Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software

TLDR

Software vulnerabilities have devastated the Internet, with worms such as CodeRed and Slammer compromising hundreds of thousands of hosts in minutes and causing millions of dollars of damage. We propose dynamic taint analysis that requires no source code or special compilation, implemented as TaintCheck, which performs binary rewriting at run time to detect overwrite attacks on commodity software. TaintCheck reliably detects most types of exploits and produced no false positives across a wide range of tested programs.

Abstract

Software vulnerabilities have had a devastating effect on the Internet. Worms such as CodeRed and Slammer can compromise hundreds of thousands of hosts within hours or even minutes, and cause millions of dollars of damage [26, 43]. To successfully combat these fast automatic Internet attacks, we need fast automatic attack detection and filtering mechanisms. In this paper we propose dynamic taint analysis for automatic detection of overwrite attacks, which include most types of exploits. This approach does not need source code or special compilation for the monitored program, and hence works on commodity software. To demonstrate this idea, we have implemented TaintCheck, a mechanism that can perform dynamic taint analysis by performing binary rewriting at run time. We show that TaintCheck reliably detects most types of exploits. We found that TaintCheck produced no false positives for any of the many different programs that we tested. Further, we describe how TaintCheck could improve automatic signature generation in