TWC: Small: Automated Security Testing for Applications Integrating Third-Party Services

现代网络和移动应用程序越来越依赖多方提供的代码和服务，包括提供身份验证、支付和共享等安全关键功能的服务。开发人员经常在将这些服务集成到他们的应用程序中时出错，从而导致严重的安全漏洞。这些集成失败的主要原因是未能理解和确保安全使用外部服务所需的假设。该项目正在开发一个系统的解释过程，以揭示安全使用外部服务所必需的安全关键假设，以及用于自动测试应用程序在集成服务中的漏洞的工具。该项目正在创建一种部分自动化的方法，该方法结合静态和动态分析技术来构建不可用于直接分析的外部服务的模型，并将这些模型用作解释过程的一部分，该过程探索可使用受到不受限制的对手威胁的服务构建的所有合理应用程序的空间。未被覆盖的漏洞导致自动化测试工具，用于检查应用程序是否存在已被发现的漏洞。由于这些漏洞涉及涉及经过身份验证的用户的交互序列，因此不能通过表面分析检测到它们，但需要进行深入测试，扫描程序可以模拟登录用户的操作。该扫描仪利用日益流行的单点登录服务来自动化帐户注册和登录，以实现对已部署应用程序的深度、自动化扫描。该项目的预期结果包括开放源码工具和Web服务，这些工具和Web服务将实现对已部署应用程序的大规模深度扫描，并将为开发人员提供一个方便且易于使用的工具来测试他们的实现是否存在常见漏洞。

Modern web and mobile applications increasingly rely on code and services from multiple parties, including services that provide security-critical functions like authentication, payments, and sharing. Developers often make mistakes in integrating these services into their applications that lead to serious security vulnerabilities. These integration failures are mainly due to failures to understand and ensure assumptions necessary for secure use of the external service. This project is developing a systematic explication process to uncover security-critical assumptions necessary for secure use of an external service, along with tools for automatically testing applications for vulnerabilities in integrating services.The project is creating a partially automated method that combines static and dynamic analysis techniques for building models of external services that are not available for direct analysis, and for using those models as part of an explicating process that explores the space of all reasonable applications that can be constructed using a service under threat from an unconstrained adversary. The uncovered vulnerabilities lead to automated testing tools for checking applications for vulnerabilities uncovered. Since these vulnerabilities concern sequences of interactions involving authenticated users, they cannot be detected by superficial analysis but require deep testing where a scanner can simulate the actions of a logged-in user. The scanner takes advantage of single sign-on services that are becoming increasingly popular to automate account registration and logins to enable deep, automated scanning of deployed applications. Expected results of the project include open source tools and web services that will enable large-scale deep scans of deployed applications, and that will provide developers with a convenient and easy to use tool to test their implementations for common vulnerabilities.