The Community for Technology Leaders
RSS Icon
Subscribe
Tucson, Arizona
Dec. 5, 2005 to Dec. 9, 2005
ISBN: 0-7695-2461-3
pp: 303-311
Vivek Haldar , University of California, Irvine, CA
Deepak Chandra , University of California, Irvine, CA
Michael Franz , University of California, Irvine, CA
ABSTRACT
Improperly validated user input is the underlying root cause for a wide variety of attacks on web-based applications. Static approaches for detecting this problem help at the time of development, but require source code and report a number of false positives. Hence, they are of little use for securing fully deployed and rapidly evolving applications. We propose a dynamic solution that tags and tracks user input at runtime and prevents its improper use to maliciously afSect the execution of the program. Our implementation can be transparently applied to Java class files, and does not require source code. Benchmarks show that the overhead of this runtime enforcement is negligible and can prevent a number of attacks.
INDEX TERMS
null
CITATION
Vivek Haldar, Deepak Chandra, Michael Franz, "Dynamic Taint Propagation for Java", ACSAC, 2005, Computer Security Applications Conference, Annual, Computer Security Applications Conference, Annual 2005, pp. 303-311, doi:10.1109/CSAC.2005.21
14 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool