Abstract

Policy-based confinement, employed in SELinux and specification-based intrusion detection systems, is a popular approach for defending against exploitation of vulnerabilities in benign software. To be effective, this approach requires the development of accurate application-specific security policies, which is a difficult task. Even if sufficient resources and expertise are expended for policy development, conventional access control policies (employed in these approaches) are inherently limited — they can only detect those attacks that involve resource accesses beyond what is legitimately needed by a victim application. They cannot detect attacks that “hijack ” legitimate access privileges granted to a program, e.g., an attack that subverts an FTP server to download the password file. (Note that FTP server would normally need to access the password file for performing used authentication.) Some of the common attack types reported today, such as SQL injection and cross-site scripting, involve such subversion of legitimate access privileges; others, such as buffer overflows and format string attacks, can be easily adapted to evade policy-based detection. In this paper, we develop a new approach that addresses these weaknesses by augmenting traditional security policies with information about the origin of each byte of data used in security-sensitive operations. With this information, our security policies can distinguish between accesses made by an application on its own accord, and accesses made on behalf of untrusted users. This distinction turns out to be crucial for accurate detection of most attacks, including buffer overflows, format-string vulnerabilities, integer overflows, SQL injection, cross-site scripting, command injection, and directory traversal. (These attack types account for about 2/3rd of vulnerabilities reported by CVE in 2003 and 2004.) Very simple, application-independent policies are sufficient for detecting these attacks. Moreover, detection overheads are below 10 % for server applications.

Citations