# Taint Anlysis

## Information Flow Security

![image-20240425114724965](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-d5acf000675308095adf563839056faeacfc9a15%2Fimage-20240425114724965.png?alt=media)

* Access Control(a standard way to protect sensitive data)
  * checks if the program has the right/permissions to access certain information
  * concerns how information is accessed
* Information flow security(end-2-end)
  * tracks how information flows through the program to make sure that the program handles the information securely
  * concerns how information is propagated

> "A practical system needs both access and flow control to satisfy all security requirements." ——— D. Denning, 1976

Both access control and flow control complement each other. We are not sure how information is used after accessed. So we need information flow control to keep the information under watch.

**Information Flow**: if the information in variable _x_ is transfered to variable _y_, then there is information flow _x_->_y_

how to connect information flow to security ?

* Classifies program variables into different security levels
* Specifies permissible flows between these levels,i.e.,information flow policy

The most basic model is two-level policy, i.e., a variable is classified into one of two security levels(high security and low security)

Security levels can be modeled as _lattice_ _L≤H_

![image-20240425115625005](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-188518c1ce1f4200c66227e59292918c51526f8d%2Fimage-20240425115625005.png?alt=media)

information flow policy restricts how information flows between different security levels.

Noninterference policy

* requires the information of high variable have no effect on the information of low variables
* that is, not able to conclude anything about high information by observing low variables

![image-20240425115840424](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-045a76e5ade1ae1d4330f4e56757fc1424d807e4%2Fimage-20240425115840424.png?alt=media)

As seen above, low variables can override high variables which cannot provide integrity of high security information.

## Confidentiality and Integrity

Confidentiality

* Prevent secret information from being leaked

Integrity

* Prevent untrusted information from corrupting (trusted) critical information
* i.e., Injection attack

![image-20240425120828412](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-474dc3477f4c463f959272c516d5c02d3b0aa81f%2Fimage-20240425120828412.png?alt=media)

## Explicit Flows and Convert Channels

We have seen how information flows through direct copying.This is called explicit flow.(X~~L~~=Y~~H~~)

but there are also some implicit flows.

It may arise when the control flow is affected by secret information.

Any differences in side effects under secret control encode information about the control, which may be publicly observable and leak secret informatio

(convert channel: 隐蔽信道)

![image-20240425124013664](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-268666272dd5d4b346df66b8377ab2c5f20414af%2Fimage-20240425124013664.png?alt=media)

However, explicit flows generally carry more information than covert channels, so we focus on explicit flow.

![image-20240425124216698](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-a4d4977c43b775cf2a47603fa45975f001f14d51%2Fimage-20240425124216698.png?alt=media)

## Taint Analysis

Taint analysis is the most common information flow analysis. It classifies program data into two kinds:

* Data of interest, some kinds of labels are associated with the data, called tainted data
* Other data, called untainted data

Sources of tainted data is called sources. In practice, tainted data usually come from the return values of some methods (regarded as sources).

Taint analysis tracks how tainted data flow through the program and observes if they can flow to locations of interest (called sinks). In practice, sinks are usually some sensitive methods.

![image-20240425130905185](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-fcafe67048d00f27ae8911193eb9dca93d03b996%2Fimage-20240425130905185.png?alt=media)

taint analysis and pointer analysis are very alike.

![image-20240425130948601](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-9aac5f9833a3d25ddabbcaddbc072f0e4797d062%2Fimage-20240425130948601.png?alt=media)

![image-20240425131015660](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-5cbe254f97fff2cbb400b4b60c99edd17b6a0c48%2Fimage-20240425131015660.png?alt=media)

![image-20240425131033164](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-5e61bcc3b059710bcc9b3f571895098318b1d58b%2Fimage-20240425131033164.png?alt=media)

![image-20240425131122278](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-01c87b440597b4dec429e971c1a1b82b3d66e271%2Fimage-20240425131122278.png?alt=media)

![image-20240425131144815](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-ae8a0b3e2883f98dfc3fd9d1d2d1bcbcc331489a%2Fimage-20240425131144815.png?alt=media)

![image-20240425131211770](https://1239337109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2HLPOkuOfb7iyCzDJ8vA%2Fuploads%2Fgit-blob-7343541b72055c289e0756b0eca8ae56eb1f10b5%2Fimage-20240425131211770.png?alt=media)
