kirancodes.me
To Proof Maintenance & Beyond!
ASE 2017

Static detection of asymptotic resource side-channel vulnerabilities in web applications

Jia Chen, Oswaldo Olivo, Isil Dillig, Calvin Lin

DOI 10.1109/ase.2017.8115636dblp

Abstract

Web applications can leak confidential user information due to the presence of unintended side-channel vulnerabilities in code. One particularly subtle class of side-channel vulnerabilities arises due to resource usage imbalances along different execution paths of a program. Such side-channel vulnerabilities are especially severe if the resource usage imbalance is asymptotic. This paper formalizes the notion of asymptotic resource side-channels and presents a lightweight static analysis algorithm for automatically detecting them. Based on these ideas, we have developed a tool called SCANNER that detects resource-related side-channel vulnerabilities in PHP applications. SCANNER has found 18 zero-day security vulnerabilities in 10 different web applications and reports only 2 false positives. The vulnerabilities uncovered by SCANNER can be exploited using cross-site search attacks to extract various kinds of confidential information, such as a user's medications or purchase history.

BibTeX
@inproceedings{Chen-al:ASE17,
  author    = {Jia Chen and
               Oswaldo Olivo and
               Isil Dillig and
               Calvin Lin},
  title     = {Static detection of asymptotic resource side-channel vulnerabilities in web applications},
  booktitle = {ASE},
  pages     = {229--239},
  publisher = {{IEEE} Computer Society},
  year      = {2017},
}

Related papers