Determining the vulnerability of computer software applications to privilege-escalation attacks

1. A computer program product for determining vulnerability of computer software applications to privilege-escalation attacks, the computer program product comprising:

a non-transitory computer-readable storage medium; and

computer-readable program code embodied in said computer-readable storage device, wherein said computer-readable program code is configured to:

identify a candidate access-restricted area of instructions of a computer software application;

statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area;

in response to determining that the conditional instruction exists, perform static analysis to determine if the conditional instruction is dependent on a user input; and

in response to determining that the conditional instruction is not dependent on the user input, designate the candidate access-restricted area as vulnerable to privilege-escalation attacks.

2. The computer program product according to claim 1 , wherein the computer-readable program code configured to identify the candidate access-restricted area of the instructions of the computer software application is further configured to:

identify the candidate access-restricted area in accordance with predefined criteria for identifying any of the instructions as access-restricted instructions.

3. The computer program product according to claim 1 , wherein the computer-readable program code configured to identify the candidate access-restricted area of the instructions of the computer software application is further configured to:

receive a manually-entered location of the candidate access-restricted area within the computer software application.

4. The computer program product according to claim 1 , wherein the computer-readable program code configured to identify the candidate access-restricted area of the instructions of the computer software application is further configured to:

perform differential black-box testing of the computer software application to identify the candidate access-restricted area.

5. A computer program product for determining vulnerability of computer software applications to privilege-escalation attacks, the computer program product comprising:

a non-transitory computer-readable storage medium; and

computer-readable program code embodied in said computer-readable storage device, wherein said computer-readable program code is configured to:

perform differential black-box testing of the computer software application to identify a candidate access-restricted area of instructions of a computer software application, comprising:

control a black-box tester to perform a first test simulating interactions with the computer software application as a user who is authorized to access restricted areas of the computer software application,

control the black-box tester to perform a second test simulating interactions with the computer software application as a user who is not authorized to the access restricted areas of the computer software application,

compare the results of both of the tests to identify any data entry interfaces that were exposed to the authorized user but that were not exposed to the unauthorized user,

correlate the identified data entry interfaces with the computer software application instructions underlying the identified data entry interfaces, and

designate the correlated instructions as the candidate access-restricted area;

statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area;

in response to determining that the conditional instruction exists, perform static analysis to determine if the conditional instruction is dependent on a user input; and

in response to determining that the conditional instruction is not dependent on the user input, designate the candidate access-restricted area as vulnerable to privilege-escalation attacks.

6. The computer program product according to claim 1 , wherein the computer-readable program code configured to identify the candidate access-restricted area of the instructions of the computer software application is further configured to:

statically analyze the application instructions using a predefined specification of security-sensitive operations.

7. The computer program product according to claim 1 , wherein the computer-readable program code configured to identify the candidate access-restricted area of the instructions of the computer software application comprises:

statically analyze the application instructions using a predefined specification of domain-specific knowledge relating to security-sensitive operations.

8. The computer program product according to claim 1 , wherein the computer-readable program code is further configured to:

in response to determining that the conditional instruction exists, and to determining that the conditional instruction is dependent on the user input, identify one or more data entry interfaces that is exposed by the computer software application and that leads to an authentication test performed by the conditional instruction; and

for each identified data entry interface

perform a first test simulating an interaction with the data entry interface as a user who is authorized to access restricted areas of the computer software application,

perform a second test simulating an interaction with the data entry interface as a user who is not authorized to access restricted areas of the computer software application, and

if only the first test succeeds, determine the authentication test to be a valid authentication test.

9. The computer program product according to claim 1 , wherein the computer-readable program code is further configured to:

present the designation of the candidate access-restricted area as vulnerable to privilege-escalation attacks via a computer-controlled output device.

10. A system for determining the vulnerability of computer software applications to privilege-escalation attacks, the system comprising:

a processor; and

a non-transitory computer-readable storage medium comprising computer-readable program code embodied therein, the computer-readable program code configured to:

identify a candidate access-restricted area of instructions of a computer software application;

statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area;

in response to determining that the conditional instruction exists, perform static analysis to determine if the conditional instruction is dependent on a user input; and

in response to determining that the conditional instruction is not dependent on the user input, designate the candidate access-restricted area as vulnerable to privilege-escalation attacks.

11. The system according to claim 10 , wherein the computer-readable program code configured to identify the candidate access-restricted area of the instructions of the computer software application is further configured to:

identify the candidate access-restricted area in accordance with predefined criteria for identifying any of the instructions as access-restricted instructions.

12. The system according to claim 10 , wherein the computer-readable program code configured to identify the candidate access-restricted area of the instructions of the computer software application is further configured to:

control a black-box tester to perform differential black-box testing of the computer software application to identify the candidate access-restricted area.

13. A system for determining the vulnerability of computer software applications to privilege-escalation attacks, the system comprising:

a processor; and

a non-transitory computer-readable storage medium comprising computer-readable program code embodied therein, the computer-readable program code configured to:

control a black-box tester to perform differential black-box testing of a computer software application to identify a candidate access-restricted area, further configured to:

control the black-box tester to perform a first test simulating interactions with the computer software application as a user who is authorized to access restricted areas of the computer software application;

control the black-box tester to perform a second test simulating interactions with the computer software application as a user who is not authorized to the access restricted areas of the computer software application;

compare the results of both of the tests to identify any data entry interfaces that were exposed to the authorized user but that were not exposed to the unauthorized user;

correlate the identified data entry interfaces with the computer software application instructions underlying the identified data entry interfaces; and

designate the correlated instructions as the candidate access-restricted areas;

statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area;

in response to determining that the conditional instruction exists, perform static analysis to determine if the conditional instruction is dependent on a user input; and

in response to determining that the conditional instruction is not dependent on the user input, designate the candidate access-restricted area as vulnerable to privilege-escalation attacks.

14. The system according to claim 10 , wherein the computer-readable program code configured to identify the candidate access-restricted area of the instructions of the computer software application is further configured to:

identify the candidate access-restricted areas of the computer software application by statically analyzing the application instructions using a predefined specification of security-sensitive operations.

15. The system according to claim 10 , wherein the computer-readable program code configured to identity the candidate access-restricted area of the instructions of the computer software application is further configured to:

identify candidate access-restricted areas of the computer software application by statically analyzing the application instructions using a predefined specification of domain-specific knowledge relating to security-sensitive operations.

16. The system according to claim 10 , further comprising a black-box tester, wherein the computer-readable program code configured to identity the candidate access-restricted area of the instructions of the computer software application is further configured to:

in response to determining that the conditional instruction exists, and to determining that the conditional instruction is dependent on the user input, identify one or more data entry interfaces that is exposed by the computer software application and that leads to an authentication test performed by the conditional instruction; and

for each identified data entry interface,

control the black-box tester to perform a first test simulating an interaction with the data entry interface as a user who is authorized to access restricted areas of the computer software application,

control the black-box tester to perform a second test simulating an interaction with the data entry interface as a user who is not authorized to access restricted areas of the computer software application, and

if only the first test succeeds, determine the authentication test to be a valid authentication test.

17. A computer program product for determining vulnerability of computer software applications to privilege-escalation attacks, the computer program product comprising:

a non-transitory computer-readable storage medium; and

computer-readable program code embodied in said computer-readable storage device, wherein said computer-readable program code is configured to:

identify a candidate access-restricted area of instructions of a computer software application;

statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area;

in response to determining that the conditional instruction exists, perform static analysis to determine if the conditional instruction is dependent on a user input;

in response to determining that the conditional instruction is not dependent on the user input, designate the candidate access-restricted area as vulnerable to privilege-escalation attacks; and

in response to determining that the conditional instruction is dependent on the user input:

perform a first test simulating interactions with the computer software application as a user who is authorized to access the candidate access-restricted area;

perform a second test simulating interactions with the computer software application as a user who is not authorized to access the candidate access-restricted area; and

in response to determining a success of the first test only, determine that the conditional instruction is a valid authentication test.

18. A system for determining the vulnerability of computer software applications to privilege-escalation attacks, the system comprising:

a processor; and

a non-transitory computer-readable storage medium comprising computer-readable program code embodied therein, the computer-readable program code configured to:

identify a candidate access-restricted area of instructions of a computer software application;

statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area;

in response to determining that the conditional instruction exists, perform static analysis to determine if the conditional instruction is dependent on a user input;

in response to determining that the conditional instruction is not dependent on the user input, designate the candidate access-restricted area as vulnerable to privilege-escalation attacks; and

in response to determining that the conditional instruction is dependent on the user input:

perform a first test simulating interactions with the computer software application as a user who is authorized to access the candidate access-restricted area;

perform a second test simulating interactions with the computer software application as a user who is not authorized to access the candidate access-restricted area; and

in response to determining a success of the first test only, determine that the conditional instruction is a valid authentication test.