1. C ANDID : P REVENTING SQL I NJECTION A TTACKS U SING D YNAMIC C ANDIDATE E VALUATIONS 2008. 09. 25 Presented by Jeong-hoon, Park 1

2. O UTLINE SQL Command Injection Attack (SQLCIA) Prepare Statements High level idea: Dynamic Candidate Evaluations Proposed Method Evaluation 2

3. SQL C OMMAND I NJECTION A TTACK (SQLCIA) 3 PhoneBook Record Manager User Name Password John 123 Display Delete submit SELECT * FROM phonebook WHERE username= ‘ John ’ AND Password = ‘ 123 ’ John’s phonebook entries are displayed

4. SQL C OMMAND I NJECTION A TTACK (SQLCIA) – CONT. 4 PhoneBook Record Manager User Name Password John’ OR 1=1 -- what? Display Delete submit SELECT * FROM phonebook WHERE username= ‘ John’ OR 1=1 -- ’ AND Password = ‘ what? ’ All phonebook entries are displayed

5. SQL C OMMAND I NJECTION A TTACK (SQLCIA) – CONT. 5

6. 6

7. Most Systems separate code from data SQL queries can be constructed by arbitrary sequences of programming constructs that involve string operations like Concatenation, substring… Such Construct also involve (trusted / untrusted) user inputs. Queries intended by the programmer can be “changed” by untrusted user input. 7

8. SQL C OMMAND I NJECTION A TTACK (SQLCIA) – CONT. 8 SELECT * FROM phonebook WHERE username= ‘ John ’ AND Password = ‘ 123 ’ WHERE username= ‘ John ’ AND Password = ‘ 123 ’ Benign Query Benign Query

9. SQL C OMMAND I NJECTION A TTACK (SQLCIA) – CONT. 9 SELECT * FROM phonebook WHERE username= ‘ John’ OR 1=1 -- ’ AND Password = ‘ what? ’ WHERE username= ‘ John’ OR 1=1 -- ’ AND Password = ‘ what? ’ Attack Query Attack Query

10. P REPARE S TATEMENTS Prepare statement in Commercial DBMS is useful in preventing the SQLCIA It separates query structure from data Statements are not parsed for every user input ex) Mysql> PREPARE stmt_name FROM “SELECT * FRM phonebook WHERE username=? AND password=?” 10

11. P REPARE S TATEMENTS – CONT. The way to prevent SQLCIA is replacing all the query statements in legacy application by the PREPARE statements But, replacing them automatically with static techniques is very hard. Require to guess the structure of query at each query issue location in program code. Query issued at a location depends on path taken in program So, Problem is How can we dynamically infer the benign query structure? 11

12. H IGH LEVEL IDEA : D YNAMIC CANDIDATE E VALUATIONS 12 Actual Input Candidate Input Application SQL Parser Database Actual Query Candidate Query matching Non-matching

13. H IGH LEVEL IDEA : D YNAMIC CANDIDATE E VALUATIONS – CONT. But, It is undecidable because the candidate inputs Should be Benign Issue a query at the same query issue location by following the same path in the program 13 PhoneBook Record Manager User Name Password John 123 Display Delete submit

14. P ROPOSED M ETHOD Manifestly benign inputs For every string create a sample string of ‘a’s having the same length. Candidate Input: Uname=‘aaaa’ Pwd = ‘aaa’ For integer or boolean variable, use original input Follow the original control flow by using original inputs 14 PhoneBook Record Manager User Name Password John 123 Display Delete submit

15. P ROPOSED M ETHOD – CONT. 15 Input: String uname, String pwd, boolean display Display? “select * from phonebook where username=‘” + uname +” ‘ and password=‘” + pwd +”’ ”; “delete from phonebook where username=‘” + uname +” ‘ and password=‘” + pwd +”’ ”; display == true display == false User Input: uname=“John ” pwd=“12d” display=false User Input: uname=“John ” pwd=“12d” display=false Candidate Input: uname=“aaaa” pwd=“aaa ” Candidate Input: uname=“aaaa” pwd=“aaa ” Candidate Input(2): uname=“aaaa” pwd=“aaa ” display=true Candidate Input(2): uname=“aaaa” pwd=“aaa ” display=true Actual Query: Delete from phonebook where username=‘John’ and password=‘12d’ Candidate Query: Delete from phonebook where username=‘aaaa’ and password=‘aaa’

16. P ROPOSED M ETHOD – CONT. 16 Web Application CANDID Program Transformer Safe Web Application

17. Transformation Example 17 Input: String uname, String pwd, boolean display String uname_c, String pwd_c Display? Query=“Select * from phonebook where username=‘” + uname +” ‘ and password=‘” + pwd +”’ ”; Query_c=“Select * from phonebook where username=‘” + uname_c +” ‘ and password=‘” + pwd_c +”’ ”; Query=“delete from phonebook where username=‘” + uname +” ‘ and password=‘” + pwd +”’ ”; Query_c=“delete from phonebook where username=‘” + uname_c +” ‘ and password=‘” + pwd_c +”’ ”; display == true display == false Uname=input_1, pwd=input_2, delete=input_3; Uname_c=createSample(uname), pwd_c= createSample(pwd); P ROPOSED M ETHOD – CONT. execute_query(query)If(match_queries(query,query_c)==true) execute_query(query)

18. P ROPOSED M ETHOD – CONT. Implementation Architecture Offline View Online View 18 Original Program JAVA Bytecode Transformer Instrumented Program Browser Web Server SQL Parser Tree Checker Database Instrumented Program

19. E VALUATION 19 Attack Evaluation Result Performance Overhead