Systematic approach to uncover GUI logic flaws

• US 8,125,669 B2
• Filed: 06/29/2007
• Issued: 02/28/2012
• Est. Priority Date: 11/30/2006
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Chen, Shuo, Wang, Yi-Min, Wang, Jiahe Helen
• Primary Examiner(s): EBRAHIMI DEHKORDY, SAEID
• Application Number:
  US11/772,085
• Publication Number:
  US 20080127341A1
• Time in Patent Office: 1,705 Days
• Field of Search: 358/1.15, 358/1.14, 358/1.13, 358/1.16, 358/1.18, 358/3.28, 358/1.2, 715/730, 715/760, 715/764, 715/751, 715/766, 715/784, 726/25, 726/22, 726/15, 726/23, 726/4, 717/100, 717/143, 717/170, 709/227, 709/200
• US Class Current: 358/1.15
• CPC Class Codes: G06F 11/3608 using formal methods, e.g. model checking, abstract interpretation theorem proving G06N5/013
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof

Abstract

To achieve end-to-end security, traditional machine-to-machine security measures are insufficient if the integrity of the graphical user interface (GUI) is compromised. GUI logic flaws are a category of software vulnerabilities that result from logic flaws in GUI implementation. The invention described here is a technology for uncovering these flaws using a systematic reasoning approach. Major steps in the technology include: (1) mapping a visual invariant to a program invariant; (2) formally modeling the program logic, the user actions and the execution context, and systematically exploring the possibilities of violations of the program invariant; (3) finding real spoofing attacks based on the exploration.

Claims

1. A method comprising:

A processor examining graphic user interface (GUI) logic;

identifying flaws in the logic that expose security damage;

mapping a visual invariant to a program invariant;

discovering inputs to the GUI logic that include a user action and an execution context to cause the program invariant to be violated; and

uncovering browser address bar spoofing by examining for logic correctness as to navigation functionality that includes loading a new page, travelling back in the history log, and opening a new window.

2. The method of claim 1, wherein the flaws include GUI design and implementation.

3. The method of claim 2, wherein spoofing scenarios as to an Internet browser are examined.

4. The method of claim 3 wherein the spoofing scenario includes a secure socket layer (SSL) certificate spoof.

5. The method of claim 3 wherein the spoofing scenario includes non-markup language navigation.

6. The method of claim 1, wherein the flaws are directed to non browser applications.

7. The method of claim 6, wherein the non browser applications include email clients, word processing utilities, and identity management systems.

8. The method of claim 1,

wherein browser status bar spoofing is uncovered by examining source code for logic correctness of mouse-handling functionality of markup language elements.

9. The method of claim 1,

wherein browser status bar spoofing is uncovered by examining execution context of a spoofing attack that includes an HTML page, and user action sequence that include multiple raw mouse messages.

10. The method of claim 1,

wherein browser address bar spoofing is uncovered by examining execution context of a spoofing attack that includes a set of Boolean flags that affect the execution of navigation functions.

11. A method comprising:

A processor examining graphic user interface (GUI) logic;

identifying flaws in the logic that expose security damage;

mapping a visual invariant to a program invariant;

discovering inputs to GUI logic that include user actions and an execution context to cause the program invariant to be violated, the discovering comprising document object trees, active scripts, and user actions that cause the visual invariant to be violated; and

constructing real visual spoofing attacks based on the inputs to GUI logic.

12. The method of claim 11, wherein browser status bar spoofing is uncovered by examining source code for logic correctness of mouse-handling functionality of markup language elements.

13. The method of claim 11, wherein browser status bar spoofing is uncovered by examining execution context of a spoofing attack that includes an HTML page, and user action sequence that include multiple raw mouse messages.

14. A method comprising:

A processor generating a webpage that includes a canonical document object model tree;

loading the webpage through a browser, wherein an action sequence performed by the browser is simulated, and states of the browser are tracked; and

checking for spoofs when the loading is performed by examining graphic user interface (GUI) logic and identifying flaws in the logic that expose security damage, the action sequence and the checking for spoofs implemented using binary instrumentation tools.

15. The method of claim 14, wherein the action sequence is pumped by repeatedly calling a routine.

16. The method of claim 14 further comprising repeating generating the webpage by generating another webpage.