Menu
MIT's new bug finder uncovers flaws in Web apps in 64 seconds

MIT's new bug finder uncovers flaws in Web apps in 64 seconds

It found 23 new vulnerabilities in 50 popular Web applications written with Ruby on Rails

MIT's new debugging system found 23 previously undiagnosed security flaws. Credit: MIT News

MIT's new debugging system found 23 previously undiagnosed security flaws. Credit: MIT News

Finding bugs in Web applications is an ongoing challenge, but a new tool from MIT exploits some of the idiosyncrasies in the Ruby on Rails programming framework to quickly uncover new ones.

In tests on 50 popular Web applications written using Ruby on Rails, the system found 23 previously undiagnosed security flaws, and it took no more than 64 seconds to analyze any given program.

Ruby on Rails is distinguished from other frameworks because it defines even its most basic operations in libraries. MIT's researchers took advantage of that fact by rewriting those libraries so that the operations defined in them describe their own behavior in a logical language.

That turns the Rails interpreter, which converts high-level Rails programs into machine-readable code, into a static-analysis tool that describes how data flows through the program. The result is that running a Rails program through the interpreter produces a formal, line-by-line description of how the program handles data.

Dubbed Space, the new debugger focuses on a program’s data-access procedures using a simple logical model that describes what operations a user can perform on what data and under what circumstances. From the descriptions generated by the hacked libraries, Space can automatically determine whether the program adheres to those models; if it doesn’t, there’s likely to be a security flaw.

The researchers will present their results next month at the International Conference on Software Engineering.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments