PhD Proposal: Sooel Son, ACES 2.404B

Contact Name: 
Lydia Griffith
Apr 10, 2013 9:00am - 10:00am

PhD Oral Proposal:  Sooel Son

Location: ACES 2.404B
Date: April 10th 2013 9:00 AM
Title: Toward Better Server-side Web Security
Research Supervisor:  Vitaly Shmatikov

Server-side Web applications are constantly exposed to new threats as new technologies emerge. The forced
browsing attack abuses incomplete access-control enforcement to access security-sensitive operations (such as database
writes). The SQL command injection attack (SQLCIA) has evolved into the NoSQL command injection attack,
which targets increasingly popular NoSQL databases. Preventing such vulnerabilities demands defensive programming
techniques. However, they require repetitive and error-prone manual code examination. This thesis proposes
static and dynamic methods for improving server-side Web application security against forced browsing and NoSQL
command injection attacks. (1) We design and implement ROLECAST, a tool for finding incomplete access-control
enforcement. ROLECAST statically identifies access-control logic that mediates security-sensitive operations and
finds missing access-control checks without a priori specifying an access-control policy. (2) We also design and implement
FIXMEUP, a static analysis and program transformation tool that finds access-control errors of omission and
produces candidate repairs. (3) We propose JEKHYDE, a tool for dynamically identifying NoSQL injection attacks.