Taint-Exchange: A Generic System for Cross-process and Cross-host Taint Tracking

Taint-Exchange: A Generic System for Cross-process and Cross-host Taint Tracking (2011)

Cached

Download Links

[www1.cs.columbia.edu]

by Angeliki Zavou , Georgios Portokalidis , Angelos D. Keromytis

Venue:	In Proc. of the 6 th IWSEC
Citations:	2 - 2 self

Versions

Version History

Metadata Version 1

Datum	Value	Source
TITLE	Taint-Exchange: A Generic System for Cross-process and Cross-host Taint Tracking	INFERENCE
AUTHOR NAME	Angeliki Zavou	SVM HeaderParse 0.2
AUTHOR AFFIL	Network Security Lab, Department of Computer Science,; Columbia University	SVM HeaderParse 0.2
AUTHOR ADDR	New York, NY, USA	SVM HeaderParse 0.2
AUTHOR NAME	Georgios Portokalidis	SVM HeaderParse 0.2
AUTHOR AFFIL	Network Security Lab, Department of Computer Science,; Columbia University	SVM HeaderParse 0.2
AUTHOR ADDR	New York, NY, USA	SVM HeaderParse 0.2
AUTHOR NAME	Angelos D. Keromytis	SVM HeaderParse 0.2
AUTHOR AFFIL	Network Security Lab, Department of Computer Science,; Columbia University	SVM HeaderParse 0.2
AUTHOR ADDR	New York, NY, USA	SVM HeaderParse 0.2
ABSTRACT	Abstract. Dynamic taint analysis (DTA) has been heavily used by security researchers for various tasks, including detecting unknown exploits, analyzing malware, preventing information leaks, and many more. Recently, it has been also utilized to track data across processes and hosts to shed light on the interaction of distributed components, but also for security purposes. This paper presents Taint-Exchange, a generic crossprocess and cross-host taint tracking framework. Our goal is to provide researchers with a valuable tool for rapidly developing prototypes that utilize cross-host taint tracking. Taint-Exchange builds on the libdft open source data flow tracking framework for processes, so unlike previous work it does not require extensive maintenance and setup. It intercepts I/O related system calls to transparently multiplex fine-grained taint information into existing communication channels, like sockets and pipes. We evaluate Taint-Exchange using the popular lmbench suite, and show that it incurs only moderate overhead. 1	SVM HeaderParse 0.2
YEAR	2011	INFERENCE
VENUE	In Proc. of the 6 th IWSEC	INFERENCE
VENUE TYPE	CONFERENCE	INFERENCE
PAGES	113--128	INFERENCE
CITATIONS	27 found	ParsCit 1.0