Systems and methods for automating blind detection of computational vulnerabilities
View Patent ↗Methods for blind detection of computational vulnerabilities include the submission by a detecting system of potentially interpretable information to a target system; measurement of the timing characteristics of the output from the target system by the detecting system; and diagnosis of the vulnerabilities of the target system by the detecting system as based on the timing characteristics, optionally in conjunction with auxiliary data. Invented systems provide reference implementations of these methods.
1. A non-transitory computer-readable medium having instructions stored thereon comprising instructions that when executed cause a programmable device to:
submit to a target computer system a plurality of times an innocuous input designed for execution by an interpreter potentially in use on the target system;
calculate a first latency for the target system as an average of latencies for the innocuous input;
submit a non-innocuous input designed for execution by the interpreter to the target system, the non-innocuous input analogous to the innocuous input and designed to increase latency of the target system;
calculate a second latency for the target system corresponding to the non-innocuous input; and
determine that the target system has the interpreter and that the interpreter is vulnerable responsive to the second latency exceeding the first latency by an amount corresponding to the non-innocuous input.
2. The computer-readable medium of claim 1 , wherein the target system is an asynchronous system.
3. The computer-readable medium of claim 1 , wherein the target system is a synchronous system.
4. The computer-readable medium of claim 1 , wherein non-innocuous input is designed for execution by an SQL interpreter for a web application.
5. The computer-readable medium of claim 4 , wherein the non-innocuous input is configured to cause the SQL interpreter to break out of a numeric data type.
6. The computer-readable medium of claim 4 , wherein the non-innocuous input is configured to cause the SQL interpreter to break out of a string data type.
7. The computer-readable medium of claim 4 , wherein the non-innocuous input alters an end of a statement block.
8. The computer-readable medium of claim 4 , wherein the non-innocuous input alters a middle of a statement block and comments out a remainder of the block.
9. The computer-readable medium of claim 4 , wherein the non-innocuous input is configured to cause the SQL interpreter to break out of a statement.
10. A system configured to detect a vulnerability of a target system, comprising:
a memory; and
one or more processors, communicatively coupled to the memory, wherein the memory stores instructions that when executed cause the one or more processors to:
generate an innocuous input designed for execution by an interpreter;
generate a non-innocuous input designed for execution by the interpreter;
calculate a first latency for the target system using the innocuous input;
calculate a second latency for the target system using the non-innocuous input; and
determine that the target system has the interpreter and that the interpreter is vulnerable responsive to the second latency exceeding the first latency.
11. The system of claim 10 , wherein the instructions that when executed cause the one or more processors to calculate a first latency comprise instructions that when executed cause the one or more processors to:
submit the innocuous input to the target system a plurality of times; and
calculate the first latency as an average of latencies for the innocuous input.
12. The system of claim 10 , wherein the non-innocuous input is designed to increase latency of the target system.
13. The system of claim 10 , wherein the interpreter is an interpreter potentially in use on the target system.
14. The system of claim 10 , wherein the non-innocuous input is analogous to the innocuous input.
15. A method of detecting a vulnerability of a target system, comprising:
calculating a first latency for a target computer system corresponding to an innocuous input submitted to the target computer system designed for execution by an interpreter potentially in use on the target system;
calculating a second latency for the target computer system corresponding to a non-innocuous input designed for execution by the interpreter to the target system; and
determine that the target computer system has the interpreter and that the interpreter is vulnerable responsive to the second latency exceeding the first latency.
16. The method of claim 15 , wherein the interpreter is an SQL interpreter.
17. The method of claim 15 , wherein calculating the first latency comprises:
submitting the innocuous input to the target computer system a plurality of times; and
calculating the first latency for the target computer system as an average of latencies for the innocuous input.
18. The method of claim 15 , wherein the non-innocuous input is designed to increase latency of the target computer system.
19. The method of claim 15 , wherein the non-innocuous input is analogous to the innocuous input.
20. The method of claim 15 , wherein the target computer system is an asynchronous system.