[Paper Review] TaintAssembly: Taint-Based Information Flow Control Tracking for WebAssembly

William Fu, Raymond Tzer Pin Lin+1 more|arXiv (Cornell University)|Feb 4, 2018

Advanced Malware Detection Techniques7 references20 citations

TL;DR

TaintAssembly is a modified V8 JavaScript engine that enables dynamic taint tracking for interpreted WebAssembly, supporting taint propagation across function parameters, local variables, linear memory, and probabilistic taint. It achieves only 5–12% runtime overhead compared to vanilla V8, making it viable for development and debugging of WebAssembly applications with information flow analysis.

ABSTRACT

WebAssembly (wasm) has recently emerged as a promisingly portable, size-efficient, fast, and safe binary format for the web. As WebAssembly can interact freely with JavaScript libraries, this gives rise to a potential for undesirable behavior to occur. It is therefore important to be able to detect when this might happen. A way to do this is through taint tracking, where we follow the flow of information by applying taint labels to data. In this paper, we describe TaintAssembly, a taint tracking engine for interpreted WebAssembly, that we have created by modifying the V8 JavaScript engine. We implement basic taint tracking functionality, taint in linear memory, and a probabilistic variant of taint. We then benchmark our TaintAssembly engine by incorporating it into a Chromium build and running it on custom test scripts and various real world WebAssembly applications. We find that our modifications to the V8 engine do not incur significant overhead with respect to vanilla V8's interpreted WebAssembly, making TaintAssembly suitable for development and debugging.

Motivation & Objective

• To address the lack of dynamic taint tracking tools for WebAssembly, especially in the context of interactions with JavaScript.
• To enable developers to detect unintended data flows and potential vulnerabilities in WebAssembly programs during development.
• To implement taint tracking in interpreted WebAssembly without significant performance overhead.
• To support taint propagation across function parameters, local variables, linear memory, and probabilistic taint models.
• To evaluate the feasibility and performance of taint tracking in a real-world browser engine (V8/Chromium).

Proposed method

• Modified the V8 WebAssembly interpreter to track taint labels on function parameters and local variables using bit-vector taint tracking.
• Extended taint tracking to WebAssembly’s linear memory by maintaining a separate taint map for memory locations, incurring some runtime and memory overhead.
• Implemented a probabilistic taint model that assigns a probability to taint propagation per operation, reducing memory usage at the cost of some precision.
• Used a resolution of 8 bits for probability values and evaluated taint persistence through a hash function over 100,000 iterations.
• Integrated the modified V8 engine into a Chromium build and benchmarked it on custom scripts and real-world WebAssembly applications.
• Traced and debugged the V8 source code, targeting a stable branch (chromium/3270) due to instability in the master branch.

Experimental results

Research questions

• RQ1 Can dynamic taint tracking be effectively implemented in interpreted WebAssembly without prohibitive performance costs?
• RQ2 How does taint propagation behave across WebAssembly functions, local variables, and linear memory?
• RQ3 What is the performance overhead of taint tracking in a real-world browser engine like V8?
• RQ4 How effective is probabilistic taint tracking in preserving taint lifetime while reducing memory usage?
• RQ5 Can taint tracking detect data flow between WebAssembly and JavaScript, enabling vulnerability detection?

Key findings

• TaintAssembly achieves only 5–12% performance overhead on real-world WebAssembly applications compared to vanilla V8, demonstrating practical feasibility for development use.
• Basic taint tracking for function parameters and local variables is effective and incurs minimal overhead.
• Taint tracking in linear memory is functional but introduces measurable runtime and memory overhead due to the need for a separate taint map.
• Probabilistic taint tracking shows a sharp decline in taint persistence when propagation probability drops below 0.6, with approximately 50% retention at a probability of 0.8.
• The taint propagation behavior through a 2700-operation hash function approximates a softplus function, indicating predictable decay in taint lifetime.
• The implementation successfully supports taint tracking across WebAssembly-JavaScript interactions, enabling detection of data flow from untrusted sources.