Blind Spots: Automatically detecting ignored program inputs

TL;DR

This paper introduces an automated dynamic analysis technique to detect blind spots in program inputs, revealing exploitable bugs and ignored data in complex file parsers like PDF, with broad applicability to other formats.

Contribution

It formalizes blind spots, develops a dynamic information flow tracking method, and demonstrates its effectiveness in identifying parser bugs and ignored inputs in PDFs.

Findings

Detected exploitable bugs in MuPDF PDF parser

Missed detection rate is no higher than 11%

At least 5% of each PDF is ignored by the parser

Abstract

A blind spot is any input to a program that can be arbitrarily mutated without affecting the program's output. Blind spots can be used for steganography or to embed malware payloads. If blind spots overlap file format keywords, they indicate parsing bugs that can lead to exploitable differentials. For example, one could craft a document that renders one way in one viewer and a completely different way in another viewer. They have also been used to circumvent code signing in Android binaries, to coerce certificate authorities to misbehave, and to execute HTTP request smuggling and parameter pollution attacks. This paper formalizes the operational semantics of blind spots, leading to a technique based on dynamic information flow tracking that automatically detects blind spots. An efficient implementation is introduced and evaluated against a corpus of over a thousand diverse PDFs parsed through MuPDF, revealing exploitable bugs in the parser. All of the blind spot classifications are confirmed to be correct and the missed detection rate is no higher than 11%. On average, at least 5% of each PDF file is completely ignored by the parser. Our results show promise that this technique is an efficient automated means to detect exploitable parser bugs, over-permissiveness and differentials. Nothing in the technique is tied to PDF in general, so it can be immediately applied to other notoriously difficult-to-parse formats like ELF, X.509, and XML.