PPT-Dynamic Taint Analysis for Automatic Detection, Analysis, a

Paper by James Newsome and Dawn Song Network and Distributed Systems Security Symposium NDSS Feb 2005 CS451 Spring 2011 Instructor Christos Papadopoulos Original slides by Devendra . cmuedu Carne gie Mellon Uni ersity Da wn Song da wnsongcmuedu Carne gie Mellon Uni ersity Abstract Softwar vulner abilities have had de vastating ef fect on the Internet orms suc as CodeRed and Slammer can compr omise hundr eds of thousands of hosts Incorporating Synchronization Arcs in . Dataflow-Analysis-Based Parallel Monitoring. Michelle Goodstein. *. , Shimin Chen. †. , . Phillip B. Gibbons. ‡. , Michael A. Kozuch. ‡. . and Todd C. Mowry. : . The Evolution of Evasive Malware . Giovanni Vigna. Department of Computer Science. University of California Santa Barbara. http://. www.cs.ucsb.edu. /~. vigna. Lastline, Inc.. http://. www.lastline.com. About Dynamic . Taint . Analysis & Forward . Symbolic . Execution (. but might have been afraid to ask. ). Edward J. Schwartz, . ThanassisAvgerinos. , David . Brumley. Presented by: . Vaibhav . Rastogi. (but might have been afraid to ask). IEEE S&P 2010. Overview. Two Main Contributions. Precisely describe the algorithms for dynamic taint analysis and forward symbolic execution as extensions to the run-time semantics of a general language. Unlimited Watchpoints. Joseph L. Greathouse. †. , . Hongyi. . Xin. *, . Yixin. . Luo. . †‡. , Todd Austin. †. †. University of Michigan. ‡. Shanghai Jiao. Tong University. *. Carnegie Mellon University. Yinzhi Cao. Reference: . http. ://www.cs.tau.ac.il/~. omertrip/pldi09/TAJ.ppt. www.cs.cmu.edu/~. soonhok/talks/20110301.pdf. 2. Motivating Example. *. * Inspired by . Refl1. in. SecuriBench Micro. Taint Flow #1. Edward J. Schwartz, . Thanassis. Avgerinos, David . Brumley. Presented by: . Haitao Xu. 1. The Root of All Evil. Humans write programs. This Talk:. Computers Analyzing Programs Dynamically at Runtime. Unlimited Watchpoints. Joseph L. Greathouse. †. , . Hongyi. . Xin. *, . Yixin. . Luo. . †‡. , Todd Austin. †. †. University of Michigan. ‡. Shanghai Jiao. Tong University. *. Carnegie Mellon University. Yinzhi Cao. Reference: . http. ://www.cs.tau.ac.il/~. omertrip/pldi09/TAJ.ppt. www.cs.cmu.edu/~. soonhok/talks/20110301.pdf. 2. Motivating Example. *. * Inspired by . Refl1. in. SecuriBench Micro. Taint Flow #1. About Dynamic . Taint . Analysis & Forward . Symbolic . Execution (. but might have been afraid to ask. ). Edward J. Schwartz, . ThanassisAvgerinos. , David . Brumley. Presented by: . Vaibhav . Rastogi. Roadmap. Background. TaintDroid. JavaScript. Conclusion. Background. In smartphone, we. . use third-party applications such as . - Google map, Angry bird … . etc. More than 10Billion Apps. Because it’s useful.. App Sets. Will Klieber*, Lori Flynn, . Amar Bhosale , Limin Jia, and Lujo Bauer . Carnegie Mellon University. *presenting. Motivation. Detect malicious apps that leak sensitive data.. Dataflow-Analysis-Based Parallel Monitoring. Michelle Goodstein. *. , Shimin Chen. †. , . Phillip B. Gibbons. ‡. , Michael A. Kozuch. ‡. . and Todd C. Mowry. *. *. Carnegie Mellon University. .