Visible to the public Eliminating Input-Based Attacks by Deriving Automated Encoders and Decoders from Context-Free Grammars

TitleEliminating Input-Based Attacks by Deriving Automated Encoders and Decoders from Context-Free Grammars
Publication TypeConference Paper
Year of Publication2017
AuthorsBieschke, T., Hermerschmidt, L., Rumpe, B., Stanchev, P.
Conference Name2017 IEEE Security and Privacy Workshops (SPW)
Date PublishedMay 2017
ISBN Number978-1-5386-1968-1
Keywordsarbitrary code execution, automated decoders, automated encoders, binary languages, communication language, context-free grammars, correct parsing, Cross Site Scripting, Cross Site Scripting (XSS), cross-site scripting, custom language, data encoding, encoding, encoding generation, formal languages, Generators, Grammar, grammars, Human Behavior, human factor, human factors, input based attack elimination, McHammerCoder, Nails, parsers, Protocols, pubcrawl, reliable systems, resilience, Resiliency, Scalability, secure systems, security of data, security vulnerabilities, Software systems, SQL, textual languages, unparsers

Software systems nowadays communicate via a number of complex languages. This is often the cause of security vulnerabilities like arbitrary code execution, or injections. Whereby injections such as cross-site scripting are widely known from textual languages such as HTML and JSON that constantly gain more popularity. These systems use parsers to read input and unparsers write output, where these security vulnerabilities arise. Therefore correct parsing and unparsing of messages is of the utmost importance when developing secure and reliable systems. Part of the challenge developers face is to correctly encode data during unparsing and decode it during parsing. This paper presents McHammerCoder, an (un)parser and encoding generator supporting textual and binary languages. Those (un)parsers automatically apply the generated encoding, that is derived from the language's grammar. Therefore manually defining and applying encoding is not required to effectively prevent injections when using McHammerCoder. By specifying the communication language within a grammar, McHammerCoder provides developers with correct input and output handling code for their custom language.

Citation Keybieschke_eliminating_2017