網站應用程式安全性弱點分析方法與工具之研究

A Study of Methods and Tools for Analyzing Security Vulnerabilities in Web Applications

蔡依珊(Yi-Shan Tsai)

指導教授 ： 蔡益坤

國立臺灣大學/管理學院/資訊管理學研究所/碩士(2009年)

https://doi.org/10.6342/NTU.2009.03309

摘要

身為全球經濟體系基礎建設中的一部分，網站應用程式提供了一個虛擬平台做為使用者之間的溝通橋樑，這使得其地位顯得相當重要。然而，網路安全漏洞的問題卻日益嚴重，並對網站應用程式的發展造成了負面的影響。在應用程式的開發過程中，網站應用程式源碼檢測可做為解決此項問題的其中一項方法。但是人工檢測程式源碼過程費時、費力或因人為疏失而導致不精確的檢測結果；再加上檢測程式源碼人員必須具備資訊安全的專業知識背景。因此，自動化源碼檢測工具的需求，也就因應而生。早期自動化方法與工具僅應用在軟體應用程式上，而後才延伸至網站應用程式，但目前來說，評估靜態工具與方法精確性之研究也較少。換句話說，靜態工具開發者在沒有與其他工具比較之情況下宣稱其靜態方法與工具具有效率與有效性就失去了說服力。

本篇論文目的在於評估現有四個靜態分析方法與工具之精確性，為此我們設計了一套含有安全漏洞的程式源碼之標準檢查程式(例如跨站腳本攻擊與資料庫安全漏洞的注入)，且標準檢查程式內也含有不同的資料結構與控制流程敘述。更明確地說，透過我們設計的標準檢查程式來評估現有靜態方法與工具之效能，並以統計數據方式呈現工具間於特定安全漏洞類別之精確的處理程度。最後，我們整合這四個靜態分析方法與工具之結果，找出現有靜態方法與工具不足之處，以協助未來靜態方法與工具之開發。

關鍵字

安全漏洞 ； 網站應用程式 ； 精確性 ； 標準檢查程式 ； 程式源碼檢測 ； 靜態分析方法與工具

並列摘要

As part of the infrastructure of the global economy, Web applications are of the utmost importance because they provide a virtual space where end users can communicate with one another. A negative aspect of this development is that the number of security vulnerabilities is growing constantly. One method used to solve such problems involves reviewing program code as a part of the development process. However, manual code verification is time-consuming, error-prone, and costly; and code auditors need a security background in order to audit the code. Thus, there is an urgent need for automated solutions to check whether Web applications are vulnerable. Verification tools have long implemented analysis methods in software applications and Web applications, but little research has been performed to evaluate the efficacy of each tool. Of course, developers claim that their tools are effective and efficient, but they do not compare their tool with others.

In this thesis, our objective is to evaluate the efficacy of existing verification tools. To this end, we build benchmark cases of vulnerable code that may cause security problems, such as cross-site scripting and SQL injection, but some benchmark cases do not consist of vulnerable code to determine if a false positive occurs after the tool scans the code. Specifically, we use the developed benchmark cases to test four static analysis tools that generate reports of vulnerable program locations, and evaluate the performance of the tools statistically. Moreover, the benchmark cases enable us to identify the structures or control flow statements that cause false alarms in the four tools. As a result, we can determine which benchmark cases are not handled in the target tools.

並列關鍵字

Security Vulnerabilities ； Web Applications ； Precision ； Benchmark ； False Alarm ； Code-Verification ； Static Analysis Tools

參考文獻

[16] R. Johnson and D. Wagner. Finding user/kernel pointer bugs with type inference. In Proceedings of the 2004 Usenix Security Conference, pages 119-134, 2004.

[13] Y.-W. Huang, F. Yu, C. Hang, C.-H. Tsai, D.-T. Lee, and S.-Y. Kuo. Securing Web application code by static analysis and runtime protection. In Proceedings of the 13th conference on World Wide Web, pages 40-52. ACM Press, 2004.

[14] Y.-W. Huang, F. Yu, C. Hang, C.-H. Tsai, D.-T. Lee, and S.-Y. Kuo. Verifying Web applications using bounded model checking. In Proceedings of the 2004 International Conference on Dependable Systems and Networks, pages 199-208. IEEE Computer Society, 2004.

[4] B. Chess and G. McGraw. Static analysis for security. IEEE Security and Privacy, pages 76-79, 2004.

[5] E. Clarke, D. Kroening, and K. Yorav. Behavioral consistency of C and Verilog programs using bounded model checking. In Proceedings of the 40th Conference on Design Automation, pages 368-371. ACM New York, NY, USA, 2003.