426 CS class Jan 17, 2012
www.cs.purdue.edu/homes/ssw/cs426/{index.html,syll.pdf,outline}
(General purpose) Program security
These ideas apply also to OS and DB.
Read Chapter 3
What does it mean for a pgm to be secure? Depends whom you ask.
Takes a long time to break its security controls
Has run for 9 weeks with no failure
Contains no potential security flaw
A program fault is an unexpected (bad) behavior of a pgm
Which program is more secure?
1. pgm with 100 faults discovered and fixed
2. a similar pgm with 20 faults discovered and fixed
Early computer security was "penetrate and patch"
Not a good solution because:
1. narrow focus on a fault ignores the context
2. fault may have nonobvious side effects
3. fixing one problem may cause another
4. fault not fixed because the fixed system wouldn't work
A better approach to computer security (via software engineering)
program security flaw = pgm behavior not what designers
intended or users expected.
Flaws may be either inadvertent human errors or
malicious, intentional flaws.
Unintentional human error are more common than deliberate
malicious ones, and they cause more damage.
Computer security terms differ IEEE standard terms: error, fault, failure
Program security is hard and we can't avoid all flaws because:
1. pgms are complicated; it is hard to describe all
unexpected behavior. A thm in CS 526 says
that it is NP-complete to decide whether a
program is secure.
2. software engineering advances faster than security
But we can still do something and make most programs secure.
Landwehr et al. [1994] classified flaws as:
A. Intentional flaws
1. malicious
2. nonmalicious
B. Inadvertent errors:
1. validation: incomplete or inconsistent permission check
2. domain: controlled access to data
3. serialization and aliasing: program flow order
4. failed authorization due to bad identification/authentication
5. boundary condition violation: first or last case failure
6. other exploitable logic errors
Three classic nonmalicious program errors (pre-Internet)
1. Buffer overflows
Memory is finite and so are arrays and strings (buffers)
Example:
int buff[10];
for (i=0; i<10; i++)
buff[i]=2;
buff[10]=3;
The last instruction may write 3 into
1. the user's data
2. the user's program code
3. another user's data
4. another user's program code
5. data
6. system system program code
A malicious attacker who knows about a buffer overflow error in
a program he can use may use the error to write malicious code
Example: passwd, browser URL parameter
Control: test after each input character; OS memory protection
2. Incomplete mediation
Not checking whether input data is valid or in range
Example: date 17 Jan 2012 okay, 37 Jat 1843 not okay
Control: check input correctness or use drop-down box
Example: Ebusiness, order form returns total price,
and customer changes it
3. Time-of-check to time-of-use error.
synchronization problem
check before use; approve in "work ticket"; user changes
the request in the ticket before the order is executed.
Example: open file (one you may open); after approval,
change file name to one you may not open.
Control: copy the ticket so the user can't access it.
If it is too big to copy and must remain accessible
to the user, then save its hash value.
Malicious code
A computer may get malicious code during installation of
(good) code, setup, or download of other code.
Malicious code runs as you and can do anything you can.
Malicious code has been around at least since 1970.
Malware definitions
Malicious code = rogue program = whole program or code
that does unexpected or unintended actions caused
by an agent intent on damage
agent = person who wrote or distributed the malicious code
virus = malicious code that can replicate itself by
modifying nonmalicious code.
transient virus = virus that stops when its attached
program stops
resident virus = virus that puts itself in memory and
keeps going even when its attached program stops
Trojan horse = malicious code that has a benign primary
effect and a nonobvious malicious effect.
Example: passwd, editor, compiler
Logic bomb = malicious code that does something bad
when a condition happens (a file is opened)
Time bomb = logic bomb with a certain date/time as condition
Trapdoor = backdoor = program feature that lets anyone
have special privileges by entering a secret code.
Example: ATM program with secret PIN
May be used for maintenance or to erase record of crime
Worm = whole program that spreads copies of itself
through a network, does not attach to other programs
Rabbit = virus or worm that replicates without bound,
exhausting time or memory