TaintInduce



Overview Web-service


Dynamic binary taint analysis has wide applications in the security analysis of commercial-off-the-shelf (COTS) binaries. One of the key challenges in dynamic binary analysis is to specify the taint rules that capture how taint information propagates for each instruction on an architecture. Most of the existing solutions specify taint rules using a deductive approach by summarizing the rules manually after analyzing the instruction semantics. Intuitively, taint propagation reflects on how an instruction input affects its output and thus can be observed from instruction executions. In this work, we propose an inductive method for taint propagation and develop a universal taint tracking engine that is architecture-agnostic. Our taint engine, TAINTINDUCE, can learn taint rules with minimal architectural knowledge by observing the execution behavior of instructions. To measure its correctness and guide taint rule generation, we define the precise notion of soundness for bit-level taint tracking in this novel setup. In our evaluation, we show that TAINT INDUCE automatically learns rules for 4 widely used architectures: x86, x64, AArch64, and MIPS-I. It can detect vulnerabilities for 24 CVEs in 15 applications on both Linux and Windows over millions of instructions and is comparable with other mature existing tools (TEMU [51], libdft [32], Triton [42]). TAINTINDUCE can be used as a standalone taint engine or be used to complement existing taint engines for unhandled instructions. Further, it can be used as a cross-referencing tool to uncover bugs in taint engines, emulation implementations and ISA documentations. significantly empowers the attacker.

The work will be presented at the Network and Distributed System Security Symposium 2019 (NDSS) in Feb 2019 (NDSS 2019).

Resources

We provide a hosted Web-service for trying out the inference engine.
The implementation of TaintInduce is available upon request.

Publication

One Engine To Serve'em All: Inferring Taint Rules Without Architectural Semantics.
Zheng Leong Chua, Yanhao Wang, Teodora Băluță, Prateek Saxena, Zhenkai Liang, Purui Su.
In the Network and Distributed System Security Symposium 2019, San Diego, CA, US, Feb 2019.

Contributions

People

Contact

chuazl AT comp DOT nus DOT edu DOT sg

Acknowledgments

This research is supported in part by the National Research Foundation, Prime Ministers Office, Singapore under its National Cybersecurity R&D Program, in part by National Natural Science Foundation of China, and in part by DSO, Singapore.