Ventkat Venkatakrishnan's guest appearances

Ventkat Venkatakrishnan

CERIAS Weekly Security Seminar - Purdue University

Ryan Henry

Cory Doctorow

Doug Smith

Larry Ponemon

George Heron

Laura Thomas

Eli Lilly

Stephen Elliott

Tony Sager

David Carroll

Jack Daniel

Joe Judge

Chris Reed

Richard III

John Richardson

OwlTail

SQL injection attacks are one of the topmost threats for applicationswritten for the Web. These attacks are launched through specially crafted user input on web applications that use low level string operations to construct SQL queries. In this talk, I will present a novel and powerful scheme for automatically transforming web applications to render them safe against all SQL injection attacks.A characteristic diagnostic feature of SQL injection attacks is that they change the intended structure of queries issued. Our technique for detecting SQL injection is to dynamically mine the programmer-intended query structure on any input, and detect attacks by comparing it against the structure of the actual query issued. We propose a simple and novel mechanism for mining programmer intended queries by dynamically evaluating runs over benign candidate inputs. This mechanism is theoretically well founded and is based on inferring intended queries by considering the symbolic query computed on a program run. Our approach has been implemented in a tool called CANDID that retrofits Web applications written in Java to defend them against SQL injection attacks. We report experimental results that show that our approach performs remarkably well in practice.(Joint work with Sruthi Bandhakavi, Prithvi Bisht and P. Madhusudan) About the speaker: Dr. V. N. Venkatakrishnan is an Assistant Professor ofComputer Science at the University of Illinois at Chicago. He is co-founder and co-director of the Center for Research and Instruction in Technologies for Electronic Security (RITES) at UIC.  Venkat's main research expertise is in using practical program transformation techniques for systems security. Specific research areas that he works on are web application security, browser security, mobile code security and data tainting mechanisms for  addressing information flow confidentiality. He received his Ph.D degree from Stony Brook University in 2004. He is the recipient of the best research paper award at ACSAC 2003, and the UIC College of Engineering teaching award in 2007.

<p>SQL injection attacks are one of the topmost threats for applicationswritten for the Web. These attacks are launched through specially crafted user input on web applications that use low level string operations to construct SQL queries. In this talk, I will present a novel and powerful scheme for automatically transforming web applications to render them safe against all SQL injection attacks.A characteristic diagnostic feature of SQL injection attacks is that they change the intended structure of queries issued. Our technique for detecting SQL injection is to dynamically mine the programmer-intended query structure on any input, and detect attacks by comparing it against the structure of the actual query issued. We propose a simple and novel mechanism for mining programmer intended queries by dynamically evaluating runs over benign candidate inputs. This mechanism is theoretically well founded and is based on inferring intended queries by considering the symbolic query computed on a program run. Our approach has been implemented in a tool called CANDID that retrofits Web applications written in Java to defend them against SQL injection attacks. We report experimental results that show that our approach performs remarkably well in practice.(Joint work with Sruthi Bandhakavi, Prithvi Bisht and P. Madhusudan) About the speaker: Dr. V. N. Venkatakrishnan is an Assistant Professor ofComputer Science at the University of Illinois at Chicago. He is co-founder and co-director of the Center for Research and Instruction in Technologies for Electronic Security (RITES) at UIC.  Venkat's main research expertise is in using practical program transformation techniques for systems security. Specific research areas that he works on are web application security, browser security, mobile code security and data tainting mechanisms for  addressing information flow confidentiality. He received his Ph.D degree from Stony Brook University in 2004. He is the recipient of the best research paper award at ACSAC 2003, and the UIC College of Engineering teaching award in 2007.</p>

Ventkat Venkatakrishnan, CANDID: Preventing SQL Injection Attacks using Dynamic Candidate Evaluations