OS Security Rethinking Permission Granting in Modern Operating Systems

Size: px

Start display at page:

Download "OS Security Rethinking Permission Granting in Modern Operating Systems"

Maximilian Lindsey
6 years ago
Views:

1 Rethinking Permission Granting in Modern Operating Systems Joe Miner Nicholas Fouche Department of Electrical & Computer Engineering Missouri University of Science and Technology 28 November 2016 rev Nicholas Fouche

2 Introduction Overview Outline State of the Art in Permission Granting Goals and Context User-Driven Access Control Implementation Evaluation Conclusion

3 Introduction Overview Introduction State of the Art in Permission Granting Goals and Context User-Driven Access Control Implementation Evaluation Conclusion

4 Overview Modern platforms such as ios, Android, Windows 8, and web browsers use user-owned resources. This is inefficient and ineffective in producing a secure environment. To improve the security of platforms, the use of userdriven access control is proposed; user intent would be captured via access control gadgets.

5 Overview State of the Art in Permission Granting Introduction State of the Art in Permission Granting Goals and Context User-Driven Access Control Implementation Evaluation Conclusion

6 State of the Art in Permission Granting The existing permission granting methods are: Global Resources Manifests Prompts No Access

7 State of the Art in Permission Granting Global Resources Globalizing resources for applications User-Friendly Allows unintended accesses with least amount of priviledges Contradicts user expectations of privacy

8 State of the Art in Permission Granting Manifests Are install-time agreements Allow Permanent Access to resources once user agrees Applications can access resources at any time Many applications ask for excessive permissions than needed Very little security here

9 Prompts State of the Art in Permission Granting Closest to verifying user intent Little effectiveness Teaches users to ignore other prompts

10 State of the Art in Permission Granting No Access System that does not allow applications to access userowned resources (i.e. Web Applications) Browser plugins are an exception since they have access to all user-owned resources

11 Introduction Overview Goals and Context State of the Art in Permission Granting Goals and Context User-Driven Access Control Implementation Evaluation Conclusion

12 Goals and Context Goals of Permission Granting are: They are in-context (unlike manifests) They are non-disruptive (unlike prompts) They are least-privileged (unlike current systems)

13 System Model Goals and Context Ref: RKM+2012

14 Goals and Context User-Owned Resources are defined as: Devices and sensors (physical and virtual) User-Controlled capabilities and settings Content (i.e. documents, photos, etc.)

15 User-Driven Access Control Introduction State of the Art in Permission Granting Goals and Context User-Driven Access Control Implementation Evaluation Conclusion

16 User-Driven Access Control Designing a non-intrusive Access Control Gadget (ACG) Ref: [RKM+2012]

17 User-Driven Access Control In order to have a useful ACG we need: Built-in permission granting in applications UI A way to obtain the user s authentic permission granting intent from interaction with the application UI Ref: [RKM+2012]

18 Ensuring integrity with ACGs Display isolation Complete Visibility Sufficient Display Duration User-Driven Access Control Disallow Customization, Limit Dynamic Customization, or Review Process of Customization Joe Miner

19 Implementation Introduction State of the Art in Permission Granting Goals and Context User-Driven Access Control Implementation Evaluation Conclusion

20 Implementation In order to implement the new ACG style we must: Build the kernel such that it captures user intent via ACGs Joe Miner Appropriate the Resource Monitor (RM) to act on the user s intent Type Call Name Description syscall upcall upcall upcall upcall InitContentTransfer (push or pull, dest or src) StartUp (gadgetid, appid, apphandle) InputEvent (gadgetid or inputsequence, appid, apphandle) LostFocus (gadgetid, appid, apphandle) EmbeddingAppExit (gadgetid, appid, apphandle) Triggers the kernel to push or pull content from a principal Notifies monitor of a new embedded ACG Notifies monitor of an ACG input event or a recognized sequence Notifies monitor when an ACG loses focus Notifies monitor when application embedding an ACG exits Ref: [RKM+2012] Table 1: System Calls and UpCalls for Resource Monitor

21 Implementation Joe Miner Type Call Name Description syscall EmbedACG (location, resource, type, duration) Embeds an ACG in the calling application s UI upcall upcall upcall PullContent (windowid, eventname, eventargs) PushContent (windowid, eventname, eventargs) IntermediateEvent (windowid, eventname, eventargs) Pulls content from a principal based on user intent Pushes content to a principal based on user intent Issues a DragEnter, DragOver, or DragLeave to a principal upcall IsDraggable (windowid, x, y) Determines if the object under the cursor is draggable upcall Ref: [RKM+2012] Table 2: System Calls and UpCalls for Applications CheckNestedPermission (windowid, nestedapp, acgtype) Determines if a nested application may embed an ACG

22 Evaluation Introduction State of the Art in Permission Granting Goals and Context User-Driven Access Control Implementation Evaluation Conclusion

23 Evaluation showed that: Evaluation Joe Miner Illegitimate access to user-owned resources is a real problem today and will likely become the dominant source of vulnerabilities in the future User-Driven Access control best matches the user s expectations Significantly Reduced Privacy threats Attackers have a very limited means of exploiting Developers can easily incorporate user-driven access control measures User-Driven access control methods don t severely limit customization The Performance impact is negligible

24 Conclusion Introduction State of the Art in Permission Granting Goals and Context User-Driven Access Control Implementation Evaluation Conclusion

25 Conclusion User-driven access control is more secure and more efficient Increasing the privacy of users Non-disruptive to users, in-context to users, and uses the least-privileged permission system Evaluations confirm these facts

26 References [RKM+2012] Franziska Roesner, Tadayoshi Kohno, Alexander Moshchuk, Bryan Parno, Helen J. Wang, and Crispin Cowan, User-Driven Access Control: Rethinking Permission Granting in Modern Operating Systems, in Proceedings of the IEEE Symposium on Security and Privacy (SP), San Francisco, CA, May 2012, pp

27 End of Foils Joe Miner

Security, Privacy, & User Expectations:

Security, Privacy, & User Expectations: Case Studies in Web Tracking and Application Permissions Franziska Roesner Assistant Professor Computer Science & Engineering University of Washington Security,