We contribute a more comprehensive benchmark for IAC analysis, IACBench, which includes the new attacks we propose. To facilitate follow-up studies, we open-sourced IAFDroid and IACBench based on the GPL agreement.

A permission-carrying security policy and static enforcement for information flows in Android programs

To detect information leaks in Android programs, existing taint analysis approaches usually specify and enforce (statically or dynamically) the two-level information flow policy, represented by a lattice ({⊤,⊥},⊑) with ⊥⊑⊤. However, this policy leaves permissions (an access control mechanism built in the Android system) out of consideration, causing a too coarse-grained analysis result in some scenarios. In fact, the existing information flow controls should integrate permissions to develop a more refined flow policy. Following this intuition, in this paper, we propose a permission-carrying secure information flow policy and accomplish a static enforcement mechanism for this policy. We first devise a small language to capture typical features of Android programs. On this base, we define the permission-carrying security policy using a subset lattice of permissions, and offer a group of rules to certify the security of information flows. Secondly, we implement a static enforcement mechanism for this policy, which allows us to detect potential insecure information flows by analysing programs in component-level. To illustrate the usefulness of this policy, we further examine two typical security threats, confused deputy and collusive data leaks, as the running cases to show how to detect security attacks in our theoretical framework. The final experiment shows that our approach is effective and scalable for real-world apps. Compare with several leading tools, our approach is applicable to checking both intra-app and inter-app vulnerabilities, and achieves a more precise detection result due to the superiority of our fine-grained security policy.

JShellDetector: A Java Fileless Webshell Detector Based on Program Analysis

Fileless webshell attacks against Java web applications have become more frequent in recent years as Java has gained market share. Webshell is a malicious script that can remotely execute commands and invade servers. It is widely used in attacks against web applications. In contrast to traditional file-based webshells, fileless webshells leave no traces on the hard drive, which means they are invisible to most antivirus software. To make matters worse, although there are some studies on fileless webshells, almost all of them are aimed at web applications developed in the PHP language. The complex mechanism of Java makes researchers face more challenges. To mitigate this attack, this paper proposes JShellDetector, a fileless webshell detector for Java web applications based on program analysis. JShellDetector uses method probes to capture dynamic characteristics of web applications in the Java Virtual Machine (JVM). When a suspicious class tries to call a specific sensitive method, JShellDetector catches it and converts it from the JVM to a bytecode file. Then, JShellDetector builds a Jimple-based control flow graph and processes it using taint analysis techniques. A suspicious class is considered malicious if there is a valid path from sources to sinks. To demonstrate the effectiveness of the proposed approach, we manually collect 35 test cases (all open source on GitHub) and test JShellDetector and only two other Java fileless webshell detection tools. The experimental results show that the detection rate of JShellDetector reaches 77.1%, which is about 11% higher than the other two tools.

TRacer: Scalable Graph-Based Transaction Tracing for Account-Based Blockchain Trading Systems

Security incidents such as scams and hacks have become a major threat to the health of the blockchain ecosystem, resulting in billions of dollars in losses to blockchain users each year. To reveal the real-world entities behind pseudonymous blockchain accounts and recover stolen funds from massive transaction data, much effort has recently been put into tracing illicit financial flows in blockchain by academia and industry. However, most of the current blockchain fund tracing methods are heuristics and taint analysis methods that are designed on the basis of expert experience and specific events, which have limitations in terms of universality, effectiveness and efficiency. This paper models blockchain transaction records as a transaction graph and tackles blockchain transaction tracing as a graph search task. To achieve efficient and effective tracing of fund transfers on the transaction graphs, we propose a scalable transaction tracing tool, TRacer, which to the best of our knowledge is the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">first</i> intelligent transaction tracing tool that is generalized to multiple account-based blockchain platforms and can handle complex transaction behavior in decentralized finance (DeFi). Particularly, we tackle the transaction tracing task via a subgraph searching approach which employ a novel ranking method to infer the relevance between accounts during the graph search process in the multi-relational blockchain transaction graph. Theoretical analysis and experimental results on datasets from multiple blockchain platforms demonstrate that TRacer can efficiently perform the transaction tracing task at a lower cost and achieve better tracing results than existing methods or even expert manual audits.

ERACE: Toward Facilitating Exploit Generation for Kernel Race Vulnerabilities

Since a large number of Linux kernel vulnerabilities are discovered every year, many vulnerabilities cannot be patched in time. Security vendors often prioritize patching high-risk vulnerabilities, and the ratings of vulnerabilities need to be evaluated based on factors such as exploitability and the scope of influence. However, evaluating exploitability is challenging and time-consuming, especially for race vulnerabilities, whose exploitation process is complicated and the success rate of exploitation is low, making them more likely to be overlooked. In this paper, we propose a new framework, called ERACE, to facilitate the process of exploiting kernel race vulnerabilities. Given a program called a proof of concept (PoC) that can trigger a race vulnerability, ERACE first applies a combination of dynamic and static analysis techniques to locate the instruction that causes the race. Then, it applies code instrumentation and static analysis to determine the timing relationship between the race instructions and the triggering type of the vulnerability and records the vulnerability context information. Next, it uses backward taint analysis to identify checkpoints that can be used to determine whether the race condition and heap spraying are satisfied and records the system calls to which the checkpoints belong. Finally, we can generate exploits based on the information collected above. To demonstrate the utility of ERACE, we tested it on 23 real-world vulnerabilities. As a result, we successfully detected the race points of 19 vulnerabilities, the timing relationship among the race instructions, and the triggering types of 17 vulnerabilities and succeeded in generating exploits for 13 vulnerabilities. ERACE can effectively help security researchers simplify the analysis process of kernel race vulnerabilities, select appropriate exploitation methods, and use checkpoints to increase the success rates of exploitations.

Baton: symphony of random testing and concolic testing through machine learning and taint analysis

Baton: symphony of random testing and concolic testing through machine learning and taint analysis

Model of Execution Trace Obfuscation Between Threads

Advanced reverse analysis tools have significantly improved the ability of attackers to crack software via dynamic analysis techniques, such as symbol execution and taint analysis. These techniques are widely used in malicious fields such as vulnerability exploitation or theft of intellectual property. In this paper, we present an obfuscation strategy called “execution trace obfuscation,” wherein the program execution trace repeatedly switches between multiple threads. Our technique realizes equivalent code transformation by abstracting the obfuscation problems into pruning, cloning, and coloring problems in graph theory. Based on this, we further propose the cascade encryption of a function that depends on execution trace information with a key derived from the function address calculation process, followed by removing this key from the program. We have implemented a compiler-level system that inputs a source program and automatically generates an obfuscated file. Finally, random test proves the universality of obfuscation algorithm and verify the system’s performance. Results shows that our system can effectively interfere advanced reverse analysis tools.

From Theory to Code: Identifying Logical Flaws in Cryptographic Implementations in C/C++

Cryptographic protocols are often expected to be provably secure. However, this security guarantee often falls short in practice due to various implementation flaws. We propose a new paradigm called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">cryptographic program analysis (CPA)</i> which prescribes the use of program analysis to detect these implementation flaws at compile time. The principal insight of the CPA is that many of these flaws in cryptographic implementations can be mapped to the violation of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">meta-level properties</i> of implementations. A program property that is necessary to realize a cryptographic property is referred to as meta-level property. We show that violations of these meta-level properties can be identified at compile-time that can serve as sufficient evidence of the encompassing flaws. We investigated existing literature on cryptographic implementation flaws and derived 25 corresponding meta-level properties. To instantiate the abstract paradigm of CPA, we develop a specification language based on deterministic finite automaton (DFA) and show that most of the meta-level properties can be expressed in terms of our language. We then develop a tool called <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TaintCrypt</small> which uses static taint analysis to identify meta-level property violations of C/C++ cryptographic implementations at compile-time. We demonstrate the efficacy of <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TaintCrypt</small> by analyzing open-source C/C++ cryptographic libraries (e.g., OpenSSL) and observe that <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TaintCrypt</small> could have helped to avoid several high-profile flaws. We also evaluated <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TaintCrypt</small> on 5 popular applications and libraries, which generated new security insights. The experimental evaluation on large-scale projects indicates the scalability of our approach.