Do You Speak My Language? Make Static Analysis Engines Understand Each Other

With the widespread usage of service-oriented architectures[1][2][3][4][5], detecting security issues becomes a harder task as vulnerabilities span multiple services, codebases, and programming languages.At Facebook, products and features are written in different languages - for example, the main Facebook.com (https://facebook.com/) codebase is written in Hack and the main Instagram.com (https://instagram.com/) is written in Python. These products usually need to communicate with each other or with backend systems for processing user requests.Current security-focused static analysis tools such as CodeQL, RIPS, and Checkmarx as well as Facebook-built tools like Zoncolan and Pysa can only analyze each codebase/language in isolation. Each tool only sees one part of the data flow, limiting the ability of application security teams to track data flows that cross the language boundary and identify security issues arising from such flows.This presentation will introduce a novel but generic framework to exchange taint information between two or more static analysis systems and how that can be used to perform cross-language, cross-repo taint-flow analysis. It will showcase how this has been implemented inside Facebook and used at scale by Facebook's security team to detect critical security vulnerabilities spanning multiple codebases. During the presentation, we will show examples of the actual vulnerabilities where the data flow crosses from one language to another.[1]: https://www.nginx.com/blog/microservices-at-netflix-architectural-best-practices/[2]: https://netflixtechblog.com/a-microscope-on-microservices-923b906103f4[3]: https://eng.uber.com/service-oriented-architecture/[4]: https://aws.amazon.com/microservices/[5]: https://engineering.fb.com/2019/05/29/security/service-encryption/