Paper: The Case for Browser Provenance

The Case for Browser Provenance

Abstract:

In our increasingly networked world, web browsers are important applications. Originally an interface tool for
accessing distributed documents, browsers have become ubiquitous, incorporating a significant portion of user interaction. A modern browser now also reads email, plays media, edits documents, and runs applications. Consequently, browsers process large quantities of data, and must record metadata, such as history, to help users
manage their data. Most of the metadata that modern browsers record is actually provenance – metadata that
captures the causality and lineage of data obtained via the browser. We demonstrate that characterizing browser
metadata as provenance and then applying techniques from the provenance research community enables new
browser functionality. For example, provenance can improve both history and web search by indicating contextual and personal relationships between data items. Users can also answer complex questions about the origins of their data by querying provenance. Our initial results suggest these features are feasible to implement and could perform well in modern browsers.

Information:

Paper by Daniel W. Margo and Margo Seltzer (Harvard School of Engineering and Applied Sciences) – accepted paper at USENIX TaPP`09 - PDF Download

Brief Discussion:

When I first saw the title of the paper, I felt immediately forced to read it. Data provenance or provenance information in general is a pretty powerful tool and can provide many answers to complex questions. If you check my blog for other provenance related papers, you will realize that provenance information provides information back to the very first beginning of an item if needed and properly implemented.

The authors of this specific paper discuss interesting scenarios in which the provenance information of a browser could be useful. Just for giving an example: Lineage (provenance) information about downloads, personalizing web search and time-contextual history search.

Finally, in section 3 a very interesting question is asked: Why do modern browser do not use any graph algorithms at all? Or is this the case? To be honest, I don´t know either …

Paper: Dark Clouds on the Horizon: Using Cloud Storage as Attack Vector and Online Slack Space

Dark Clouds on the Horizon: Using Cloud Storage as Attack Vector and Online Slack Space

Abstract:

During the past few years, a vast number of online file storage services have been introduced. While several of these services provide basic functionality such as uploading and retrieving files by a specific user, more advanced services offer features such as shared folders, real-time collaboration, minimization of data transfers or unlimited storage space. Within this paper we give an overview of existing file storage services and examine Dropbox, an advanced file storage solution, in depth. We analyze the Dropbox client software as well as its transmission protocol, show weaknesses and outline possible attack vectors against users. Based on our results we show that Dropbox is used to store copyright-protected files from
a popular filesharing network. Furthermore Dropbox can be exploited to hide files in the cloud with unlimited storage capacity. We define this as online slack space. We conclude by discussing security improvements for modern online storage services in general, and Dropbox in particular. To prevent our attacks cloud storage operators should employ data possession proofs on clients, a technique which has been recently discussed only in the context of assessing trust in cloud storage operators.

Information:

Paper by Martin Mulazzani, Sebastian Schrittwieser, Manuel Leithner, Markus Huber, and Edgar Weippl - accepted paper at USENIX Security’11 - PDF Download

Brief Discussion:

The authors provide some information about weaknesses in cloud storage services such as Dropbox and outline possible attack vectors against users. This was primarily done by analyzing the transmission protocol and the client. Besides the fact that the idea of abusing the deduplication feature of cloud services is not new, the paper is well structured and interesting to read. It takes old ideas and accumulates them with fresh results in a pretty interesting way.

However, at first I missed a little bit the main difference to the paper by Pinkas et al. In March 2011, I had the pleasure to talk to Benny Pinkas in Zurich at IBM by myself after his talk about the deduplication design flaws in cloud storage services. The attack is quite simple – unfortunately, mitigations are not. Further information can be found in the paper by Pinkas.
Furthermore, for the section “Stolen Host ID Attack” I miss proper references. This issues has obviously been discovered by Derek Newton half a year ago, or am I wrong? A referencing link would be nice in this case.

Obviously, SBA Research followed the responsible disclosure process according to comment #134 on the blog of Derek. Thx to Tobi for this information.

Paper: Detecting Hidden Storage Side Channel Vulnerabilities in Networked Applications

Detecting Hidden Storage Side Channel Vulnerabilities in Networked Applications

Abstract:

Side channels are communication channels that were not intended for communication and that accidentally leak information. A storage side channel leaks information through the content of the channel and not its timing behavior. Storage side channels are a large problem in networked applications since the output
at the level of the protocol encoding (e.g., HTTP and HTML) often depends on data and control flow. We call such channels hidden because the output differences blend with the noise of the channel. Within a formal system model, we give a necessary and sufficient condition for such storage side channels to exist. Based on this condition, we develop a method to detect this kind of side channels. The method is based on systematic comparisons of network responses of web applications. We show that this method is useful in practice by exhibiting hidden storage side channels in three well-known web applications: Typo3, Postfix Admin, and
Zenith Image Gallery

Information:

Paper by Felix Freiling Sebastian Schinzel- accepted paper at IFIP sec2011 - PDF Download

Brief Discussion:

The authors describe a method based on systematic comparisons of network responses of web applications. This means: You through a lot of rubbish requests at a web application and figure out how the responses differ from the responses caused by requests with valid accounts/data etc. I pretty much like the idea . And obviously, the results are impressive: The authors provide 3 real world applications which are vulnerable.

By the way: Sebastian Schinzel was guest at my former chair at the RUB for the HackerPraktikum. Hence, you can watch the video of his talk here which is also about side channel attacks.

Cyber Forensics in the Cloud – Magazine Article

Cyber Forensics in the Cloud

In volume 14 of the IAnewsletter, an article about forensics in the cloud was published. Although this magazine is more focussing on industry related readers and most of the topics in the article are already known, the article by Scott Zimmermann and Dominick Glavach was quite interesting to read.

Especially the aspect of time synchronization is important, imho. All involved entities during and before an investigation have to have time synchronization. Otherwise, evidence matching will be difficult, especially in front of a court.

Another interesting topic was “tools for performing”: If you ask me, it is not possible to create ONE specific tool for cloud forensics due to the current lack of standards. In most of the cases, you have to combine several other tools in order to get your results. In the future, in case there will be ONE standard for all cloud implementations , one tool could solve a lot of forensic issues – but this will hardly be realistic.

The authors talk in the article about signature based analysis for forensic collections – I do not think that this method will be applicable in real world scenarios. The past has shown that the AV industry pretty much fails if it comes to reach the 100% detection rate. 90% reliable evidence within digital forensic investigations is not enough.

Information:

Magazine paper by Dominick Glavach and Scott Zimmermann – PDF Download

Paper: Cloud Architectures

Cloud Architectures

Abstract:

It’s obviously missing

Information:

Paper by Jinesh Varia – published in 9th IEEE Annual Conference, IEEE Stanford and IEEE Silicon Valley Chapter, July 2008 – PDF Download

Brief Discussion:

First of all, I consider without any doubt this paper as one of the best papers ever read regarding the basics of cloud architectures. It describes in a clear, understandable language an example application that relys on the AWS infrastructure and does pattern-matching across millions of web documents – so this is a typical cloud scenario in which infrastructures such as AWS make sense. Jinesh uses within his example application the Hadoop framework, an open source distributed processing framework.

I pretty much like the simple structure of the paper – you get anything you need and it makes fun to read it! Especially for people who wonna know for what exactly AWS can be used for and who don’t know the difference between S3, SQS, SimpleDB, EC2 etc. this paper is highly recommended.

Some details about our recent 200km Ultra-Hike in the beautiful Altmühltal

Well, I was really astonished that so many people are interested in the details of our recent 200km ultra-hike. Hence, I will provide some details about this trip here:

Trail:
We have chosen to follow the “Altmühltal-Panoramaweg” which leads 200km from Gunzenhausen zu Krelheim. You can find some information about the trail here and here. In fact, all promises about the beauty of this trail are true – the nature is really incredible down there!

For navigation I can highly recommend this small cheap map – all information you need are included and the map has a handy size. Normally the trail is divided into 10 different parts which can be done within 10 days – first we decided to do the trail in 4 days but did it in the end in 3 days which can be quite exhausting for untrained guys like me. Anyway, be aware that some parts also contain about 30km/day if you decide to walk it in 10 days.

Distances:
We did the following distances/day:

• 1. Day: 45 km
• 2. Day: 50 km
• 3. Day: 105 km

I have to add that our luggage was about 5-6 kg for each of us while my colleague carried a little bit more due to the size of his backpack. You shouldn’t try to do these distances with heavy luggage! Water can be easily bought at various kiosks, restaurants etc.

The biggest issue with such distances in a row is the fact that you suffer from the efforts you made the days before. This means, after the first day you have to try hard to recover in one night! Hence, don’t drink any alcohol … and stick to water and iso-drinks.

The 40s and 50s km distances can be done easily compared to the last one which is in fact a long walk. We did the first part in 18 hours, slept for 5 hours before doing the rest in 7 hours. 105 km in 30 hours is possible … as it seems.

All in all, the trip was a great experience and I can highly recommend to walk such distances once in a lifetime. You will definitively regret it during the trip but in the end the feeling of “I did it!” is awesome.

Cloud Security Is Not (Just) Virtualization Security

Cloud Security Is Not (Just) Virtualization Security

Abstract:

Cloud infrastructure commonly relies on virtualization. Customers provide their own VMs, and the cloud provider runs them often without knowledge of the guest OSes or their configurations. However, cloud customers also want effective and efficient security for their VMs. Cloud providers offering security-as-a-service based on VM introspection promise the best of both worlds: efficient centralization and effective protection. Since customers can move images from one cloud to another, an effective solution requires learning what guest OS runs in each VM and securing the guest OS without relying on the guest OS functionality or an initially secure guest VM state.

We present a solution that is highly scalable in that it (i) centralizes guest protection into a security VM, (ii) supports Linux and Windows operating systems and can be easily extended to support new operating systems, (iii) does not assume any a-priori semantic knowledge of the guest, (iv) does not require any a-priori trust assumptions into any state of the guest VM. While other introspection monitoring solutions exist, to our knowledge none of them monitor guests on the semantic level required to effectively support both white- and black-listing of kernel functions, or allows to start monitoring VMs at any state during run-time, resumed from saved state, and cold-boot without the assumptions of a secure start state for monitoring.

Information:

Short Paper by Mihai Christodorescu, Reiner Sailer, Douglas Schales, Daniele Sgandurra, Diego Zamboni – accepted paper at CCSW’09 – PDF Download and Slides Download

Brief Discussion:

The authors describe an architecture for securing the customers’ virtualized workloads in cloud settings. This is done by a proposed, secure version of virtual machine introspection which does not make any assumptions about the running state of the guest VM and no assumptions about its integrity. Virtual introspection is obviously quite popular by current research papers as it can be used for various intentions – though it is nothing real new.

Anyway, I pretty much like the idea of identifying the guest OS within the VM. In the paper, no network-based approach (e.g. with nmap) is used but the interrupt handlers which obviously vary significantly across different OS types. Unfortunately, the privacy aspect has been totally omitted by the authors: What kind of eventually privacy critical information could leak by using such approach? As a customer, I don’t want my CSP to know all processes running within the VM. Of course, from a theoretical point of view, the CSP can look into the VM anytime he wants – but we should expect him not to do so. However, if I officially authorize him to do so in order to protect my VM from rootkits etc. there will probably some privacy issues. Hence, I guess there could be some research about how the CSP could protect me but still respects the privacy of my data and processes.

Details about the Kolinpolku Trail in Finnland

Intro:
Earlier this year, in April 2011, I walked the Kolinpolku Trail in Finnland together with a friend of mine. Prior to that, I tried to find some detailed information about this pretty awesome but almost unknown trail near Joensuu and I had to realize that there are no informative websites in english. Therefore, I’d like to provide you some details about the Kolinpolku trail and it’s surroundings.

Trail:
The Kolinpolku trail is about 63 km long and runs directly through the Koli National Park. Officially, the trail starts at the gas station north-east of Joensuu called Uuro. However, you can also start walking directly from the airport as we did. You can reach the gas station within one day from the airport but you should try to find a suitable path for walking – we walked random trails by using the GPS.

After the official starting point, the trail is pretty well marked and, as stated also on other websites, it’s almost impossible to get lost. However, there are some places where the marks are harder to find so you should always ask yourself “where did I see the last mark?”. If you can’t answer the question, go back to find one. I’d say that you don’t need a map, but a GPS for emergency cases could perhaps be useful. We heard a story of a couple who got lost on the trail before it has been marked as it is today. Especially in early summer/winter (yes, also late April) you will eventually find plenty of snow making the search for marks a rough job.

Above, I uploaded the high-resolution overview map of Joensuu and the north-east region. There, you can also find Uuro where the starting point for the Kolinpolku is located. Below, you find a typical picture of the trail – almost the complete trail runs on paths like this one:

Distances:
As mentioned above, the trail is officially 63 km long. On the map below which you can also find at the Uuro gas station, the trail is 70 km long. Anyway, it is separated into 6 different stages:

1. Uuro –> Urkkalampi: 20 km
2. Urkkalampi –> Hautajärvi: 10 km
3. Hautajärvi –> Ahvenlampi: 8 km
4. Ahvenlampi –> Kiviniemi: 5 km
5. Kiviniemi –> Ryläys: 10 km
6. Ryläys –> Koli: 10 km

If you wonna do the trail without a map/GPS etc., you’ll find marks like this one each 5 to 10 km:

Huts:
After each stage, you’ll find pretty awesome huts on the trail each one equipped with plenty of wood and several sleeping opportunities. At the time of year we’ve been there, no other trekkers were on the trail making the whole trip a place of peace and silence. I don’t know what happens if you do the trail during summer season, but I hope/guess this will hardly change. Here is a foto of a typical hut (Urkkalampi):

Inside one of these huts:

Starting Point Uuro:
The gas station at Uuro looks like this and sells all kinds of food, drinks and gas. At the time of walking (April 2011), the gas station does not sell any kind of camping gas etc.

The GPS coordinates for the gas station are:     N62 42.902 E29 51.282
On Google Maps: here

Urkkalampi Wilderness Trail:
Near the Urkkalampi hut, you have the chance to leave the Kolinpolku for some hours and do a wilderness/nature round trip enjoying the beautiful nature. You find a map below:

The GPS coordinates of Urkkalampi are:     N62 49.985 E30 00.563

Endpoint Koli:
We first thought that Koli is a small village or even a town – in fact it isn’t. It’s just a hotel on the top of the mountain providing an awesome view almost till Russia. Furthermore, the region is pretty prepared for tourism and contains a lot of paths, places etc. In winter, the place seems to be totally crowded with people coming for skiing. You can find a high-resolution map of the area around Koli below.

If you don’t wonna spend your night in the (expensive??) hotel, you can stay at a camping site just 15 minutes down the mountain – GPS coordinates:    N63 06.184 E29 47.507

Food/Water:
You can easily get water from the lakes and rivers on the trail. We did the same and we are still alive. The last chance to get food is the gas station in Uuro or you better go to the supermarket in Joensuu. At the hotel in Koli you can buy some snacks or you go directly to the restaurant, enjoy a cold beer and a beautiful view.

References:
As I mentioned earlier, as far as I know, there aren’t any comprehensive websites providing detailed information about the Kolinpolku trail. However, I did find some sites which where quite helpful.

http://www.vaellus.info/eng_inbrief.php
http://translate.google.de/translate?js=n&prev=_t&hl=de&ie=UTF-8&layout=2&eotf=1&sl=fi&tl=en&u=http%3A%2F%2Fwww.vaellus.info%2Freittitarkennus.php%3Fid%3D0410081015253FC1
http://s339.photobucket.com/albums/n475/mukamuki/kolinpolku09/?start=all
http://www.outdoors.fi/destinations/nationalparks/koli/trails/Pages/Default.aspx

Book Review: Cloud Computing and Software Services

Recently, I finished reading the book by Ahson and Ilyas “Cloud Computing and Software Services – Theory and Techniques” for the IACR Book review. Although the cover affects to be a security related book, it isn’t. Anyway, it was a nice and interesting read especially for guys interested in the technical and architectural details of current cloud environments.

You can download the PDF with my review here or have a look at the IACR homepage soon: book-review-iacr2011

Forensic investigation of cloud computing systems

Forensic investigation of cloud computing systems

Abstract:

Cloud computing describes a computing concept where software services, and the resources they use, operate as (and on) a virtualised platform across many different host machines, connected by the Internet or an organisation’s internal network. From a business or system user’s point of view, the cloud provides, via virtualisation, a single platform or service collection in which it can operate.

Information:

Mark Taylor, John Haggerty, David Gresty, David Lamb – PDF Download

Brief Discussion:

The article discusses the issues of forensic investigations in distributed cloud systems and focusses especially on the UK jurisdiction. The authors also state that more secure authentication could be an advantage for forensic analysts e.g. if public key crypto is used and non-repudiation is given. Of course, till a given point this is true but we shouldn’t forget malware infected client systems. Interestingly, the paper includes also the need for suitable audit trails in SaaS cloud environments – a pretty interesting topic which I also focus on currently.
The paper can be seen as an overview paper giving a more or less comprehensive overview of the issues.

Privacy and Artificial Agents, or, Is Google Reading My Email?

Privacy and Artificial Agents, or, Is Google Reading My Email?

Abstract:

We investigate legal and philosophical notions of privacy in the context of artificial agents. Our analysis utilizes a normative account of privacy that defends its value and the extent to which it should be protected: privacy is treated as an interest with moral value, to supplement the legal claim that privacy is a legal right worthy of protection by society and the law. We argue that the fact that the only entity to access my personal data (such as email) is an artificial agent is irrelevant to whether a breach of privacy has occurred. What is relevant are the capacities of the agent: what the agent is both able and empowered to do with that information. We show how concepts of legal agency and attribution of knowledge gained by agents to their principals are crucial to understanding whether a violation of privacy has occurred when artificial agents access users’ personal data. As natural language processing and semantic extraction used in artificial agents become increasingly sophisticated, so the corporations that deploy those agents will be more likely to be attributed with knowledge of their users’ personal information, thus triggering significant potential legal liabilities.

Information:

Samir Chopra, Laurence White – PDF Download

Brief Discussion:

It is an interesting discussion whether privacy can be violated if humans do not read your private communications. This is exactly what Google is saying: Human intelligence is not involved in processing user information and data and hence, privacy is not violated. In the paper, this topic is discussed in a more philosophical manner making the paper pretty worth reading.

Bigtable: A Distributed Storage System for Structured Data

The people who are interested in the system infrastructure of Google applications should read: “Bigtable: A Distributed Storage System for Structured Data” by some Google folks. They describe a simple data model provided by Bigtable, which gives clients dynamic control over data layout and format – design and implementation of Bigtable is also discussed.

The paper is pretty easy to follow and offers some interesting background information such as the automatic garbage-collection offered by Bigtable. It also discusses the different fields of application such as Google Analytics, Google Earth etc…

By the way: Did you know that Google uses Bigtable since April 2005 and spent roughly seven person-years on design and implementation before that date? Impressive!

Cloud Security Concerns of the new NIST Cloud Computing Security Working Group (NCC-SWG)

I just came across this interesting website offered by the NIST Cloud Computing Security Working Group (NCC-SWG): http://collaborate.nist.gov/twiki-cloud-computing/bin/view/CloudComputing/CloudSecurity

You should definitively have a look at the offered documents – especially this one containing the Cloud Security Concerns of the NCC-SWG:

1.  Potential Loss of Control/Ownership of Data

2.  Data Integration, Privacy Enforcement, Data Encryption

3.  Security Concerns are Identified Threats – CSA’s Top Threats (7)

4.  Data Remnence after de-provisioning

5. Multi Tenant Data Isolation

6. Data Location Requirements (within national borders)

7.  Hypervisor Security

8. Audit Data Integrity Protection

9. Ensuring Verification of Subscriber policies (including regulatory needs) through Provider controls

10.  Certification/Accreditation Requirements for a given Cloud Service

If you are monitoring the activities of CSA and ENISA, you should add this one to your bookmarks.

Content Cloacking: Preserving Privacy with Google Docs and other Web Applications

“Content Cloacking: Preserving Privacy with Google Docs and other Web Applications” is a paper by Gabriele D’Angelo et al published in the proceedings of the 2010 ACM Symposium on Applied Computing (SAC’10). It is about content cloacking, a lightweight, cryptographic, client-side solution to protect content from data holders while using web office suites and other Web 2.0, AJAX-based, collaborative applications. The approach is pretty much straightforward – a third layer is established between the user and the server which encrypts and decrypts all sensible data before it is pushed into the Internet. The authors only focus on symmetric encryption based on AES but also mention the possibility to implement further group key agreement based protocols – btw. that would be awesome. The PoC source code can be downloaded here.

Paper – Digital Forensics Research: The next 10 years

It is quite interesting what Simson L. Garfinkel published in his article “Digital Forensics Research: The next 10 years” last year at DFRWS 2010. He argues that the “Golden Age of Digital Forensics” is over now and hence, new issues with digital forensics are coming up. During the time of the Golden Age, 1999-2007, DF became a kind of magic window that offered the ability to see into the past and into the criminal mind. This is over now. One reason for this situation is the fact, that very few DF systems designers build their tools upon previous work – instead, each new project starts fresh.

Garfinkel also mentioned the issue with Cloud Forensics in section 2.3.:

“Use of the cloud for remote processing and storage, and to split a single data structure into elements, means that frequently data or code cannot even be found.”

I totally agree … furthermore he states, that encryption and the use of cloud computing both threaten forensic visibility – and both in much the same way. I also agree, but the usage of strong encryption also offers several huge benefits which shouldn’t be neglegted. Generally, the paper discusses a lot of interesting aspects of DF and proposes several potential solutions which makes the article pretty worth reading.

Taking Part in the Amazon Research Grant

Recently, I received the message that my research proposal on “Cloud Forensics” was accepted by Amazon. Today, I received my AWS credits …

Fortunately, these credits are valid for two years instead of only one. However, at first I  have to get some deeper view into the not so popular services offered by AWS in order to know where I can start my research. For EC2, I’ve already specific ideas which only demand time to get realized. Additionally, I still search for joint projects with other researchers in the fields of Cloud Forensics – if you’re interested, please drop me an email. A summary of the general stuff I’m doing can be found here.

Find out more about the AWS Research Programme here and here – current grant holders can be viewed here.

Paper: Provenance for the Cloud

Kiran-Kumar Muniswamy-Reddy, Peter Macko and Margo Seltzer from the Harvard School of Engineering and Applied Sciences published a paper at the USENIX FAST 2010 named “Provenance for the Cloud”. This paper is probably a follow-up paper of “Provenance as First Class Cloud Data” discussed here.

In the paper, the authors examine current cloud offerings and design and implement three protocols for maintaining data/provenance in current cloud stores. They contribute to the definition of properties that provenance systems must exhibit and evaluate and compare the cost and performance of three provenance storage protocols. In the paper, the authors make use of the PASS system to collect provenance.

Conclusion: I like the discussion around data provenance in general … it is an interesting aspect which gets even more complicated in the fields of cloud computing.

Cloud Application Logging for Forensics

Raffael Marty, founder of loggly.com, recently published an interesting paper called “Cloud Application Logging for Forensics” which can be downloaded here. As stated in my last blog posting, there is currently a discussion going on whether logging in the cloud demands a new “logging standard”. The paper by Raffael provides some interesting aspects of logging in general.

Generally, the paper discusses a logging framework and guidelines that provide a proactive approach to logging to ensure that the data needed for a potential forensic investigation has been created and can be used, if needed. Unfortunately, Raffael primarily focusses on SaaS scenarios and neglects PaaS as well as IaaS. But he clearly elaborates why logging is an essential part of running applications in SaaS environments.

However, in section 4.1.3 I miss something: The ordinary web attack scenario should also be treated as a typical use-case besides considering login/logout, password changes, failed resource access and all activities executes by a privileged account (those are all mentioned in the paper). What about the activities executed by an unauthorized adversary? For instance, this could be a malicious HTTP-requests containing SQL-injection payload. If you don’t log this, you probably get a huge problem during the investigation phase.

Nevertheless, I enjoyed reading the paper – it provides a nice overview of logging aspects for SaaS and could probably be interesting for both customers and CSP.

Clash of Opinions: CloudLog RFC

There’s currently an interesting discussion going on whether a newly proposed RFC focussing on logging in the cloud makes sense or not. Raffael Marty of Loggly shares the opinion that it’s quite useless to define yet another logging standard. In contrast, Gene Golovinsky of Alertlogic is the author of the current 00 draft of the cloudlog RFC. Obviously, the US blogging scene is quite interested in this topic – several blogs published articles about this topic. We will see …

An Analysis of Black-box Web Vulnerability Scanners

“Why Johnny Can’t Pentest: An Analysis of Black-box Web Vulnerability Scanners” (PDF) written by A. Doupe, M. Cova and G. Vigna provides an evaluation of eleven black-box web vulnerability scanners, both commercial and open-source. The paper was presented at DIMVA 2010.

For testing purposes, the authors created a buggy web application named WackoPicko containing XSS, SQLi, code injection and some broken access control vulnerabilities.

The interesting question the authors focus on is whether current scanners are compliant with the technical circumstances of modern web applications. For instance, the crawling feature is arguably the most important part of a vulnerability scanner. If crawling fails, testing will automatically fail too. Moreover, the authors list HTML Parsing, Multi-Step processes, infinite websites and some others  as current challenges for scanners.
I’m a little bit astonished that the authors do not mention the Damn Vulnerable Web Application (DVWA) as a vulnerable test applications. Imho DVWA has widely been accepted and also included in the OWASP Broken Web Apps ISO.

Finally, the conclusion of the authors is what I expected:
“We found that eight out of sixteen vulnerabilities were not detected by any of the scanners. We have also found areas that require further research so that web application vulnerability scanners can improve their detection of vulnerabilities. Deep crawling is vital to discover all vulnerabilities in an application. Improved reverse engineering is necessary to keep track of the state of the application, which can enable automated detection of complex vulnerabilities.
Finally, we found that there is no strong correlation between cost of the scanner and functionality provided as some of the free or very cost-effective scanners performed as well as scanners that cost thousands of dollars.”