Protection

1. Protection • Protection= access control • Goals of protection • Protecting general objects • Example: file protection in Linux

2. Goals of Protection • Let’s say we have a valuable resource like an O.S. • collection of objects, hardware & software • Objects have unique names • Accessed through well-defined set of operations • Goals of protection: • Ensure each object accessed correctly & only by authorized processes according to some policy. • policy: statement of what states (and operations) are allowed (i.e., secure/authorized), and what are not allowed (i.e., nonsecure/unauthorized) for a specific system.

3. Protecting general objects • Objects • Memory • File/directory • Hardware device • Data structure (e.g., stack, table) • Instructions (e.g., privileged instructions) • Passwords • Protection mechanism itself

4. Protection Domains • Access-right = <object-name, rights-set> • Rights-set = subset of all valid operations that can be performed on the object • (i.e., the policy!) • Domain = set of access-rights

5. Access Matrix • Column: • defines who can perform what operation on the object • Row: • Operations allowed on what objects, per-domain

6. Implementation of Access Matrix • Access list for objects • Maintain <domain, right-set> list per object • Capability (object) list for domains • Maintain list of objects + operations per domain • Object name = capability • Check in capability list for access • Pros and cons of access list & capability list • Determine the set of access rights for each domain? • Revocation of capabilities?

7. Example: File protection in UNIX • Access control bits (UNIX) • Three categories of user (owner, group, world) • Three types of access privileges (read, write, execute) • One bit per operation (111101000 = rwxr-x----) • Domain is implemented as the “user-id” • OS can do domain switching to execute some task • accomplished via file system • Each file has associated domain bit (setuid bit) • When file executed and setuid=on,user-id set to owner of the file being executed • When execution completes, user-id is reset • “ps” is a setuid program, as is “lpr”.

8. Security • The Security Problem • Program Threats • System & Network Threats • Counter-measures to Threats • Threat Monitoring • Cryptography

9. Security problem • Confidentiality: ensuring objects are available/understandable only to authorized peers • E.g., no unauthorized read access • Integrity: ensuring objects have not been maliciously or accidentally modified. • No introduction of inconsistency. • Availability: ensuring objects are available without delay and operate correctly (to authorized peers) • No malicious destruction of resources (i.e., objects)

10. Threats • Program Threats: • program cause security breaches • Trojan Horse, Login Spoofing, Trap/Back Door, Stack/Buffer Overflow, Virus • System & Network Threats: • Abuse services and network connection to cause security breaches • Worms, Port Scanning, (Distributed) Denial of Service

11. Trojan Horse • Code (segment) that misuses its environment. • Objective of Trojan • Get executed by someone • Once executed copy/mail/modify some critical files • Example: • In /tmp put a program named ls • Administrator goes to /tmp, types ls... • If the path “.” is in front of his search path... Bingo!

12. Login Spoofing • Write a fake login program • Fake program shows the usual login prompt.... • Unsuspecting user comes in and tries to log in • Types loginID • Types password • The Spoof login store the pair away and terminates • Normal logins come back up • User simply thinks he mistyped his password... • In the meantime, the attacker found a valid pair!

13. Trap Doors • Modification at the source level • Programmer introduces a loophole to bypass the login process. • Loophole ignores password for a specific login • Who can use it? (programmer, attacker) • How to prevent it... • Code review • Sometimes in compiler (very difficult)

14. Buffer Overflow Stack • Bug in a program • Program overstep some array bounds • Overwrites return address • When subroutine returns, it effectively jumps someplace else.... Main's Local Variables Return Address Foo()'s local var Fixed Sized-Array

15. Buffer Overflow Stack • Bug in a program • Program overstep some array bounds • Overwrites return address • When subroutine returns, it effectively jumps someplace else.... Main's Local Variables Return Address Foo()'s local var Long string that overflows... It wipes out the return address

16. Buffer Overflow Stack • Bug in a program • Program overstep some array bounds • Overwrites return address • When subroutine returns, it effectively jumps someplace else.... Main's Local Variables Return Address Foo()'s local var Long string that overflows... It wipes out the return address If string is well aligned with place of return address, it can be a meaninfull address

17. Buffer Overflow Stack • Bug in a program • Program overstep some array bounds • Overwrites return address • When subroutine returns, it effectively jumps someplace else.... Main's Local Variables Malicious Code! Return Address Foo()'s local var Long string that overflows... It wipes out the return address If string is well aligned with place of return address... It can be a meaninfull address

18. Virus • Self-reproducing • Attach to host machine • Dormant for a while • Activate at some point and • Destroy • Steal • Spreading via • Program copying, Email, Web-pages, …

19. Worms • Slightly different from virus • Self-reproduces; take up resources • Do not need a host-program • Use vulnerabilities to spread across the net • Break system through infestation; worst outbreak can take worldwide networks down. • Worms propagate themselves; Virus require action by the user to perpetuate themselves • Example: Morris Worms, CodeRed

20. Other System & Network Threats • Port scanning • Automated attempt to connect to a range of ports on one or a range of IP addresses • Denial of Service • Overload the targeted computer preventing it from doing any useful work • Distributed denial-of-service (DDOS) come from multiple sites at once