By taking advantage of certain idiosyncrasies inherent to the Ruby language, the MIT system was able to find 23 unnoticed security issues in 50 popular Web applications. But most impressive of all, the tool took no more than 64 seconds to analyze any single app.
This is made possible by Ruby’s reliance on defining very basic operations in libraries. When MIT researchers rewrote those libraries, the operations contained in those collections were forced to describe their behavior using a logical language. This, Katherine Noyes of the IDG News Service explains, “turns the Rails interpreter, which converts high-level Rails programs into machine-readable code, into a static-analysis tool that describes how data flows through the program.” Ultimately, researchers were left with a line-by-line breakdown of how a program interprets data.
MIT has named its debugging tool Space, and it focuses specifically on an application’s data-access procedures. This allows researchers to see what operations a user can exercise on certain data, and in what scenarios. Based on the descriptions the rewritten libraries provide, Space can tell how closely a program follows protocol — deviations suggest a security flaw.
“When you look at something like a Web application written in language like Ruby on Rails, if you try to do a conventional static analysis, you typically find yourself mired in this huge bog,” said Daniel Jackson, professor in the Department of Electrical Engineering and Computer Science in a statement to MIT News. “And this makes it really infeasible in practice.” But thanks to Space, scientists now have a much more feasible solution.
Full results of the study will be presented next month at the International Conference on Software Engineering held in Austin, Texas.
