15 - Introduction to computer security

Class: CSCE-313

Notes:

Is computer security necessary?

...

Notes:

• The amount of money you won at a bank account is really just a number stored in someone else's computer
• Money is represented in some form inside a computer
• Securing computers is then important
• All of your educational scores are basically some digitization of your scores in some computer system
• Traditionally we understood security in terms of confidentiality, but that is not the only thing within security
• But integrity is another thing, they may be able to change info without actually able to see what it is

Examples of security problems

...

Notes:

• Guy called Robert Morris
  • Grad student at Cornell
  • He wrote the Internet Worm
  • It exploited techniques of buffer overflow that even the designers of Vax at that time, were stunned at what he had done
  • This classic buffer overflow
    • 20,725 results for "buffer overflow" in the CVE database
    • They have found many many ways of doing it
• A worm is an independent thing
  • Could actually connect to other hosts, and would look at what hosts you are connected to
  • Then it would exploit that and propagate itself
  • Virus infect an executable and live in there
    • But they need a host in order to exists and depend on the file being run to proceed
• Denial of Service is a different kind of attack
  • Preventing the good guy to access a service

Buffer Overflow in a Nutshell

...

Notes:

• Stack grows towards the left
• Green function calls the blue function
  • The calling convention is that the green function will push the return address
  • The address that the blue function must return when it finishes
• The blue function allocates space on the stack for its local variables
  • Array boundaries are not checked in C
  • Reads input from the client and assigns it to V
  • V is growing in the opposite direction of the stack
• If your attacker is very smart, he will make you overwrite the return address, once you have overwritten it, instead of returning where you would return, in the earliest simple case, you will actually return to the code you pushed on the stack (the malicious code)
• This sorts of attacks do not work now, but when they came out, they were an amazing thing

Denial of Service

...

Notes:

• Bad guys push so much traffic to amazon.com that you cannot get to that destination
• The way that TCP/IP works is that if it detects a lot of traffic, it starts slowing down its transmission rate
• After a few minutes you will place your order not at amazon.com but somewhere else
  • This is what they want you to move to as a client
• Attacker will pretend like it is doing a real TCP handshake
• The attacker sends the first packet and proposes a random number
• The server allocates resources necessary for that connection (i.e. sockets, buffers)
• Then the server sends a reply to the attacker, and the attacker never completes the TCP handshake, so the allocated resources stay in the server

What is computer security?

...

Notes:

• Confidentiality, Integrity, and Availability

Why is security hard?

...

Notes:

• Security is often a tradeoff with convenience
  • It is hard to remember usernames and passwords
• There is also the performance aspect
  • If you have security measures in place, you pay a price in performance
• The other problem is that we are very smart opponents
  • Your opponent will find the weakest link in your chain
  • You cannot afford to relax in a point
  • You must get everything right in a complex system that is already very difficult
• Big-free software?
  • If it is not bug-free, the attacker may be able to exploit this bug and use it to gain control of your system
• Today we even see AI opponents outperforming humans in detecting vulnerabilities or exploiting them

1. Confidentiality

Confidentiality: Encryption

...

Notes:

• Traditionally you have confidentiality implemented through encryption
• Somehow you can transform this plaintext and produce some cyphertext which no one is able to understand
• It is happening because there is a lot of redundancy in the natural language that you are trying to encrypt
• Example:
  • I'd like fried and coke with my ...
    • burger?
• Once you have a ciphertext, you have some secret that is used to obtain your plaintext
  • Symmetric Encryption: You can use the same key to both decrypt and encrypt
  • Asymmetric Encryption: different keys for decrypting and encrypting
• ROT1 cipher example (caesar cipher):
  • ATTACK : BUUBDL
• When you do encryption, then you can actually map a sentence in english into something that looks like garbage, but it does not have to be garbage at all

Encryption ~ Speaking

...

Notes:

• Imagine you have only 4 possible plaintext input messages and other 4 possible plaintext output messages
• 16 different keys
• Every key represents a permutation between the input and the output
• Example:
  • Key 0110 induces a permutation between the input space and the output space (a configuration of connections)
• This is encapsulated in Kirkoff law
• You can assume that the attacker knows everything about this blackbox, but yet they cannot figure out which input produce this output

Confidentiality: access control

...

Notes:

• Encryption of data at rest, while it is sitting, no-one can access it unless they have the decryption key for that data
• What you also want is to control access to that data using physical controls
• It achieves authentication:
  • Example:
    • Having a special card to enter the company's building
      • "If you hold this card, you are Jack Smith"
• Then you also have authorization:
  • Now I can enable you to do what you should be permitted to do
• Identity based access control:
  • Used the persons identity to figure out what they should be enabled to do
  • Identity is often too granular
• Sometimes all you need is a role that an identity is having (RBAC):
  • When assuming the role of an instructor, then you may be able to see classmates grades
  • The actual identity is unimportant, in what capacity you are acting is what should determine whether you should be granted access or not
• Look at Access Control Models

Confidentiality: Authentication

...

Notes

• If you type your password, and your password is correct, then I know who you are.
• Classic 3 forms of authentication:
  • Something you have,
    • The fact that you possess the key to the castle authenticates you
    • If you have this key, you are whoever the key claims you to be
  • Something you know
  • Something you are

Confidentiality: Authorization

...

Notes:

• "This identifier can do this, this other identifier cannot do this"
• A filesystem has very simple authorization, but mother system can have complete root bases that are evaluated with some complex systems in order to answer Yes or No
• In our unix filesystem, we have a static authorization policy
• In the modern world, you can have a more dynamic policy
  • For example in finance, you can see the balance sheet for any company, but once you see it for one company, you are prevented from seeing the same information for a competitor
  • Evaluating policies like these is a big complex task

Confidentiality: Physical Security

...

Notes:

• Cabinets protected by a lock
• You do not want somebody 200m across to read your monitor
• If you do not protect your RFID card, it may be possible to RFID attacks
  • A faraday cage shorts these electro magnetic waves

2. Integrity

Integrity-the property that information has not been altered in an unauthorized way. Integrity is a separate property than Confidentiality.

• It protects the data from tampering.

Notes:

• If you have 50 root certs in your browser, you can't really trust
• If I could add my own root cert in your browser, then I can send you off to my site, and I can make it so nice that you won't be able to tell the difference
• The problem is that if I can change something for you, I can compromise it

Integrity: checksum

...

Notes:

• Takes an arbitrary-sized data and hashes it into a fixed length numerical value
• One way to check if your files have changed is basically to duplicate the data and check for differences, but this can be very expensive
• You can instead transform your data into a constant-size output, and then compare that to the original hash of the data, this is much easier

For example:

$ cat foo
ATTACK AT DAWN

• If I am able to change it to ATTACK AT MOON, that would be bad enough

$ sha1sum foo
0806b996cbad73b0f5e0f68898d3c80eaea27bcf  foo

But when we do

$ cat foo
ATTACK AT MOON

$ sha1sum foo
ee6f10e08c5a841ccd2a5261d0326623855fd3a3  foo

• The hash changed!

Integrity: error correcting codes

...

Notes:

• A MAC (Message Authentication Code) is basically a key in the form of a hash
• That key makes your checksum unique, you are basically specializing your checksum, so you have a different checksum for every different value of a key
• An attacker who may be able to compute a checksum, won't be able to compute a MAC without knowing the key

3. Availability

...

Notes:

• Basically that an attacker is not able to degrade your access to the service or the information
• Usually the technique to handle this is to have redundancy
  • Multiple copies of the data
  • Break data into multiple shares and re-combine them, etc.

Design Principles for Secure Systems

...

Notes:

• If you follow these, you will have a more secure system
• Economy of protection mechanism
  • Keep it simple and stupid (KISS) principle
• Fail-safe defaults
  • By default everything should be denied, and should expressively permit someone to do something
  • Again the tradeoff between convenience and security hits
• Complete mediation
  • You want security to check every access to every object
• Open design
  • Goes back to kirkoffs law
  • People have spent billions of dollars believing that if they could make that hardware secure, and no-one would be able to reverse engineer the hardware, they will be secure
  • The only security that you should have should be that key, not the entire system
  • Go in the forward direction, not in the backward
• Separation of privileges
  • You need two people to insert the key at the same time to launch the nuke
• Least privilege
  • Do you need to be root if you just need to troubleshoot networking?
  • No, you should only be given the privilege you need
• Least common mechanism
  • You do not want a common mechanism to become so large so that it satisfies a large set of users, because it can become liable
  • If there is a single bug somewhere, somebody else that is not using that particular thing can see the effects
  • For example: boringssl is more boring, but more secure by removing old deprecated encryption methods
• Acceptability
  • No matter how secure a system is, if it is difficult to use, people will find ways to break it

Questions

A Unix file system checks permissions on every file access - not just when a file is first opened/ Even if a process has already read from a file, each subsequent read is re-checked against the current ACL.

Answer: Complete mediation

• Every access to every object must be checked

A new employee at a hospital is given read/write access to all patient records, billing, HR files, and the pharmacy system - 'just in case they need it later.'

Answer: Least privilege

• You only want to give the privileges that they need to do their job

A bank's wire-transfer system requires both a manager's password and a hardware token before a large transfer would be approved

Answer: Separation of privileges

An operating system's kernel is kept as small as possible, with only the most essential functions inside it. Everything else runs in user space.

Answer: Economy of [protection] mechanism

• KISS principle

An operating system's kernel security system requires users to enter a 47-step authentication ritual before they can access their own calendar. Most users end up writing their password on a sticky note.

Answer: Acceptability

• This is not acceptable
• We want systems to work with people