Systematic Approach to Uncover GUI Logic Flaws

• US 20080127341A1
• Filed: 06/29/2007
• Published: 05/29/2008
• Est. Priority Date: 11/30/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wang, Yi-Min, Wang, Jiahe Helen, Chen, Shuo
• Granted Patent: US 8,125,669 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 11/3608 using formal methods, e.g. model checking, abstract interpretation theorem proving G06N5/013
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof

Abstract

To achieve end-to-end security, traditional machine-to-machine security measures are insufficient if the integrity of the graphical user interface (GUI) is compromised. GUI logic flaws are a category of software vulnerabilities that result from logic flaws in GUI implementation. The invention described here is a technology for uncovering these flaws using a systematic reasoning approach. Major steps in the technology include: (1) mapping a visual invariant to a program invariant; (2) formally modeling the program logic, the user actions and the execution context, and systematically exploring the possibilities of violations of the program invariant; (3) finding real spoofing attacks based on the exploration.

Claims

1. A method comprising:

mapping a visual invariant to a program invariant; and

discovering inputs to GUI logic that includes a user actions and an execution context to cause the program invariant to be violated.

2. The method of claim 1, wherein the discovering comprises document object trees, active scripts, and user actions that cause the visual invariant to be violated.

3. The method of claim 1, wherein the discovering is used as the guidance for constructing real visual spoofing attacks.

4. The method of claim 1, wherein browser status bar spoofing is uncovered by examining source code for logic correctness of mouse-handling functionality of markup language elements.

5. The method of claim 1, wherein browser status bar spoofing is uncovered by examining execution context of a spoofing attack that includes an HTML page, and user action sequence that include multiple raw mouse messages.

6. The method of claim 1, wherein browser address bar spoofing is uncovered by examining for logic correctness as to the navigation functionality that includes loading a new page, travelling back in the history log and opening a new window.

7. The method of claim 1, wherein browser address bar spoofing is uncovered by examining execution context of a spoofing attack that includes a set of Boolean flags that affect the execution of navigation functions.

8. A method comprising:

generating a webpage;

loading the webpage through a browser, wherein an action sequence performed by the browser is simulated, and states of the browser are tracked; and

checking for spoofs when the loading is performed.

11. The method of claim 11, wherein the action sequence is pumped by repeatedly calling a routine.

9. The method of claim 11, wherein the action sequence and the checking for spoofs is implemented using binary instrumentation tools.

10. The method of claim 11, wherein the webpage comprises a canonical document object model tree.

12. The method of claim 11, wherein the checking is performed by intercepting calls of browser state updates.

13. The method of claim 11 further comprising repeating generating a second webpage.

14. A method comprising:

examining graphic user interface (GUI) logic; and

identifying flaws in the logic that expose security damage.

15. The method of claim 14, wherein the flaws include GUI design and implementation.

16. The method of claim 15, wherein spoofing scenarios as to an Internet browser are examined.

17. The method of claim 16 wherein the spoofing scenario includes a secure socket layer (SSL) certificate spoof.

18. The method of claim 16 wherein the spoofing scenario includes non-markup language navigation.

19. The method of claim 14, wherein the flaws are directed to non browser applications.

20. The method of claim 19, wherein the non browser applications include email clients, word processing utilities, and identity management systems.