Injection attacks, like SQL Injection and Cross-site Scripting, are a massive threat
to the (web) applications and its users – individuals, institutions and companies.
They are manifold and might occur at many places in modern (web) applications.
Previous works have proven taint tracking, tagging value and monitoring their flow
at runtime, to be an effective measure to detect a whole bunch of such vulnerabilities and prevent their exploitation.
But systems available for Java SE/Java EE today are not yet ready for being
used in production contexts. In the thesis at hand, this usage scenario and the
according requirements will be analyzed. Then, Juturna, a new take on taint
tracking for Java combining established concepts with novel ideas, will be drafted,
implemented and evaluated in depth with real-world requirements in mind.
One of the major problems of taint tracking is its intrinsic computational overhead and the increased memory footprint. Therefore, Juturna does not only consist of a sophisticated, yet efficient taint tracking system trying to be lightweight
and pluggable by neither invasively modifying applications or the JRE, but additionally includes optional techniques known from static Information Flow Control
(IFC). Juturna uses these to determine execution paths guaranteed to be free from
malicious flows on which tracking can be selectively avoided, reducing the caused
overhead.
This makes it, if desired, a hybrid approach combining both dynamic and static
analysis techniques.
Publications
Advisors
Students
