Notes for October 12, 2000

  1. Greetings and Felicitations!
    1. More questions ... send to cs153@cs.ucdavis.edu (the csif address seems to fail intermittently)
    2. Homework #2 will be available tomorrow on the web page
  2. Puzzle of the day
  3. PA Model (Neumann's organization)
    1. Improper protection (initialization and enforcement)
      1. improper choice of initial protection domain - "incorrect initial assignment of security or integrity level at system initialization or generation; a security critical function manipulating critical data directly accessible to the user";
      2. improper isolation of implementation detail - allowing users to bypass operating system controls and write to absolute input/output addresses; direct manipulation of a "hidden" data structure such as a directory file being written to as if it were a regular file; drawing inferences from paging activity
      3. improper change - the "time-of-check to time-of-use" flaw; changing a parameter unexpectedly;
      4. improper naming - allowing two different objects to have the same name, resulting in confusion over which is referenced;
      5. improper deallocation or deletion - leaving old data in memory deallocated by one process and reallocated to another process, enabling the second process to access the information used by the first; failing to end a session properly
    2. Improper validation - not checking critical conditions and parameters, leading to a process' addressing memory not in its memory space by referencing through an out-of-bounds pointer value; allowing type clashes; overflows
    3. Improper synchronization;
      1. improper indivisibility - interrupting atomic operations (e.g. locking); cache inconsistency
      2. improper sequencing - allowing actions in an incorrect order (e.g. reading during writing)
    4. Improper choice of operand or operation - using unfair scheduling algorithms that block certain processes or users from running; using the wrong function or wrong arguments.
  4. RISOS
    1. Incomplete parameter validation - failing to check that a parameter used as an array index is in the range of the array;
    2. Inconsistent parameter validation - if a routine allowing shared access to files accepts blanks in a file name, but no other file manipulation routine (such as a routine to revoke shared access) will accept them;
    3. Implicit sharing of privileged/confidential data - sending information by modulating the load average of the system;
    4. Asynchronous validation/Inadequate serialization - checking a file for access permission and opening it non-atomically, thereby allowing another process to change the binding of the name to the data between the check and the open;
    5. Inadequate identification/authentication/authorization - running a system program identified only by name, and having a different program with the same name executed;
    6. Violable prohibition/limit - being able to manipulate data outside one's protection domain; and
    7. Exploitable logic error - preventing a program from opening a critical file, causing the program to execute an error routine that gives the user unauthorized rights.
  5. Penetration Studies
    1. Why? Why not analysis?
    2. Effectiveness
    3. Interpretation
  6. Flaw Hypothesis Methodology
    1. System analysis
    2. Hypothesis generation
    3. Hypothesis testing
    4. Generalization
  7. System Analysis
    1. Learn everything you can about the system
    2. Learn everything you can about operational procedures
    3. Compare to models like PA, RISOS
  8. Hypothesis Generation
    1. Study the system, look for inconsistencies in interfaces
    2. Compare to previous systems
    3. Compare to models like PA, RISOS
  9. Hypothesis testing
    1. Look at system code, see if it would work (live experiment may be unneeded)
    2. If live experiment needed, observe usual protocols
  10. Generalization
    1. See if other programs, interfaces, or subjects/objects suffer from the same problem
    2. See if this suggests a more generic type of flaw
  11. Peeling the Onion
    1. You know very little (not even phone numbers or IP addresses)
    2. You know the phone number/IP address of system, but nothing else
    3. You have an unprivileged (guest) account on the system.
    4. You have an account with limited privileges.

Puzzle of the Day

The following is part of the output from ls -sailF /bin /usr/sbin. What is suspicious about it? 

 64236	168  -r-xr-xr-x	1  root	160028	May  2 20:53	/bin/csh*
 64293	192  -r-xr-xr-x	2  root	180816	May  2 20:58	/bin/ksh*
 64285	 88  -r-xr-xr-x	3  root	89564	May  2 21:02	/bin/sh*
. . .
309872	144  -r-xr-xr-x	1  root	137984	Aug 19 14:58	/usr/sbin/in.named*
309704	  9  -r-xr-xr-x	1  root	8532	May  2 20:56	/usr/sbin/in.rexecd*
309705	 10  -r-xr-xr-x	1  root	9672	May  2 20:56	/usr/sbin/in.rlogind*
309707	 10  -r-xr-xr-x	1  root	9836	May  2 20:56	/usr/sbin/in.rshd*
309710	 88  -r-sr-xr-x	3  root	89564	Aug 22 03:05	/usr/sbin/in.telnetd*
Matt Bishop
Office: 3059 Engineering Unit II Phone: +1 (530) 752-8060
Fax: +1 (530) 752-4767
Email: bishop@cs.ucdavis.edu
Copyright Matt Bishop, 2000. All federal and state copyrights reserved for all original material presented in this course through any medium, including lecture or print.
Page last modified on 10/12/2000