TaintInduce

Overview Web-service

Dynamic binary taint analysis has wide applications in the security analysis of commercial-off-the-shelf (COTS) binaries. One of the key challenges in dynamic binary analysis is to specify the taint rules that capture how taint information propagates for each instruction on an architecture. Most of the existing solutions specify taint rules using a deductive approach by summarizing the rules manually after analyzing the instruction semantics. Intuitively, taint propagation reflects on how an instruction input affects its output and thus can be observed from instruction executions. In this work, we propose an inductive method for taint propagation and develop a universal taint tracking engine that is architecture-agnostic. Our taint engine, TAINTINDUCE, can learn taint rules with minimal architectural knowledge by observing the execution behavior of instructions. To measure its correctness and guide taint rule generation, we define the precise notion of soundness for bit-level taint tracking in this novel setup. In our evaluation, we show that TAINT INDUCE automatically learns rules for 4 widely used architectures: x86, x64, AArch64, and MIPS-I. It can detect vulnerabilities for 24 CVEs in 15 applications on both Linux and Windows over millions of instructions and is comparable with other mature existing tools (TEMU [51], libdft [32], Triton [42]). TAINTINDUCE can be used as a standalone taint engine or be used to complement existing taint engines for unhandled instructions. Further, it can be used as a cross-referencing tool to uncover bugs in taint engines, emulation implementations and ISA documentations. significantly empowers the attacker.

The work will be presented at the Network and Distributed System Security Symposium 2019 (NDSS) in Feb 2019 (NDSS 2019).

Resources

We provide a hosted Web-service for trying out the inference engine.
The implementation of TaintInduce is available upon request.

Publication

One Engine To Serve'em All: Inferring Taint Rules Without Architectural Semantics.
Zheng Leong Chua, Yanhao Wang, Teodora Băluță, Prateek Saxena, Zhenkai Liang, Purui Su.
In the Network and Distributed System Security Symposium 2019, San Diego, CA, US, Feb 2019.

Contributions

• We propose a novel method, TAINTINDUCE, to perform dynamic taint analysis. To the best of our knowledge, TAINTINDUCE is the first to perform dynamic taint analysis for binary code requiring minimal architectural semantics, which is through on-the-fly taint rule inference.

• We precisely define influence, soundness, and completeness for dynamic taint analysis of program executions. We provide a sound algorithm to infer taint rules in a novel setup and show how to generalize systematically.

• We implemented TAINTINDUCE and evaluated with millions of instructions. We empirically show that our approach is useful as a stand-alone taint engine and a crossreferencing debugging aid. It is applicable to 4 processor architectures with minimal specialized knowledge, finding many errors in existing state-of-the-art tools, emulators and ISA software developer manuals.

People

Zheng Leong Chua
Yanhao Wang
Teodora Băluță
Prateek Saxena
Zhenkai Liang
Purui Su

Contact

chuazl AT comp DOT nus DOT edu DOT sg

Acknowledgments

This research is supported in part by the National Research Foundation, Prime Ministers Office, Singapore under its National Cybersecurity R&D Program, in part by National Natural Science Foundation of China, and in part by DSO, Singapore.