Identifying information disclosure in web applications with retroactive auditing
Haogang Chen, Taesoo Kim, Xi Wang, Nickolai Zeldovich, M. Frans Kaashoek · 2014
Rail is a framework for building web applications that can precisely identify inappropriately disclosed data after a vulnerability is discovered. To do so, Rail introduces retroactive disclosure auditing: re-running the applica-tion with previous inputs once the vulnerability is fixed, to determine what data should have been disclosed. A key challenge for Rail is to reconcile state divergence between the original and replay executions, so that the differences between executions precisely correspond to inappropriately disclosed data. Rail provides applica-tion developers with APIs to address this challenge, by identifying sensitive data, assigning semantic names to non-deterministic inputs, and tracking dependencies. Results from a prototype of Rail built on top of the Me-teor framework show that Rail can quickly and precisely identify data disclosure from complex attacks, including programming bugs, administrative mistakes, and stolen passwords. Rail incurs up to 22 % throughput overhead and 0.5 KB storage overhead per request. Porting three existing web applications required fewer than 25 lines of code changes per application. 1