AUTOMATED TRACKING OF MALICIOUS DATA IN WEB APPLICATIONS
Application layer security vulnerabilities are now of growing interest to information security practitioners as web applications have become the target of a mounting number of attacks. Security professionals seeking to develop a secure web application must possess a high degree of expertise and they are relegated to using complex, inefficient, ad hoc tools, which are difficult to maintain and audit.
CoreLabs research has led to the development of a solution that prevents the exploitation of web-application vulnerabilities which exist in the most widely used scripting languages (such as PHP, ASP, .NET, Python, Perl, C++ and Java). This solution thwarts database-injection attacks, cross-site scripting attacks, shell-injection attacks and directory-transversal attacks. Furthermore, it prevents database theft and most information disclosure threats. This protection scheme is fully-functional after a simple installation that requires no complex setups or statistical training.
This new solution for securing web applications allows the virtual machine (or interpreter of the different scripting languages) to recognize the source of the data it receives and manipulates, by validating the mark that is tied to each piece of data. With this solution, user-supplied data is marked as "untrusted" and sensitive data in databases is marked as "private". Whenever data is supplied to the back end APIs or a user's browser, protection modules inspect the data and potential attacks are blocked. For example, SQL-injection attacks are prevented by blocking user-supplied meta-characters from being forwarded to the SQL engines. This simple method for enhancing the quality of the information manipulated by the web application's virtual machine efficiently prevents some of the most dangerous attacks.
GRASP is now available as open source software under the Apache 2.0 license. To download the software and collaborate with the project, please visit http://grasp.coresecurity.com.
Project Resources:
 |
Futoransky, Ariel; Gutesman, Ezequiel; Waissbein, Ariel "A dynamic technique for enhancing the security and privacy of web applications".
Black Hat USA 2007 Briefings, August, 2007. Las Vegas, NV, USA. [paper] [presentation] |