FlowWatcher: Preventing Data Disclosure Vulnerabilities in Web Applications

Add to your list(s) Download to your calendar using vCal

• Dan O'Keeffe (Imperial College London)
• Thursday 05 November 2015, 15:00-16:00
• FW26, Computer Laboratory, William Gates Building.

If you have a question about this talk, please contact Eiko Yoneki.

Bugs in the authorisation logic of web applications can expose the data of one user to another. Such data disclosure vulnerabilities are common—they can be caused by a single omitted access control check in the application.

In this talk I will describe FlowWatcher, an HTTP proxy that mitigates data disclosure vulnerabilities in unmodified web applications. FlowWatcher monitors HTTP traffic and shadows part of an application’s access control state based on a rule-based specification of the user-data-access (UDA) policy. The UDA policy states the intended data ownership and how it changes based on observed HTTP requests. FlowWatcher detects violations of the UDA policy by tracking data items that are likely to be unique across HTTP requests and responses of different users. Our evaluation of a prototype implementation of FlowWatcher as a plug-in for the Nginx reverse proxy shows that, with short UDA policies, it can mitigate CVE bugs in six popular web applications.

Short Bio: Dan O’Keeffe is a Post-Doctoral Research Associate in the Large Scale Distributed Systems (LSDS) group at Imperial College London. He holds a PhD in Distributed Systems from the University of Cambridge, and a Bachelor’s Degree in Computer Science from Trinity College Dublin. He also has several years of industrial experience as a software engineer.

This talk is part of the Computer Laboratory Systems Research Group Seminar series.

This talk is included in these lists:

• All Talks (aka the CURE list)
• CL's SRG seminar
• Cambridge Centre for Data-Driven Discovery (C2D3)
• Cambridge talks
• Chris Davis' list
• Computer Laboratory Systems Research Group Seminar
• Department of Computer Science and Technology talks and seminars
• FW26, Computer Laboratory, William Gates Building
• Interested Talks
• School of Technology
• Security-related talks
• Trust & Technology Initiative - interesting events
• bld31
• ndk22's list
• ob366-ai4er
• rp587

Note that ex-directory lists are not shown.