University of Minnesota
Program Analysis for Security
index.php

Dynamic taint analysis, part 1

Jim Chow, Ben Pfaff, Tal Garfinkel, Kevin Christopher, and Mendel Rosenblum. “Understanding data lifetime via whole system simulation”. In USENIX Security Symposium, pages 321-336, San Diego, CA, USA, August 2004.
[USENIX]

James Newsome and Dawn Song. “Dynamic taint analysis: Automatic detection, analysis, and signature generation of exploit attacks on commodity software”. In Network and Distributed Systems Security Symposium (NDSS), San Diego, CA, USA, February 2005.
[Author's version]

Question: The TaintBochs tool analyzes an entire system, whereas the TaintCheck tool traces taint in just one process at a time. Pick one of the two problem domains, and briefly discuss the effects of making the opposite design choice. I.e., tracking the lifetime of secret data in just a single process, or detecting network attacks on a whole-system basis. For instance what would be the tradeoff between decreased/increased implementation effort and increased/decreased coverage of attacks/vulnerabilities?