Category: Security

Where should an ACL be stored?
– In trusted part of the system
– Consists of access control entries, or, ACEs
– Along with other object meta-data
– For example, file meta-data has a bunch of information where this can go as well
– Checking requires traversal of the ACL

Where do C-list go?
– A capability is an unforgeable reference/handle for a resource
– User catalogue of capabilities defines what a certain user can access
– Can be stored in objects/resources themselves(Hydra)
– Sharing requires propagation of capabilities

Efficieny, Accountability, Revocation

Access Control Implementation
How is Access Control Implemented in Unix-like Systems?
– In Unix, each resource looks like a file
– Each file has an owner(UID) and access is possible for owner, group and everyone(world).
– Permissions are read, write and execute
– Original ACL implementation had a compact fixed size representation(9 bits)
– Now full ACL support is available in many variants(Linux, BSD, MacOS,..)
– Few other things(sticky bit, setuid,…)

Access Control Implementation
How are files used(system calls for accessing files?)
– Create(filename)/* several ways to do it */
– fd = open(filename, mode)
– read (fd, buf, sizeof(buf))
– write(fd, buf, sizeof(buf))
– close(fd)

List all processes and subjects in a matrix
A11 A12 A13 … A1n
A21 A22 A23 … A2n
A31 A32 A33 … A3n
.
.
Am1 Am2 Am3 … Amn
List each object in a column and row

Access control matrix is large
How do we represent it in the system?
Column for object Oi is [(ul1, right1),(ui2, right2),…]
called access control list or ACL
Associated with each resource
For user ui, a row in the matrix is [(oil1, righ1),(oi2,righs2)…]
Called a capability-list or C-list
such a C-list stored for each user

ACLs
x->[(A,rwx)]
y->[(A,r)(B,rw)(c,rw)]
z->[(B,rx)(C,rx)]

C-lists
A->[(X,rwx)(y,r)]
B->[(y,rw)(Z,rx)]
C->[(y,rw)(Z,rx)]

Controlling Accesses to Resources
– TCB(reference monitor) sees a request for a resource, how does it decide whether it should be granted?
– Example: Should John’s process making a request to read a certain file be allowed to do so?

– Authentication establishes the source of a request
– Authorization or access control answers the question if a certain source of request(User ID) is allowed to read the file
– Subject who owns a resource(creates it) should be able to control access to it

Access Control
Basically, it is about who is allowed to access what.
Two parts
– Decide who should have access to certain resources
– Enforcement – only accesses defined by the access control policy are granted
Complete mediation is essential for successful enforcement

An access control matrix(ACM) abstracts the state relevant to access control.
Rows of ACM correspond to users/subjects/groups
Columns correspond to resources that need to be protected.
ACM defines who can access what

Hardware/OS must provide a trusted path
– Windows CNTL-ALT-DEL
– keyboard and display must have trusted paths to OS
– Special kind of display under OS control

popular password:
123456, password, qwerty, 123456789, baseball, football

publicly available software can do
10^8 MD5 hashes/sec on a GPU

Six random upper case/lower case/ digit then 62^6 possible password, about 10 minutes

-As password length and complexity increases, usability suffers
-Phishing and social engineering – users do not authenticate who is asking for a password
-Once a password is stolen, it can be used many times
-> This is why there are policies that say passwords be changed frequenty
-Humans have a hard time remembering lots of passwords. Usable passwords are easy to guess.

Sys Administrators:
– Never store passwords in the clear
– Store only hashed values generated with a random salt and limit acess to them
– Avoid general purpose fast hash functions

Users:
– Use password managers

Other Authentication Methods
– you must have them
– May require additional hardware (e.g., readers)
– How does it implement authentication (challenge/response)
– Cost and misplaced trust(RSA SecureID master key breach)

Various biometrics
– Fingerprints(finger swipes)
– Keystroke dynamics
– Voice
– Retina scans

Password -> H(password) -> A string of fixed length

Hash Functions & Threads
– We assume a one-way property for hash functions
– If we know common passwords, we can determine their hash
– For dictionary and offline attacks, we have hash values and plenty of time to test for matches

Brute Force Guessing of Passwords
– Publicly available software can do 10^8 MD5 hashes/sec on a GPU
– Six random upper case/lower case/digits then 62^6 possible passwords, about 10 minutes
– Eight random characters increases it to about six days

Passwords are not really random
To reduce the work required for a brute force attack:
– Try the popular passwords first
– Create a rainbow table

– Add a random salt before hashing
– Store the salt with the hashed value
– Check by using the salt with the typed password

Brute Force Guessing of Passwords
User ID, Salt, Hash code

A number of online banking systems send a limited lifetime PIN to your smartphone for you to be able to authenticate yourself to the bank.

Thread modeling of the password method
– guessing the password for a given user allows impersonation
– impersonating a real login program
– Keylogging to steal a passdword

Importance of a Trusted Path
Hardware/OS must provide a trusted path:
– Windows CNTL-ALT-DEL
– Keyboard and display must have trusted paths to OS
– Special kind of display under OS control
– Do users pay attention?

Store a list of passwords, one for each user in the system file.
– The file is readable only by the root/admin account
– What if the permissions are set incorrectly?
– Why shold admin know passwords?
– if security is breached, the passwords are exposed to attacker.

Use a one-way hash function and store the result
The password file is readable only for root/admin

Authentication : Who are you? prove it.
-> Authorization : Does this person have permission to access the requested resources?
-> Resources

OS(TCB) needs to know who makes a request for a protected resorce
A process that makes the request does it on behalf of a certain user, subject or principal
Authentication helps us answer the question: on whose behalf the requesting process runs?
Includes claims about an identity and verification of the claimed identitiy of the user who wants to gain access to system and resource

Authentication Goals
User/principal associated with an identity should be able to successfully authenticate itself
– Availability
– No false negatives

User/principal not associated with the dentity should not be able to authenticate itself
– Authenticity
– No false positives

How is Authentication implemented?
– something a user knows, something a user has, something a user is

OS is large and complex, even different operating systems may be desired by different customers
Compromise of an OS impacts all applications

Use: Hypervisor, virtual machines, guest OS and applications
Compromise of OS in VM1 only impacts applications running on VM1

Do your taxes in on VM1 while browsing potentially dangerous places on the web on VM2

Compromise of OS(TCB) means an attacker has access to everything.
Getting the TCB right is extreamly important
Smaller and simpler(hypervisor only partitions physical resource among VMs and let us guest OS handle management)
Secure coding is really important when writing the OS which typically is written in languages that are not type safe

No think, how can we do a non-executable stack to help prevent code injection via stack buffer?
– used by windows, os X, Linux

OS(Kernel) resides in a portion of each process’s address space
True for each process, processes can cross the fence only in controlled/limited ways.

32-bit Linux: Lower 3GB for user code/data, top 1GB for kernel
Corresponds to x86 privilege ring transitions
Windows and OS X similar
DOS had no such fence, any process could alter DOS and viruses could spread by hooking DOS interrupt handlers via kernel changes.

Linux User/Kernel Memory Split
Kernel Mode Space/ User Mode Space

Complete Mediation
-Make sure that no protected resource could be accessed without going through the TCB
-TCB acts as a reference monitor that cannot be bypassed
-Privileged instructions

User code cannot access OS part of address space without changing to system mode
User code cannot access physical resources because they require privileged instructions (e.g. servicing interrupts) which can only be executed in system mode.

OS virtualizes physical resources and provides and API for virtualized resources
File for storing persistent data on disk
Virtual resource must be translated to physical resource handle whch cn only be done by OS, which ensures complete mediation