Computer Security Exam
Malikbinn
CPSC353PowerPoints-A.zipCh03-BufferOverflow.pptx
Buffer Overflow Attacks
1
2009-01-28
Operating Systems: Basic Concepts
CS 166
What is an Exploit?
An exploit is any input (i.e., a piece of software, an argument string, or sequence of commands) that takes advantage of a bug, glitch or vulnerability in order to cause an attack
An attack is an unintended or unanticipated behavior that occurs on computer software, hardware, or something electronic and that brings an advantage to the attacker
10/13/10
Buffer Overflow
2
not necessarily a program... while it can be a program that communicates bad input to a vulnerable piece of software, it can also be just the bad input itself... any bad input (or even valid input that the developer just failed to anticipate) can cause the vulnerable application to behave improperly...
Operating Systems: Basic Concepts
2009-01-28
CS 166
2
Buffer Overflow Attack
One of the most common OS bugs is a buffer overflow
The developer fails to include code that checks whether an input string fits into its buffer array
An input to the running process exceeds the length of the buffer
The input string overwrites a portion of the memory of the process
Causes the application to behave improperly and unexpectedly
Effect of a buffer overflow
The process can operate on malicious data or execute malicious code passed in by the attacker
If the process is executed as root, the malicious code will be executing with root privileges
10/13/10
Buffer Overflow
3
3
Because of the nature of the address space, locally declared buffers are allocated on the stack
Since the stack grows downward, if you write past the end of the buffer, you can corrupt the content of the rest of the stack, thus, if enough information is known about the program, one could write over known register information and the return address
2009-01-28
Operating Systems: Basic Concepts
CS 166
Address Space
Every program needs to access memory in order to run
For simplicity sake, it would be nice to allow each process (i.e., each executing program) to act as if it owns all of memory
The address space model is used to accomplish this
Each process can allocate space anywhere it wants in memory
Most kernels manage each process’ allocation of memory through the virtual memory model
How the memory is managed is irrelevant to the process
10/13/10
Buffer Overflow
4
4
This would also be consistent with the process model proposed earlier where each process feels like it “owns” the machine. The size of the address space is machine dependent, until the Intel 386 came around, most address spaces were 16 bit, for most of the past 15 years, we have been sing 32 bit machines, though increasingly larger number of processors with 64 bit modes are making their way into people’s computers.
2009-01-28
Operating Systems: Basic Concepts
CS 166
Virtual Memory
Mapping virtual addresses to real addresses
10/13/10
Buffer Overflow
5
Another
Program
Hard Drive
Program Sees
Actual Memory
Unix Address Space
Text: machine code of the program, compiled from the source code
Data: static program variables initialized in the source code prior to execution
BSS (block started by symbol): static variables that are uninitialized
Heap : data dynamically generated during the execution of a process
Stack: structure that grows downwards and keeps track of the activated method calls, their arguments and local variables
10/13/10
Buffer Overflow
6
Low Addresses
0x0000 0000
High Addresses
0xFFFF FFFF
Stack
Heap
BSS
Data
Text
Vulnerabilities and Attack Method
Vulnerability scenarios
The program has root privileges (setuid) and is launched from a shell
The program is part of a web application
Typical attack method
Find vulnerability
Reverse engineer the program
Build the exploit
10/13/10
Buffer Overflow
7
Buffer Overflow Attack in a Nutshell
First described in
Aleph One. Smashing The Stack For Fun And Profit. e-zine www.Phrack.org #49, 1996
The attacker exploits an unchecked buffer to perform a buffer overflow attack
The ultimate goal for the attacker is getting a shell that allows to execute arbitrary commands with high privileges
Kinds of buffer overflow attacks:
Heap smashing
Stack smashing
10/13/10
Buffer Overflow
8
Buffer Overflow
Retrieves domain registration info
e.g., domain brown.edu
10/13/10
Buffer Overflow
9
domain.c
Main(int argc, char *argv[ ])
/* get user_input */
{
char var1[15];
char command[20];
strcpy(command, “whois ");
strcat(command, argv[1]);
strcpy(var1, argv[1]);
printf(var1);
system(command);
}
Top of
Memory
0xFFFFFFFF
Bottom of
Memory
0x00000000
.
.
.
Stack
Fill
Direction
var1 (15 char)
command
(20 char)
strcpy() Vulnerability
argv[1] is the user input
strcpy(dest, src) does not check buffer
strcat(d, s) concatenates strings
10/13/10
Buffer Overflow
10
domain.c
Main(int argc, char *argv[])
/*get user_input*/
{
char var1[15];
char command[20];
strcpy(command, “whois ");
strcat(command, argv[1]);
strcpy(var1, argv[1]);
printf(var1);
system(command);
}
var1 (15 char)
command
(20 char)
argv[1] (15 char)
argv[1] (20 char)
Top of
Memory
0xFFFFFFFF
Bottom of
Memory
0x00000000
.
.
.
Stack
Fill
Direction
Overflow
exploit
strcpy() vs. strncpy()
Function strcpy() copies the string in the second argument into the first argument
e.g., strcpy(dest, src)
If source string > destination string, the overflow characters may occupy the memory space used by other variables
The null character is appended at the end automatically
Function strncpy() copies the string by specifying the number n of characters to copy
e.g., strncpy(dest, src, n); dest[n] = ‘\0’
If source string is longer than the destination string, the overflow characters are discarded automatically
You have to place the null character manually
10/13/10
Buffer Overflow
Return Address Smashing
The Unix fingerd() system call, which runs as root (it needs to access sensitive files), used to be vulnerable to buffer overflow
Write malicious code into buffer and overwrite return address to point to the malicious code
When return address is reached, it will now execute the malicious code with the full rights and privileges of root
10/13/10
Buffer Overflow
12
void fingerd (…) {
char buf[80];
…
get(buf);
…
}
current frame
previous frames
f() arguments
buffer
local variables
program code
program code
next location
padding
attacker’s input
malicious code
return address
f() arguments
EIP
return address
EIP
12
The fragment of C code for fingerd() above shows the problem
A local array buf[80] is declared, which gets allocated on the stack, but the function get does not do bounds checking, and hence makes buffer overflows possible.
2009-01-28
Operating Systems: Basic Concepts
CS 166
Unix Shell Command Substitution
The Unix shell enables a command argument to be obtained from the standard output of another
This feature is called command substitution
When parsing command line, the shell replaces the output of a command between back quotes with the output of the command
Example:
File name.txt contains string farasi
The following two commands are equivalent
finger `cat name.txt`
finger farasi
10/13/10
Buffer Overflow
13
Shellcode Injection
An exploit takes control of attacked computer so injects code to “spawn a shell” or “shellcode”
A shellcode is:
Code assembled in the CPU’s native instruction set (e.g. x86 , x86-64, arm, sparc, risc, etc.)
Injected as a part of the buffer that is overflowed.
We inject the code directly into the buffer that we send for the attack
A buffer containing shellcode is a “payload”
10/13/10
14
Buffer Overflow
14
Now comes the question of injecting our own code to be executed. We inject the code directly into the buffer that we send for the attack.
Buffer Overflow Mitigation
We know how a buffer overflow happens, but why does it happen?
This problem could not occur in Java; it is a C problem
In Java, objects are allocated dynamically on the heap (except ints, etc.)
Also cannot do pointer arithmetic in Java
In C, however, you can declare things directly on the stack
One solution is to make the buffer dynamically allocated
Another (OS) problem is that fingerd had to run as root
Just get rid of fingerd’s need for root access (solution eventually used)
The program needed access to a file that had sensitive information in it
A new world-readable file was created with the information required by fingerd
10/13/10
Buffer Overflow
15
15
Why doesn’t get do a bounds check and why does the operating system allow writing beyond the array bounds?
In Java can’t just overwrite the stack because you don’t know where the stack is!
In Java, cannot access memory without direct access, since we lack pointer arithmetic
2009-01-28
Operating Systems: Basic Concepts
CS 166
Stack-based buffer overflow detection using a random canary
The canary is placed in the stack prior to the return address, so that any attempt to over-write the return address also over-writes the canary.
10/13/10
Buffer Overflow
16
Buffer
Other local variables
Canary (random)
Return address
Other data
Buffer
Corrupt return address
Attack code
Normal (safe) stack configuration:
Buffer overflow attack attempt:
Overflow data
x
Ch03-OS.pptx
Operating Systems Concepts
1
1
10/13/10
Introduction
A Computer Model
An operating system has to deal with the fact that a computer is made up of a CPU, random access memory (RAM), input/output (I/O) devices, and long-term storage.
2
Disk Drive
RAM
CPU
0
1
2
3
4
5
6
7
8
9
.
.
.
I/O
OS Concepts
An operating system (OS) provides the interface between the users of a computer and that computer’s hardware.
An operating system manages the ways applications access the resources in a computer, including its disk drives, CPU, main memory, input devices, output devices, and network interfaces.
An operating system manages multiple users.
An operating system manages multiple programs.
3
Multitasking
Give each running program a “slice” of the CPU’s time.
The CPU is running so fast that to any user it appears that the computer is running all the programs simultaneously.
4
Public domain image from http://commons.wikimedia.org/wiki/File:Chapters_meeting_2009_Liam_juggling.JPG
The Kernel
The kernel is the core component of the operating system. It handles the management of low-level hardware resources, including memory, processors, and input/output (I/O) devices, such as a keyboard, mouse, or video display.
Most operating systems define the tasks associated with the kernel in terms of a layer metaphor, with the hardware components, such as the CPU, memory, and input/output devices being on the bottom, and users and applications being on the top.
5
User Applications
Non-essential OS Applications
The OS Kernel
CPU, Memory, Input/Output
Userland
Operating System
Hardware
Input/Output
The input/output devices of a computer include things like its keyboard, mouse, video display, and network card, as well as other more optional devices, like a scanner, Wi-Fi interface, video camera, USB ports, etc.
Each such device is represented in an operating system using a device driver, which encapsulates the details of how interaction with that device should be done.
The application programmer interface (API), which the device drivers present to application programs, allows those programs to interact with those devices at a fairly high level, while the operating system does the “heavy lifting” of performing the low-level interactions that make such devices actually work.
6
System Calls
7
User applications don’t communicate directly with low-level hardware components, and instead delegate such tasks to the kernel via system calls.
System calls are usually contained in a collection of programs, that is, a library such as the C library (libc), and they provide an interface that allows applications to use a predefined series of APIs that define the functions for communicating with the kernel.
Examples of system calls include those for performing file I/O (open, close, read, write) and running application programs (exec).
Processes
A process is an instance of a program that is currently executing.
The actual contents of all programs are initially stored in persistent storage, such as a hard drive.
In order to be executed, a program must be loaded into random-access memory (RAM) and uniquely identified as a process.
In this way, multiple copies of the same program can be run as different processes.
For example, we can have multiple copies of MS Powerpoint open at the same time.
8
Process IDs
Each process running on a given computer is identified by a unique nonnegative integer, called the process ID (PID).
Given the PID for a process, we can then associate its CPU time, memory usage, user ID (UID), program name, etc.
9
File Systems
A filesystem is an abstraction of how the external, nonvolatile memory of the computer is organized.
Operating systems typically organize files hierarchically into folders, also called directories.
Each folder may contain files and/or subfolders.
Thus, a volume, or drive, consists of a collection of nested folders that form a tree.
The topmost folder is the root of this tree and is also called the root folder.
10
File System Example
11
File Permissions
File permissions are checked by the operating system to determine if a file is readable, writable, or executable by a user or group of users.
In Unix-like OS’s, a file permission matrix shows who is allowed to do what to the file.
Files have owner permissions, which show what the owner can do, and group permissions, which show what some group id can do, and world permissions, which give default access rights.
12
Memory Management
The RAM memory of a computer is its address space.
It contains both the code for the running program, its input data, and its working memory.
For any running process, it is organized into different segments, which keep the different parts of the address space separate.
As we will discuss, security concerns require that we never mix up these different segments.
13
Memory Organization
Text. This segment contains the actual (binary) machine code of the program.
Data. This segment contains static program variables that have been initialized in the program code.
BSS. This segment, which is named for an antiquated acronym for block started by symbol, contains static variables that are uninitialized.
Heap. This segment, which is also known as the dynamic segment, stores data generated during the execution of a process.
Stack. This segment houses a stack data structure that grows downwards and is used for keeping track of the call structure of subroutines (e.g., methods in Java and functions in C) and their arguments.
14
Memory Layout
15
Virtual Memory
There is generally not enough computer memory for the address spaces of all running processes.
Nevertheless, the OS gives each running process the illusion that it has access to its complete (contiguous) address space.
In reality, this view is virtual, in that the OS supports this view, but it is not really how the memory is organized.
Instead, memory is divided into pages, and the OS keeps track of which ones are in memory and which ones are stored out to disk.
16
ATM
Page Faults
17
Process
1. Process requests virtual address not in memory,
causing a page fault.
2. Paging supervisor pages out
an old block of RAM memory.
3. Paging supervisor locates requested block
on the disk and brings it into RAM memory.
“read 0110101”
“Page fault,
let me fix that.”
Blocks in
RAM memory:
Paging supervisor
External disk
old
new
Virtual Machines
Virtual machine: A view that an OS presents that a process is running on a specific architecture and OS, when really it is something else. E.g., a windows emulator on a Mac.
Benefits:
Hardware Efficiency
Portability
Security
Management
18
Public domain image from http://commons.wikimedia.org/wiki/File:VMM-Type2.JPG
Stack
Dynamic
BSS
Data
Text
Another Program
Hard Drive
Program Sees: Actual Memory:
Ch04-Malware.pptx
Malware: Malicious Software
10/21/2010
Malware
1
1
2009-02-02
CS 166 - Malware
Viruses, Worms, Trojans, Rootkits
Malware can be classified into several categories, depending on propagation and concealment
Propagation
Virus: human-assisted propagation (e.g., open email attachment)
Worm: automatic propagation without human assistance
Concealment
Rootkit: modifies operating system to hide its existence
Trojan: provides desirable functionality but hides malicious operation
Various types of payloads, ranging from annoyance to crime
10/21/2010
Malware
2
2
Name derives from the wooden horse left by the Greeks at the gates of Troy during the siege of Troy
A Trojan horse program intentionally hides malicious activity while pretending to be something else
Usually described as innocuous looking, or software delivered through innocuous means which either allows to take control of systems
Trojan horse programs do not replicate themselves
Sometimes passed on using commonly passed executables, things like jokes forwarded by e-mail
Sometimes marketed/distributed as “remote administration tool”
Often combined with rootkits to disguise activity and remote access
Popularized to an extent by software like Cult of the Dead Cow’s Back Orifice, offered as a free download for running “remote administration” tasks or playing spooky jokes on friends
The line between user-launched worms and Trojans is highly blurred, with many user-launched worms behaving in a manner similar to worms.
Trojans are by definition malicious. The classic movie/television exploit of remotely opening disk drives is a definite symptom of being infected by a Trojan.
Have lately begun using much of the same defense mechanisms used by viruses, there are known Trojans which use WSH to run.
To detect infected computers, attackers often use so called sweep lists, list of IP addresses known to be online. One of the popular ways of doing this is to monitor IRC chat rooms and use the IP addresses of participants in these rooms.
Payload examples
perform amusing or annoying pranks
destroy/corrupt files and applications
monitor and transmit user activity (spyware, logger)
install backdoor (makes the infected computer a zombie)
email spam
launch denial-of-service attack
alter browser settings to display ads
dial out international or 900 numbers (dialer)
2009-02-02
CS 166 - Malware
Insider Attacks
An insider attack is a security breach that is caused or facilitated by someone who is a part of the very organization that controls or builds the asset that should be protected.
In the case of malware, an insider attack refers to a security hole that is created in a software system by one of its programmers.
10/21/2010
Malware
3
Backdoors
A backdoor, which is also sometimes called a trapdoor, is a hidden feature or command in a program that allows a user to perform actions he or she would not normally be allowed to do.
When used in a normal way, this program performs completely as expected and advertised.
But if the hidden feature is activated, the program does something unexpected, often in violation of security policies, such as performing a privilege escalation.
Benign example: Easter Eggs in DVDs and software
10/21/2010
Malware
4
Logic Bombs
A logic bomb is a program that performs a malicious action as a result of a certain logic condition.
The classic example of a logic bomb is a programmer coding up the software for the payroll system who puts in code that makes the program crash should it ever process two consecutive payrolls without paying him.
Another classic example combines a logic bomb with a backdoor, where a programmer puts in a logic bomb that will crash the program on a certain date.
10/21/2010
Malware
5
The Omega Engineering Logic Bomb
An example of a logic bomb that was actually triggered and caused damage is one that programmer Tim Lloyd was convicted of using on his former employer, Omega Engineering Corporation. On July 31, 1996, a logic bomb was triggered on the server for Omega Engineering’s manufacturing operations, which ultimately cost the company millions of dollars in damages and led to it laying off many of its employees.
10/21/2010
Malware
6
The Omega Bomb Code
The Logic Behind the Omega Engineering Time Bomb included the following strings:
7/30/96
Event that triggered the bomb
F:
Focused attention to volume F, which had critical files
F:\LOGIN\LOGIN 12345
Login a fictitious user, 12345 (the back door)
CD \PUBLIC
Moves to the public folder of programs
FIX.EXE /Y F:\*.*
Run a program, called FIX, which actually deletes everything
PURGE F:\/ALL
Prevent recovery of the deleted files
10/21/2010
Malware
7
Defenses against Insider Attacks
Avoid single points of failure.
Use code walk-throughs.
Use archiving and reporting tools.
Limit authority and permissions.
Physically secure critical systems.
Monitor employee behavior.
Control software installations.
10/21/2010
Malware
8
Computer Viruses
A computer virus is computer code that can replicate itself by modifying other files or programs to insert code that is capable of further replication.
This self-replication property is what distinguishes computer viruses from other kinds of malware, such as logic bombs.
Another distinguishing property of a virus is that replication requires some type of user assistance, such as clicking on an email attachment or sharing a USB drive.
10/21/2010
Malware
9
Biological Analogy
Computer viruses share some properties with Biological viruses
10/21/2010
Malware
10
Attack
Penetration
Replication and assembly
Release
Early History
1972 sci-fi novel “When HARLIE Was One” features a program called VIRUS that reproduces itself
First academic use of term virus by PhD student Fred Cohen in 1984, who credits advisor Len Adleman with coining it
In 1982, high-school student Rich Skrenta wrote first virus released in the wild: Elk Cloner, a boot sector virus
(c)Brain, by Basit and Amjood Farooq Alvi in 1986, credited with being the first virus to infect PCs
10/21/2010
Malware
11
Much of the macro classification carries over from viruses, worms based on macro capabilities of programs are programmed in much the same way as viruses, with minor differences
Primary classification has often been based on a worm relying on e-mail or IRC, ICQ, AIM.
Through much of the mid-90s IRC was a popular target, and worms were often combined with Trojans to allow for remotely controlling systems
Examples include IRC.Worm.Ceyda and IRC.Worm.Whacked, the later of which is also a Trojan
Simultaneously with a growth in instant messaging, popular IM clients have been targeted by worms
There are known worms targeting AIM (W32.AimVen.Worm), MSN (W32.Kelvir and variants), ICQ (W32.Bizex), Yahoo Messenger (W32.Hawawi) and pretty much every other popular IM network
P2P networks have been targeted of late, with W32.Hawawi and others spreading through Kazza
E-mail, exploited indirectly by the Morris Worm continues to be a popular propagation method, with worms like W97M.Melissa, and W32.Navidad relying on MAPI to provide them with an easy way to e-mail themselves out.
CS 166 - Malware
2009-02-02
11
Virus Phases
Dormant phase. During this phase, the virus just exists—the virus is laying low and avoiding detection.
Propagation phase. During this phase, the virus is replicating itself, infecting new files on new systems.
Triggering phase. In this phase, some logical condition causes the virus to move from a dormant or propagation phase to perform its intended action.
Action phase. In this phase, the virus performs the malicious action that it was designed to perform, called payload.
This action could include something seemingly innocent, like displaying a silly picture on a computer’s screen, or something quite malicious, such as deleting all essential files on the hard drive.
10/21/2010
Malware
12
Infection Types
Overwriting
Destroys original code
Pre-pending
Keeps original code, possibly compressed
Infection of libraries
Allows virus to be memory resident
E.g., kernel32.dll
Macro viruses
Infects MS Office documents
Often installs in main document template
10/21/2010
Malware
13
virus
compressed
original code
Resident viruses continue running after executing the infected file
Modified system calls
Modified DLLs
Non-resident viruses
Resident viruses are more common than non-resident viruses, and essentially latch onto system calls, DLLs and the like, and stay resident, affecting every program run subsequent to them being introduced into memory.
Non resident viruses are executed every time an infected file is executed
All Windows DLLs have an export table listing the functions provided and their addresses
A virus can hook onto a DLL
Fairly easy for viruses using DLLs to get memory resident
kernel32.dll is a collection of core Windows API calls (system calls) that is imported by most applications
Most viruses relying on patching DLLs usually attack kernel32.dll
For instance W32.Kriz will attack any PE executable, and also kernel32.dll to get a hook on system calls
Hooking system calls may be done by legitimate programs, such as Regmon (a registry monitoring utility)
Viruses hook onto DLLs by either changing their exported symbol table, so as to call malicious code, or by adding mallicious code to the DLL.
CS 166 - Malware
2009-02-02
13
Degrees of Complication
Viruses have various degrees of complication in how they can insert themselves in computer code.
10/21/2010
Malware
14
Concealment
Encrypted virus
Decryption engine + encrypted body
Randomly generate encryption key
Detection looks for decryption engine
Polymorphic virus
Encrypted virus with random variations of the decryption engine (e.g., padding code)
Detection using CPU emulator
Metamorphic virus
Different virus bodies
Approaches include code permutation and instruction replacement
Challenging to detect
10/21/2010
Malware
15
Computer Worms
A computer worm is a malware program that spreads copies of itself without the need to inject itself in other programs, and usually without human interaction.
Thus, computer worms are technically not computer viruses (since they don’t infect other programs), but some people nevertheless confuse the terms, since both spread by self-replication.
In most cases, a computer worm will carry a malicious payload, such as deleting files or installing a backdoor.
10/21/2010
Malware
16
Early History
First worms built in the labs of John Shock and Jon Hepps at Xerox PARC in the early 80s
CHRISTMA EXEC written in REXX, released in December 1987, and targeting IBM VM/CMS systems was the first worm to use e-mail service
The first internet worm was the Morris Worm, written by Cornell student Robert Tappan Morris and released on November 2, 1988
10/21/2010
Malware
17
Much of the macro classification carries over from viruses, worms based on macro capabilities of programs are programmed in much the same way as viruses, with minor differences
Primary classification has often been based on a worm relying on e-mail or IRC, ICQ, AIM.
Through much of the mid-90s IRC was a popular target, and worms were often combined with Trojans to allow for remotely controlling systems
Examples include IRC.Worm.Ceyda and IRC.Worm.Whacked, the later of which is also a Trojan
Simultaneously with a growth in instant messaging, popular IM clients have been targeted by worms
There are known worms targeting AIM (W32.AimVen.Worm), MSN (W32.Kelvir and variants), ICQ (W32.Bizex), Yahoo Messenger (W32.Hawawi) and pretty much every other popular IM network
P2P networks have been targeted of late, with W32.Hawawi and others spreading through Kazza
E-mail, exploited indirectly by the Morris Worm continues to be a popular propagation method, with worms like W97M.Melissa, and W32.Navidad relying on MAPI to provide them with an easy way to e-mail themselves out.
CS 166 - Malware
2009-02-02
17
Worm Development
Identify vulnerability still unpatched
Write code for
Exploit of vulnerability
Generation of target list
Random hosts on the internet
Hosts on LAN
Divide-and-conquer
Installation and execution of payload
Querying/reporting if a host is infected
Initial deployment on botnet
Worm template
Generate target list
For each host on target list
Check if infected
Check if vulnerable
Infect
Recur
Distributed graph search algorithm
Forward edges: infection
Back edges: already infected or not vulnerable
10/21/2010
Malware
18
Worm Propagation
Worms propagate by finding and infecting vulnerable hosts.
They need a way to tell if a host is vulnerable
They need a way to tell if a host is already infected.
10/21/2010
Malware
19
initial infection
Propagation: Theory
Classic epidemic model
N: total number of vulnerable hosts
I(t): number of infected hosts at time t
S(t): number of susceptible hosts at time t
I(t) + S(t) = N
b: infection rate
Differential equation for I(t):
dI/dt = bI(t) S(t)
More accurate models adjust propagation rate over time
10/21/2010
Malware
20
Source:
Cliff C. Zou, Weibo Gong, Don Towsley, and Lixin Gao. The Monitoring and Early Detection of Internet Worms, IEEE/ACM Transactions on Networking, 2005.
Propagation: Practice
Cumulative total of unique IP addresses infected by the first outbreak of Code-RedI v2 on July 19-20, 2001
10/21/2010
Malware
21
Source:
David Moore, Colleen Shannon, and Jeffery Brown. Code-Red: a case study on the spread and victims of an Internet worm, CAIDA, 2002
Trojan Horses
A Trojan horse (or Trojan) is a malware program that appears to perform some useful task, but which also does something with negative consequences (e.g., launches a keylogger).
Trojan horses can be installed as part of the payload of other malware but are often installed by a user or administrator, either deliberately or accidentally.
10/21/2010
Malware
22
Current Trends
Trojans currently have largest infection potential
Often exploit browser vulnerabilities
Typically used to download other malware in multi-stage attacks
10/21/2010
Malware
23
Source:
Symantec Internet Security Threat Report, April 2009
Rootkits
A rootkit modifies the operating system to hide its existence
E.g., modifies file system exploration utilities
Hard to detect using software that relies on the OS itself
RootkitRevealer
By Bryce Cogswell and Mark Russinovich (Sysinternals)
Two scans of file system
High-level scan using the Windows API
Raw scan using disk access methods
Discrepancy reveals presence of rootkit
Could be defeated by rootkit that intercepts and modifies results of raw scan operations
10/21/2010
Malware
24
Malware Zombies
Malware can turn a computer in to a zombie, which is a machine that is controlled externally to perform malicious attacks, usually as a part of a botnet.
10/21/2010
25
Botnet Controller (Attacker)
Victim
Botnet:
Attack Commands
Attack Actions
Financial Impact
Malware often affects a large user population
Significant financial impact, though estimates vary widely, up to $100B per year (mi2g)
Examples
LoveBug (2000) caused $8.75B in damages and shut down the British parliament
In 2004, 8% of emails infected by W32/MyDoom.A at its peak
In February 2006, the Russian Stock Exchange was taken down by a virus.
10/21/2010
Malware
26
26
2009-02-02
CS 166 - Malware
Economics of Malware
New malware threats have grown from 20K to 1.7M in the period 2002-2008
Most of the growth has been from 2006 to 2008
Number of new threats per year appears to be growing an exponential rate.
10/21/2010
Malware
27
Source:
Symantec Internet Security Threat Report, April 2009
Professional Malware
Growth in professional cybercrime and online fraud has led to demand for professionally developed malware
New malware is often a custom-designed variations of known exploits, so the malware designer can sell different “products” to his/her customers.
Like every product, professional malware is subject to the laws of supply and demand.
Recent studies put the price of a software keystroke logger at $23 and a botnet use at $225.
10/21/2010
Malware
28
Image by User:SilverStar from http://commons.wikimedia.org/wiki/File:Supply-demand-equilibrium.svg
used by permission under the Creative Commons Attribution ShareAlike 3.0 License
Adware
10/21/2010
Malware
29
Adware software payload
Adware engine infects
a user’s computer
Computer user
Adware agent
Adware engine requests
advertisements
from adware agent
Advertisers
Advertisers contract with
adware agent for content
Adware agent delivers
ad content to user
Spyware
10/21/2010
Malware
30
Spyware software payload
1. Spyware engine infects
a user’s computer.
Computer user
Spyware data collection agent
2. Spyware process collects
keystrokes, passwords,
and screen captures.
3. Spyware process
periodically sends
collected data to
spyware data collection
agent.
Signatures: A Malware Countermeasure
Scan compare the analyzed object with a database of signatures
A signature is a virus fingerprint
E.g.,a string with a sequence of instructions specific for each virus
Different from a digital signature
A file is infected if there is a signature inside its code
Fast pattern matching techniques to search for signatures
All the signatures together create the malware database that usually is proprietary
10/21/2010
Malware
31
Signatures Database
Common Malware Enumeration (CME)
aims to provide unique, common identifiers to new virus threats
Hosted by MITRE
http://cme.mitre.org/data/list.html
Digital Immune System (DIS)
Create automatically new signatures
10/21/2010
Malware
32
While not completely standardized, virus naming follows a fairly standard convention
Viruses often have multiple names in standard usage, and names reported often depend on the detection software used.
Commonly used prefixes include:
@m: Worms or viruses propagating by e-mail
@mm: Mass mailer worms or viruses
Dr: Dropper programs
Family: A virus which shares characteristics with other viruses in a family
Gen: Similar to family
Int: An intended virus, a virus which failed
Worm: Sometimes used to indicate worms
CS 166 - Malware
2009-02-02
32
White/Black Listing
Maintain database of cryptographic hashes for
Operating system files
Popular applications
Known infected files
Compute hash of each file
Look up into database
Needs to protect the integrity of the database
10/21/2010
Malware
33
Heuristic Analysis
Useful to identify new and “zero day” malware
Code analysis
Based on the instructions, the antivirus can determine whether or not the program is malicious, i.e., program contains instruction to delete system files,
Execution emulation
Run code in isolated emulation environment
Monitor actions that target file takes
If the actions are harmful, mark as virus
Heuristic methods can trigger false alarms
10/21/2010
Malware
34
Shield vs. On-demand
Shield
Background process (service/daemon)
Scans each time a file is touched (open, copy, execute, etc.)
10/21/2010
Malware
35
On-demand
Scan on explicit user request or according to regular schedule
On a suspicious file, directory, drive, etc.
Performance test of scan techniques
Comparative: check the number of already known viruses that are found and the time to perform the scan
Retrospective: test the proactive detection of the scanner for unknown viruses, to verify which vendor uses better heuristics
Anti-viruses are ranked using both parameters:
Malicious Code
2008-02-04
35
Online vs Offline Anti Virus Software
Online
Free browser plug-in
Authentication through third party certificate (i.e. VeriSign)
No shielding
Software and signatures update at each scan
Poorly configurable
Scan needs internet connection
Report collected by the company that offers the service
Offline
Paid annual subscription
Installed on the OS
Software distributed securely by the vendor online or a retailer
System shielding
Scheduled software and signatures updates
Easily configurable
Scan without internet connection
Report collected locally and may be sent to vendor
10/21/2010
Malware
36
Quarantine
A suspicious file can be isolated in a folder called quarantine:
E.g,. if the result of the heuristic analysis is positive and you are waiting for db signatures update
The suspicious file is not deleted but made harmless: the user can decide when to remove it or eventually restore for a false positive
Interacting with a file in quarantine it is possible only through the antivirus program
The file in quarantine is harmless because it is encrypted
Usually the quarantine technique is proprietary and the details are kept secret
10/21/2010
Malware
37
Malicious Code
2008-02-04
37
Static vs. Dynamic Analysis
Static Analysis
Checks the code without trying to execute it
Quick scan in white list
Filtering: scan with different antivirus and check if they return same result with different name
Weeding: remove the correct part of files as junk to better identify the virus
Code analysis: check binary code to understand if it is an executable, e.g., PE
Disassembling: check if the byte code shows something unusual
Dynamic Analysis
Check the execution of codes inside a virtual sandbox
Monitor
File changes
Registry changes
Processes and threads
Networks ports
10/21/2010
Malware
38
Virus Detection is Undecidable
Theoretical result by Fred Cohen (1987)
Virus abstractly modeled as program that eventually executes infect
Code for infect may be generated at runtime
Proof by contradiction similar to that of the halting problem
Suppose program isVirus(P) determines whether program P is a virus
Define new program Q as follows:
if (not isVirus(Q))
infect stop
Running isVirus on Q achieves a contradiction
10/21/2010
Malware
39
Theoretically a class of viruses can be found for which there is no minimal detection algorithm
Can thus prove inability to find a perfect virus scanning algorithm and hence a perfect virus scanner
The signatures are behavioral signatures, changing registers, accessing certain memory locations
Signatures are expensive to generate, but cheap to compare against and distinguish between normal computer behavior and abnormal behavior
Virus detection technologies:
Activity monitors rely on monitoring current system activity, help in detecting malware by monitoring specific memory or service access
Signature scanners broadly check files and memory for known virus signatures
File authentication methods rely on authenticating files to make sure they are not really infected by viruses
CS 166 - Malware
2009-02-02
39
Other Undecidable Detection Problems
Detection of a virus
by its appearance
by its behavior
Detection of an evolution of a known virus
Detection of a triggering mechanism
by its appearance
by its behavior
Detection of a virus detector
by its appearance
by its behavior
Detection of an evolution of
a known virus
a known triggering mechanism
a virus detector
10/21/2010
Malware
40
40
Theoretically a class of viruses can be found for which there is no minimal detection algorithm
Can thus prove inability to find a perfect virus scanning algorithm and hence a perfect virus scanner
The signatures are behavioral signatures, changing registers, accessing certain memory locations
Signatures are expensive to generate, but cheap to compare against and distinguish between normal computer behavior and abnormal behavior
2008-02-04
Malicious Code
Resources
Computer Emergency Response Team
Research center funded by the US federal government
Vulnerabilities database
Symantec
Reports on malware trends
Database of malware
Art of Computer Virus Research and Defense by Peter Szor
10/21/2010
Malware
41
41
2009-02-02
CS 166 - Malware
Chart1
| 1997 | 1997 |
| 1998 | 1998 |
| 1999 | 1999 |
| 2000 | 2000 |
| 2001 | 2001 |
| 2002 | 2002 |
| 2003 | 2003 |
| 2004 | 2004 |
| 2005 | 2005 |
| 2006 | 2006 |
Sheet2
| Year | Impact | Impact2 |
| 1997 | $3B | $ 3 |
| 1998 | $6B | $ 6 |
| 1999 | $13B | $ 13 |
| 2000 | $17B | $ 17 |
| 2001 | $13B | $ 13 |
| 2002 | $11B | $ 11 |
| 2003 | $13B | $ 13 |
| 2004 | $17B | $ 18 |
| 2005 | $14B | $ 14 |
| 2006 | $13B | $ 13 |
Ch03-FilesystemSecurity.pptx
Filesystem Security
1
1
General Principles
Files and folders are managed by the operating system
Applications, including shells, access files through an API
Access control entry (ACE)
Allow/deny a certain type of access to a file/folder by user/group
Access control list (ACL)
Collection of ACEs for a file/folder
A file handle provides an opaque identifier for a file/folder
File operations
Open file: returns file handle
Read/write/execute file
Close file: invalidates file handle
Hierarchical file organization
Tree (Windows)
DAG (Linux)
2
Discretionary Access Control (DAC)
Users can protect what they own
The owner may grant access to others
The owner may define the type of access (read/write/execute) given to others
DAC is the standard model used in operating systems
Mandatory Access Control (MAC)
Alternative model not covered in this lecture
Multiple levels of security for users and documents
Read down and write up principles
3
3
Ripasso DAC
Closed vs. Open Policy
Closed policy
Also called “default secure”
Give Tom read access to “foo”
Give Bob r/w access to “bar
Tom: I would like to read “foo”
Access allowed
Tom: I would like to read “bar”
Access denied
Open Policy
Deny Tom read access to “foo”
Deny Bob r/w access to “bar”
Tom: I would like to read “foo”
Access denied
Tom: I would like to read “bar”
Access allowed
4
4
Default sicuro
Closed Policy with Negative Authorizations and Deny Priority
Give Tom r/w access to “bar”
Deny Tom write access to “bar”
Tom: I would like to read “bar”
Access allowed
Tom: I would like to write “bar”
Access denied
Policy is used by Windows to manage access control to the file system
5
Access Control Entries and Lists
An Access Control List (ACL) for a resource (e.g., a file or folder) is a sorted list of zero or more Access Control Entries (ACEs)
An ACE refers specifies that a certain set of accesses (e.g., read, execute and write) to the resources is allowed or denied for a user or group
Examples of ACEs for folder “Bob’s CS167 Grades”
Bob; Read; Allow
TAs; Read; Allow
TWD; Read, Write; Allow
Bob; Write; Deny
TAs; Write; Allow
6
Linux vs. Windows
Linux
Allow-only ACEs
Access to file depends on ACL of file and of all its ancestor folders
Start at root of file system
Traverse path of folders
Each folder must have execute (cd) permission
Different paths to same file not equivalent
File’s ACL must allow requested access
Windows
Allow and deny ACEs
By default, deny ACEs precede allow ones
Access to file depends only on file’s ACL
ACLs of ancestors ignored when access is requested
Permissions set on a folder usually propagated to descendants (inheritance)
System keeps track of inherited ACE’s
7
7
Linux File Access Control
File Access Control for:
Files
Directories
Therefore…
\dev\ : devices
\mnt\ : mounted file systems
What else? Sockets, pipes, symbolic links…
8
8
Because of the way devices and mounted file systems are represented in Linux as part of the file system, they are also covered by the same access control scheme as normal files.
Linux File System
Tree of directories (folders)
Each directory has links to zero or more files or directories
Hard link
From a directory to a file
The same file can have hard links from multiple directories, each with its own filename, but all sharing owner, group, and permissions
File deleted when no more hard links to it
Symbolic link (symlink)
From a directory to a target file or directory
Stores path to target, which is traversed for each access
The same file or directory can have multiple symlinks to it
Removal of symlink does not affect target
Removal of target invalidates (but not removes) symlinks to it
Analogue of Windows shortcut or Mac OS alias
9
Unix Permissions
Standard for all UNIXes
Every file is owned by a user and has an associated group
Permissions often displayed in compact 10-character notation
To see permissions, use ls –l
jk@sphere:~/test$ ls –l
total 0
-rw-r----- 1 jk ugrad 0 2005-10-13 07:18 file1
-rwxrwxrwx 1 jk ugrad 0 2005-10-13 07:18 file2
10
10
Permissions Examples (Regular Files)
11
read/write/execute to everyone
-rwxrwxrwx
read-only to everyone, including owner
-r--r--r--
read/write/execute for owner, forbidden to everyone else
-rwx------
read/write for owner, read-only for group, forbidden to others
-rw-r-----
read/write for owner, read-only for everyone else
-rw-r—r--
11
Permissions for Directories
Permissions bits interpreted differently for directories
Read bit allows listing names of files in directory, but not their properties like size and permissions
Write bit allows creating and deleting files within the directory
Execute bit allows entering the directory and getting properties of files in the directory
Lines for directories in ls –l output begin with d, as below:
jk@sphere:~/test$ ls –l
Total 4
drwxr-xr-x 2 jk ugrad 4096 2005-10-13 07:37 dir1
-rw-r--r-- 1 jk ugrad 0 2005-10-13 07:18 file1
12
12
Permissions Examples (Directories)
13
full access to everyone
-rwxrwxrwx
full access to owner, group can access known filenames in directory, forbidden to others
drwx--x---
full access to owner and group, forbidden to others
drwxrwx---
all can enter and list the directory, only owner can add/delete files
drwxr-xr-x
13
File Sharing Challenge
Creating and modifying groups requires root
Given a directory with permissions drwx------x and a file in it
Give permission to write the file to user1, user2, user3, … without creating a new group
Selectively revoke a user
Solution 1
Give file write permission for everyone
Create different random hard links: user1-23421, user2-56784, …
Problem! Selectively removing access: hard link can be copied
Solution 2
Create random symbolic links
Problem! Symbolic link tells where it points
14
14
Creating and adding users to groups in Linux requires root. Thus, groups, in a sense, are not “dynamic.” The example on this slide hints at a problem with this permission system: it is difficult to manage by-user access to files.
Working Graphically with Permissions
Several Linux GUIs exist for displaying and changing permissions
In KDE’s file manager Konqueror, right-click on a file and choose Properties, and click on the Permissions tab:
Changes can be made here (more about changes later)
15
15
Special Permission Bits
Three other permission bits exist
Set-user-ID (“suid” or “setuid”) bit
Set-group-ID (“sgid” or “setgid”) bit
Sticky bit
16
16
Set-user-ID
Set-user-ID (“suid” or “setuid”) bit
On executable files, causes the program to run as file owner regardless of who runs it
Ignored for everything else
In 10-character display, replaces the 4th character (x or -) with s (or S if not also executable)
-rwsr-xr-x: setuid, executable by all
-rwxr-xr-x: executable by all, but not setuid
-rwSr--r--: setuid, but not executable - not useful
17
17
Set-group-ID
Set-group-ID (“sgid” or “setgid”) bit
On executable files, causes the program to run with the file’s group, regardless of whether the user who runs it is in that group
On directories, causes files created within the directory to have the same group as the directory, useful for directories shared by multiple users with different default groups
Ignored for everything else
In 10-character display, replaces 7th character (x or -) with s (or S if not also executable)
-rwxr-sr-x: setgid file, executable by all
drwxrwsr-x: setgid directory; files within will have group of directory
-rw-r-Sr--: setgid file, but not executable - not useful
18
18
The setgid bit is used by many games. The executable files are in group games and are setgid. No users are in group games, but the high-score files are. Being setgid games allows games to update high scores!
Sticky Bit
On directories, prevents users from deleting or renaming files they do not own
Ignored for everything else
In 10-character display, replaces 10th character (x or -) with t (or T if not also executable)
drwxrwxrwt: sticky bit set, full access for everyone
drwxrwx--T: sticky bit set, full access by user/group
drwxr--r-T: sticky, full owner access, others can read (useless)
19
19
Working Graphically with Special Bits
Special permission bits can also be displayed and changed through a GUI
In Konqueror’s Permissions window, click Advanced Permissions:
Changes can be made here (more about changes later)
20
20
Root
“root” account is a super-user account, like Administrator on Windows
Multiple roots possible
File permissions do not restrict root
This is dangerous, but necessary, and OK with good practices
21
21
There can be multiple root accounts, but root is the conventional name. Any account with user ID 0 has root powers. This is like the Windows Administrators group. As the system administrator, root can change any file’s owner, group, or permissions, or delete the file, regardless of who owns it or its permissions. This is clearly dangerous, but necessary, and in practice can be secure. Choosing a good root password is very important, as well as minimizing programs and commands which are run as root. Finally, root is the entity charged with making sure that permissions allow no other users to disrupt the system (accidentally or intentionally), but there is nobody doing oversight on root. Thus, it is wise to think twice before doing anything as root, to guard against mistakes.
Becoming Root
su
Changes home directory, PATH, and shell to that of root, but doesn’t touch most of environment and doesn’t run login scripts
su -
Logs in as root just as if root had done so normally
sudo <command>
Run just one command as root
su [-] <user>
Become another non-root user
Root does not require to enter password
22
22
To become root, type su or su - and put in the root password when prompted. Sudo functions similarly, but only for the duration of one command.
Changing Permissions
Permissions are changed with chmod or through a GUI like Konqueror
Only the file owner or root can change permissions
If a user owns a file, the user can use chgrp to set its group to any group of which the user is a member
root can change file ownership with chown (and can optionally change group in the same command)
chown, chmod, and chgrp can take the -R option to recur through subdirectories
23
23
Examples of Changing Permissions
24
Sets the setuid bit on file1. (Doesn’t change execute bit.)
chmod u+s file1
Sets file1’s group to testgrp, if the user is a member of that group
chgrp testgrp file1
Adds group read/write permission to dir1 and everything within it, and group execute permission on files or directories where someone has execute permission
chmod -R g=rwX dir1
Adds group write permission to file1 and file2, denying all access to others
chmod g+w,o-rwx file1 file2
Changes ownership of dir1 and everything within it to root
chown -R root dir1
24
Octal Notation
Previous slide’s syntax is nice for simple cases, but bad for complex changes
Alternative is octal notation, i.e., three or four digits from 0 to 7
Digits from left (most significant) to right(least significant): [special bits][user bits][group bits][other bits]
Special bit digit = (4 if setuid) + (2 if setgid) + (1 if sticky)
All other digits = (4 if readable) + (2 if writable) + (1 if executable)
25
25
Octal Notation Examples
26
read/write/execute to everyone (dangerous!)
777 or 0777
same as 777, plus sticky bit
1777
same as 775, plus setgid (useful for directories)
2775
read/write for owner, read-only for group, forbidden to others
640 or 0640
read/write/execute for owner and group, read/execute for others
775 or 0775
read/write for owner, read-only for everyone else
644 or 0644
26
Limitations of Unix Permissions
Unix permissions are not perfect
Groups are restrictive
Limitations on file creation
Linux optionally uses POSIX ACLs
Builds on top of traditional Unix permissions
Several users and groups can be named in ACLs, each with different permissions
Allows for finer-grained access control
Each ACL is of the form type:[name]:rwx
Setuid, setgid, and sticky bits are outside the ACL system
27
27
27
Unix permissions are not perfect. There is, for instance, no way to have specific permissions for two or three users, groups, etc. There is also limited ability to set permissions on newly created files, and non-root users cannot create groups and may only use the groups provided by root. At some risk of giving away the next slide, an optional solution is provided in POSIX ACLs.
Linux supports Access Control Lists (ACLs) specified by a POSIX draft standard, which works with Linux filesystems such as Ext2, Ext3, XFS, JFS, and ReiserFS. ACLs build on top of traditional Unix permissions, which still work, but allow for finer-grained access control. Several users and groups can be named in ACLs, each with different permissions. POSIX ACLs also permits a default ACLs for new files within directories.
Minimal ACLs
In a file with minimal ACLs, name does not appear, and the ACLs with type “user” and “group” correspond to Unix user and group permissions, respectively.
When name is omitted from a “user” type ACL entry, it applies to the file owner.
28
28
28
ACL Commands
ACLs are read with the getfacl command and set with the setfacl command.
Changing the ACLs corresponding to Unix permissions shows up in ls -l output, and changing the Unix permissions with chmod changes those ACLs.
Example of getfacl:
29
jimmy@techhouse:~/test$ ls -l
total 4
drwxr-x--- 2 jimmy jimmy 4096 2005-12-02 04:13 dir
jimmy@techhouse:~/test$ getfacl dir
# file: dir
# owner: jimmy
# group: jimmy
user::rwx
group::r-x
other::---
29
29
More ACL Command Examples
30
jimmy@techhouse:~/test$ setfacl -m group::rwx dir
jimmy@techhouse:~/test$ ls -l
total 4
drwxrwx--- 2 jimmy jimmy 4096 2005-12-02 04:13 dir
jimmy@techhouse:~/test$ chmod 755 dir
jimmy@techhouse:~/test$ getfacl dir
# file: dir
# owner: jimmy
# group: jimmy
user::rwx
group::r-x
other::r-x
30
30
Note that in the first example, the setfacl command changed the permissions just like chmod would. In the second, chmod's permissions change is reflected in the getfacl output.
Extended ACLs
ACLs that say more than Unix permissions are extended ACLs
Specific users and groups can be named and given permissions via ACLs, which fall under the group class (even for for ACLs naming users and not groups)
With extended ACLs, mapping to and from Unix permissions is a bit complicated.
User and other classes map directly to the corresponding Unix permission bits
Group class contains named users and groups as well as owning group permissions. How to map?
31
31
31
Mask-type ACLs
Unix group permissions now map to an ACL of type “mask”, which is an upper bound on permissions for all group class ACLs.
All group class ACLs are logically and-ed with the mask before taking effect
rw-—xrw- & r-x—x--- = r----x--
The ACL of type “group” with no name still refers to the Unix owning group
Mask ACLs are created automatically with the necessary bits such that they do not restrict the other ACLs at all, but this can be changed
32
32
32
Extended ACL Example
33
jimmy@techhouse:~/test$ ls -l
total 4
drwxr-xr-x 2 jimmy jimmy 4096 2005-12-02 04:13 dir
jimmy@techhouse:~/test$ setfacl -m user:joe:rwx dir
jimmy@techhouse:~/test$ getfacl dir
# file: dir
# owner: jimmy
# group: jimmy
user::rwx
user:joe:rwx
group::r-x
mask::rwx
other::r-x
jimmy@techhouse:~/test$ ls -l
total 8
drwxrwxr-x+ 2 jimmy jimmy 4096 2005-12-02 04:13 dir
33
33
Extended ACL Example Explained
The preceding slide grants the named user joe read, write, and execute access to dir.
dir now has extended rather than minimal ACLs.
The mask is set to rwx, the union of the two group class ACLs (named user joe and the owning group).
In ls -l output, the group permission bits show the mask, not the owning group ACL
Effective owning group permissions are the logical and of the owning group ACL and the mask, which still equals r-x.
This could reduce the effective owning group permissions if the mask is changed to be more restrictive.
The + in the ls -l output after the permission bits indicates that there are extended ACLs, which can be viewed with getfacl.
34
34
34
Default ACLs
The kind of ACLs we've mentioned so far are access ACLs.
A directory can have an additional set of ACLs, called default ACLs, which are inherited by files and subdirectories created within that directory.
Subdirectories inherit the parent directory's default ACLs as both their default and their access ACLs.
Files inherit the parent directory's default ACLs only as their access ACLs, since they have no default ACLs.
The inherited permissions for the user, group, and other classes are logically and-ed with the traditional Unix permissions specified to the file creation procedure.
35
35
35
Default ACL Example
36
jimmy@techhouse:~/test$ setfacl -d -m group:webmaster:rwx dir
jimmy@techhouse:~/test$ getfacl dir
# file: dir
# owner: jimmy
# group: jimmy
user::rwx
user:joe:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:group:webmaster:rwx
default:mask::rwx
default:other::r-x
Note how this starts the default ACLs out as equal to the existing access ACLs plus the specified changes.
36
36
Default ACL Example Continued
37
jimmy@techhouse:~/test$ mkdir dir/subdir
jimmy@techhouse:~/test$ getfacl dir/subdir
# file: dir/subdir
# owner: jimmy
# group: jimmy
user::rwx
group::r-x
group:webmaster:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:group:webmaster:rwx
default:mask::rwx
default:other::r-x
The default ACLs from the parent directory are both the access and default ACLs for this directory. Group webmaster has full access.
37
37
Default ACL Example Continued
38
jimmy@techhouse:~/test$ touch dir/file
jimmy@techhouse:~/test$ ls -l dir/file
-rw-rw-r--+ 1 jimmy jimmy 0 2005-12-02 11:36 dir/file
jimmy@techhouse:~/test$ getfacl dir/file
# file: dir/file
# owner: jimmy
# group: jimmy
user::rw-
group::r-x #effective:r--
group:webmaster:rwx #effective:rw-
mask::rw-
other::r--
The default ACLs from the parent directory are the basis for the access ACLs on this file, but since touch creates files without any execute bit set, the user and other classes, and the group class as well via the mask ACL, have their execute bits removed to match.
38
38
NTFS Permissions
39
NTFS Partition
ACL
User 1
User 2
Read
Group 1
User 1
Read
Group 1
Full Control
Full Control
ACE
ACE
39
Basic NTFS Permissions
40
Group A
User 1
Multiple NTFS permissions
41
NTFS permissions are cumulative
File permissions override folder permissions
Deny overrides Allow
File1
File2
Group B
Group A
Write denied
User 1
Read
Read/Write
Folder A
Group B
Write
NTFS: permission inheritance
42
Folder A
Access allowed for File 1
Access denied for File 1
Block of Inheritance
Permission Inheritance
File1
Read/Write
Read/Write
Folder A
File1
42
NTFS File Permissions
Explicit: set by the owner for each user/group.
Inherited: dynamically inherited from the explicit permissions of ancestor folders.
Effective: obtained by combining the explicit and inherited permission.
43
Rules
inherited
explicit
effective
Determining effective permissions:
By default, a user/group has no privileges.
Explicit permissions override conflicting inherited permissions.
Denied permissions override conflicting allowed permissions.
43
Access Control Algorithm
The DACL of a file or folder is a sorted list of ACEs
Local ACEs precede inherited ACEs
ACEs inherited from folder F precede those inherited from parent of F
Among those with same source, Deny ACEs precede Allow ACEs
Algorithm for granting access request (e.g., read and execute):
ACEs in the DACL are examined in order
Does the ACE refer to the user or a group containing the user?
If so, do any of the accesses in the ACE match those of the request?
If so, what type of ACE is it?
Deny: return ACCESS_DENIED
Allow: grant the specified accesses and if there are no remaining accesses to grant, return ACCESS_ALLOWED
If we reach the end of the DACL and there are remaining requested accesses that have not been granted yet, return ACCESS_DENIED
44
Example
45
Customers Group Write Folder1
Marketing Group Read Folder1
Customers Group Read Folder1
Marketing Group Write Folder2
Customers Group Modify Folder1
File2 should only be accessible to Marketing Group, and only for read access
File2
Folder1
Folder2
File1
User1
NTFS
Customers Group
Marketing Group
45
NTFS move vs. copy in same volume
If you move a file or a folder inside the same volume your permission will be the same of the source folder
If you copy a file or a folder inside the same volume your permission will be the same of the destination folder
46
NTFS E:\
Copy
Move
NTFS move vs. copy across volumes
If you copy or move a file or a folder on different volumes your permission will be the same of the destination folder
47
NTFS D:\
NTFS E:\
NTFS C:\
Copy
Move
Setting File Permissions in Win XP
48
NTFS permissions in Windows XP Pro are disabled by default.
Using Folder Options… from Tools menu inside Windows Explorer is possible to activate NTFS permission in windows by unchecking Use simple file sharing
Qui devo cambiare le immagini dalla versione in inglese di windows
48
Windows Tools
Access control management tools provide detailed information and controls, across multiple dialogs.
Focus on single file/folders.
It is challenging for an inexperienced user, or a system administrator dealing with very large file structures, to gain a global view of permissions within the file system
49
Treemap Access Control Evaluator (TrACE)
50
Alexander Heitzmann, Bernardo Palazzi, Charalampos Papamanthou, Roberto Tamassia. Effective Visualization of File System Access Control, VizSEC 2008
Sponsors:
TrACE Highlights
At a glance, determine the explicit, inherited, and effective permissions of files and folders.
Understand access control relationships between files and their ancestors
Quickly evaluate large directory structures and find problem areas
Layout based on treemaps
51
What is a Treemap?
A visualization method to display large hierarchical data structures (trees)
Layout based on nested rectangles.
Treemaps were introduced by Ben Shneiderman in “Tree visualization with tree-maps: 2-d space-filling approach”; TOG 1991
52
A
B
C
F
E
D
53
53
54
Acknowledgment
Much of these POSIX ACL slides are adapted (and some pictures are taken) from Andreas Grünbacher’s paper POSIX Access Control Lists on Linux, available online at: http://www.suse.de/~agruen/acl/linux-acls/
55
55
55
Read
Open files and subfolders
Open files
List Folder Contents
Read and Execute
Write
Modify
Full Control
NTFS Permission
Folders
Files
Not applicable
List contents of folder, traverse
folder to open subfolders
Create subfolders and add files
Not applicable
Open files, execute
programs
All the above + delete
All the above +
change permissions
and take ownership,
delete subfolders
All the above
Modify files
All the above +
change permissions
and take ownership
Ch06-Firewalls.pptx
Firewalls, Tunnels, and Network Intrusion Detection
1
1
Firewalls
A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.
A network firewall is similar to firewalls in building construction, because in both cases they are intended to isolate one "network" or "compartment" from another.
2
Firewall Policies
To protect private networks and individual machines from the dangers of the greater Internet, a firewall can be employed to filter incoming or outgoing traffic based on a predefined set of rules called firewall policies.
3
Trusted internal network
Firewall
Firewall policies
Untrusted
Internet
Policy Actions
Packets flowing through a firewall can have one of three outcomes:
Accepted: permitted through the firewall
Dropped: not allowed through with no indication of failure
Rejected: not allowed through, accompanied by an attempt to inform the source that the packet was rejected
Policies used by the firewall to handle packets are based on several properties of the packets being inspected, including the protocol used, such as:
TCP or UDP
the source and destination IP addresses
the source and destination ports
the application-level payload of the packet (e.g., whether it contains a virus).
4
Blacklists and White Lists
There are two fundamental approaches to creating firewall policies (or rulesets) to effectively minimize vulnerability to the outside world while maintaining the desired functionality for the machines in the trusted internal network (or individual computer).
Blacklist approach
All packets are allowed through except those that fit the rules defined specifically in a blacklist.
This type of configuration is more flexible in ensuring that service to the internal network is not disrupted by the firewall, but is naïve from a security perspective in that it assumes the network administrator can enumerate all of the properties of malicious traffic.
Whitelist approach
A safer approach to defining a firewall ruleset is the default-deny policy, in which packets are dropped or rejected unless they are specifically allowed by the firewall.
5
Firewall Types
packet filters (stateless)
If a packet matches the packet filter's set of rules, the packet filter will drop or accept it
"stateful" filters
it maintains records of all connections passing through it and can determine if a packet is either the start of a new connection, a part of an existing connection, or is an invalid packet.
application layer
It works like a proxy it can “understand” certain applications and protocols.
It may inspect the contents of the traffic, blocking what it views as inappropriate content (i.e. websites, viruses, vulnerabilities, ...)
6