Detection of logic flaws in multi-party business applications via security testing. (Détection d'anomalies logiques dans les logiciels d'entreprise multi-partis à travers des tests de sécurité)

Multi-party business applications are computer programs distributed over the Web implementing collaborative business functions. These applications are one of the main target of attackers who exploit vulnerabilities in order to perform malicious activities. The most prevalent classes of vulnerabilities are the consequence of insufficient validation of the user-provided input. However, the less-known class of logic vulnerabilities recently attracted the attention of researcher. Unfortunately, the unavailability of the source code in these kind of applications makes it hard to discover this type of vulnerabilities. According to the availability of software documentation, two further techniques can be used: design verification via model checking, and black-box security testing. However, the former offers no support to test real implementations and the latter lacks the sophistication to detect logic flaws. In this thesis, we present two novel security testing techniques to detect logic flaws in multi-party business applications that tackle the shortcomings of the existing techniques. First, we present the design verification via model checking of two security protcools. We then address the challenge of extending the results of the model checker to automatically test real protocol implementations. Second, when explicit documentation is not available, we present a novel black-box security testing technique that combines model inference, extraction of workflow and data flow patterns, and an attack pattern-based test case generation algorithm. Finally, we discuss the application of the technique developed in this thesis in an industrial setting. We used the techniques presented in this thesis to discover previously-unknown design errors in the SAML SSO and OpenID security protocols and their implementations, and ten severe logic vulnerabilities in eCommerce business applications allowing an attacker to pay less or even shop for free.