Retrofitting Legacy Code for Authorization Policy Enforcement Vinod Ganapathy
|
|
|
- Dayna Parker
- 5 years ago
- Views:
Transcription
1 Retrofitting Legacy Code for Authorization Policy Enforcement Vinod Ganapathy Ph.D. Thesis Defense Thursday, July 12 th, 2007
2 Principle of Design for Security To create a secure system, design it to be secure from the ground up Historic example: MULTICS [Corbato et al. 65] More recent examples: Operating systems Database servers Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 2
3 Relevance of the Principle today Most deployed software is not designed for security Deadline-driven software development Design.Build.(Patch)* is here to stay Diverse/Evolving security requirements MULTICS security study [Karger and Schell, 72] Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 3
4 Retrofitting legacy code Need systematic techniques to retrofit legacy code for security Legacy code INSECURE Retrofitted code SECURE Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 4
5 Retrofitting legacy code Need systematic techniques to retrofit legacy code for security Enforcing type safety CCured [Necula et al. 02] Partitioning for privilege separation PrivTrans [Brumley and Song, 04] Enforcing authorization policies Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 5
6 Enforcing authorization policies Resource user Operation request Response Allowed? Resource manager Reference monitor YES/NO Authorization policy Alice, /etc/passwd, File_Read Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 6
7 Retrofitting for authorization Mandatory access control for Linux Linux Security Modules [Wright et al., 02] SELinux [Loscocco and Smalley, 01] Secure windowing systems Painstaking, manual procedure Trusted X, Compartmented-mode workstation, X11/SELinux [Epstein et al., 90][Berger et al., 90][Kilpatrick et al., 03] Java Virtual Machine/SELinux [Fletcher, 06] IBM Websphere/SELinux [Hocking et al., 06] Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 7
8 Thesis statement Program analysis and transformation techniques offer a principled and automated way to retrofit legacy code with reference monitors Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 8
9 Contributions Analyses and transformations for authorization policy enforcement Fingerprints: A new representation for security-sensitive operations Two algorithms to mine fingerprints Result: Reduced effort to retrofit legacy code for authorization policy enforcement Manual effort needed reduces to a few hours Applied to X server, Linux kernel, PennMUSH Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 9
10 Motivation Problem Outline Example Retrofitting legacy code: Lifecycle Solution Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 10
11 X server with multiple X clients REMOTE LOCAL Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 11
12 Malicious remote X client REMOTE LOCAL Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 12
13 Undesirable information flow REMOTE LOCAL Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 13
14 Desirable information flow REMOTE LOCAL Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 14
15 Other policies to enforce Prevent unauthorized Copy and paste Modification of inputs meant for other clients Changes to window settings of other clients Retrieval of bitmaps: Screenshots [Berger et al., 90] [Epstein et al., 90] [Kilpatrick et al., 03] Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 15
16 X server with authorization X client Operation request Response X server Reference monitor Allowed? YES/NO Authorization policy Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 16
17 Motivation Problem Outline Example Retrofitting legacy code: Lifecycle Solution Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 17
18 Retrofitting lifecycle 1. Identify security-sensitive operations 2. Locate where they are performed in code 3. Instrument these locations Security-sensitive operations Input_Event Create Destroy Copy Paste Map Source Code Policy checks Can the client receive this Input_Event? Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 18
19 Problems Manual X11/SELinux ~ 2 years [Kilpatrick et al., 03] Linux Security Modules ~ 2 years [Wright et al., 02] Ad hoc Violation of complete mediation Time-of-check to Time-of-use bugs [Zhang et al., 02][Jaeger et al., 04] Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 19
20 Our approach Principled Fingerprints: A new representation of security-sensitive operations Automated Legacy code retrofitted using fingerprints Use of static and dynamic program analysis Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 20
21 Approach overview Legacy code Miner Fingerprints Matcher Retrofitted code Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 21
22 Motivation Problem Solution Outline Fingerprints [CCS 05] Dynamic fingerprint mining Static fingerprint mining Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 22
23 What are fingerprints? Code-level signatures of security-sensitive operations Resource accesses that are unique to a security-sensitive operation Denote key steps needed to perform the security-sensitive operation on a resource Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 23
24 Examples of fingerprints Input_Event :- Cmp xevent->type == KeyPress Security-sensitive operations Input_Event Create Destroy Copy Paste Map Source Code Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 24
25 Examples of fingerprints Input_Event :- Cmp xevent->type == KeyPress Input_Event :- Cmp xevent->type == MouseMove Map :- Set Window->mapped to True & Set xevent->type to MapNotify Enumerate :- Read Window->firstChild & Read Window->nextSib & Cmp Window 0 Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 25
26 Enumerate :- Fingerprint matching Read Window->firstChild & Read Window->nextSib & Cmp Window 0 X server function MapSubWindows MapSubWindows(Window *pparent, Client *pclient) { Window *pwin; // Run through linked list of child windows pwin = pparent->firstchild; for (;pwin!= 0; pwin=pwin->nextsib) {... // Code that maps each child window... } } Performs Enumerate Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 26
27 Placing authorization checks X server function MapSubWindows MapSubWindows(Window *pparent, Client *pclient) { Window *pwin; // Run through linked list of child windows if CHECK(pClient,pParent,Enumerate) == ALLOWED { pwin = pparent->firstchild; for (;pwin!= 0; pwin=pwin->nextsib) {... // Code that maps each child window... } } else { HANDLE_FAILURE } } Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 27
28 Fingerprint matching Currently employ simple pattern matching More sophisticated matching possible Metacompilation [Engler et al., 01] MOPS [Chen and Wagner, 02] Inserting authorization checks is akin to static aspect-weaving [Kiczales et al., 97] Other aspect-weaving techniques possible Runtime aspect-weaving Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 28
29 Motivation Problem Solution Outline Fingerprints Dynamic fingerprint mining [Oakland 06] Static fingerprint mining Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 29
30 Dynamic fingerprint mining Security-sensitive operations Input_Event Create Destroy Copy Paste Map Source Code Output: Fingerprints Input_Event :- Cmp xevent->type == KeyPress Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 30
31 Dynamic fingerprint mining Security-sensitive operations [NSA 03] Input_Event Input to window from device Create Create new window Destroy Destroy existing window Map Map window to console Use this information to induce the program to perform security-sensitive operations Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 31
32 Problem definition S: Set of security-sensitive operations D: Descriptions of operations in S R: Set of resource accesses Read/Set/Cmp of Window/xEvent Each s є S has a fingerprint A fingerprint is a subset of R Contains a resource access unique to s Problem: Find fingerprints for each security-sensitive operation in S using D Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 32
33 Traces contain fingerprints Security-sensitive operations Input_Event Create Destroy Copy Paste Map Source Code Runtime trace Induce security-sensitive operation Typing to window will induce Input_Event Fingerprint must be in runtime trace Cmp xevent->type == KeyPress Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 33
34 Compare traces to localize Security-sensitive operations Input_Event Create Destroy Copy Paste Map Source Code Localize fingerprint in trace Trace difference and intersection Runtime trace Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 34
35 Runtime traces Trace the program and record reads/writes to resource data structures Window and xevent in our experiments Example: from X server startup (In function SetWindowtoDefaults) Set Window->prevSib to 0 Set Window->firstChild to 0 Set Window->lastChild to 0 about 1400 such resource accesses Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 35
36 Using traces for fingerprinting Obtain traces for each security-sensitive operation Series of controlled tracing experiments Examples Typing to keyboard generates Input_Event Creating new window generates Create Creating window also generates Map Closing existing window generates Destroy Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 36
37 Comparison with diff and Annotation is a manual step Open xterm Close xterm Move xterm Open browser Switch windows Create Destroy Map Unmap Input_Event Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 37
38 Comparison with diff and Perform same set operations on resource accesses Open xterm Close xterm Move xterm Open browser Switch windows Create Destroy Map Unmap Input_Event Create = Open xterm Open browser - Move xterm Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 38
39 Set equations Each trace has a set of labels Open xterm: {Create, Map} Browser:{Create, Destroy, Map, Unmap} Move xterm: {Map, Input_Event} Need set equation for {Create} Compute an exact cover for this set Open xterm Open browser Move xterm Perform the same set operations on the set of resource accesses in each trace Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 39
40 Experimental methodology Source code Server with logging enabled Raw traces Relevant portions of traces Pruned traces gcc -enable-logging Run experiments and collect traces Localize security-sensitive operation Compare traces with diff and Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 40
41 Dynamic mining: Results 1,000,000 1,000, ,000 54,000 Size 10,000 1, Each fingerprint localized to within 126 resource 900 accesses Source Code Raw Traces Relevant Portions Pruned Traces Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 41
42 Limitations of dynamic mining Security-sensitive operations Input_Event Create Destroy Copy Paste Map Source Code Runtime trace 1. Incomplete: False negatives 2. High-level description needed 3. Operations are manually induced Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 42
43 Motivation Problem Solution Outline Fingerprints Dynamic fingerprint mining Static fingerprint mining [ICSE 07] Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 43
44 Static fingerprint mining Security-sensitive operations Input_Event Create Destroy Copy Paste Map Source Code Resources Window xevent Output: Candidate Fingerprints Cmp xevent->type == KeyPress Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 44
45 Problem definition R: Set of resource accesses Read/Set/Cmp of Window/xEvent E: Set of entry points into the server Goal: Find fingerprints using R and E Not given an a priori description of security-sensitive operations Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 45
46 Straw-man proposal I Each resource access in R is a fingerprint Finest level of granularity Cmp xevent->type == KeyPress Read Window->firstChild Read Window->nextSib Cmp Window 0 Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 46
47 Problem with this proposal Difficult to write and maintain policies at this level of granularity Cmp xevent->type == KeyPress Read Window->firstChild Read Window->nextSib Cmp Window 0 Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 47
48 Straw-man proposal II Each API in E is a fingerprint Coarsest level of granularity Call MapSubWindows Call MapWindow Write policies allowing/disallowing the use of an API call Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 48
49 Problem with this proposal Does not reflect actual resource accesses performed by API call Call MapSubWindows Enumerates child windows and maps them to the screen Call MapWindows Maps a window onto the screen Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 49
50 Our approach Cluster resource accesses that always happen together Each API entry point implicitly defines a set of resource accesses Cluster resource accesses based upon the API entry points that perform them Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 50
51 Static analysis Extract resource accesses potentially possible via each entry point Example from the X server Entry point: MapSubWindows( ) Resource accesses: Set xevent->type To MapNotify Set Window->mapped To True Read Window->firstChild Read Window->nextSib Cmp Window 0 Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 51
52 Resource accesses MapSub Windows Map Window Keyboard Input Set xevent->type To MapNotify Set Window->mapped To True Identify 270 candidate API functions fingerprints by 430 clustering distinct resource accesses Read Window->firstChild Read Window->nextSib Cmp Window 0 Cmp xevent->type==keypress Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 52
53 Concept analysis Instances Features MapSub Windows Map Window Keyboard Input Set xevent->type To MapNotify Set Window->mapped To True Read Window->firstChild Read Window->nextSib Cmp Window 0 Cmp xevent->type==keypress Comparison via hierarchical clustering Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 53
54 Hierarchical clustering Set xevent->type To MapNotify Set Window->mapped To True Read Window->firstChild Read Window->nextSib Cmp Window 0 Cmp xevent->type==keypress A B C MapSub Windows Map Window Keyboard Input {A,B,C}, Ф {A,B}, {1,2} {C}, {6} {A}, {1,2,3,4,5} Ф, {1,2,3,4,5,6} Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 54
55 Mining candidate fingerprints A B C Cand. Fing. 1 Cand. Fing. 2 Cand. Fing Set xevent->type To MapNotify Set Window->mapped To True Read Window->firstChild Read Window->nextSib Cmp Window 0 Cmp xevent->type==keypress MapSub Windows Map Window Keyboard Input {A,B,C}, Ф {A,B}, {1,2} {C}, {6} {A}, {1,2,3,4,5} Ф, {1,2,3,4,5,6} Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 55
56 Static mining: Results Benchmark LOC Cand. Fing. Avg. Size ext2 4, X Server/dix 30, PennMUSH 94, Size 100,000 10,000 1, ext2 X server PennMUSH Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 56
57 Static mining: Results Benchmark ext2 X Server/dix Manually identified Security-sensitive ops Candidate fingerprints Able to find at least one fingerprint for each security-sensitive operation Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 57
58 Static mining: Results Benchmark ext2 X Server/dix Manually identified Security-sensitive ops Candidate fingerprints Identified automatically Identified as part in a of few minutes Interpretation multi-year takes just efforts a few hours Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 58
59 Static mining: Results Benchmark ext2 X Server/dix Manually identified Security-sensitive ops Candidate fingerprints Associated 59 candidate fingerprints with security-sensitive operations Remaining are likely security-sensitive too Read Window->DrawableRec->width & Read Window->DrawableRec->height Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 59
60 Summary of contributions Fingerprints Mining Matching Input_Event Create Destroy Copy Paste Map Can the client receive this Input_Event? Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 60
61 Lessons for the future Modifying legacy code is non-trivial Modifications may break software Modifying executables is challenging Low-overhead runtime system for policy enforcement on unmodified code Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 61
62 Lessons for the future Soundness/completeness hard to achieve for C Type-safety violations the main problem Provable guarantees with additional runtime checks? Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 62
63 Lessons for the future Difficult to automate failure handling Failure handling is a crosscutting-concern Handling failure gracefully is the main challenge Aspect-oriented solution? Checkpoint and rollback? Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 63
64
65 Errors in labeling traces (I) Open xterm Close xterm Move xterm Open browser Switch windows CREATE DESTROY MAP UNMAP INPUTEVENT Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 65
66 Errors in labeling traces (I) Open xterm Close xterm Move xterm Open browser Switch windows CREATE DESTROY MAP UNMAP INPUTEVENT CREATE = Trace1 Trace3 Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 66
67 Errors in labeling traces (II) Open xterm Close xterm Move xterm Open browser Switch windows CREATE DESTROY MAP UNMAP INPUTEVENT Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 67
68 Dealing with errors in labeling Missing labels from traces: operation will not discard fingerprint diff operation may erroneously eliminate a fingerprint Extra labels on traces: May erroneously eliminate a fingerprint Trial-and-error Relabel and recompute set-equations Empirically: tolerance of about 15% errors Vinod Ganapathy Retrofitting Legacy Code for Authorization Policy Enforcement 68
Toward Automated Authorization Policy Enforcement
Toward Automated Authorization Policy Enforcement Vinod Ganapathy vg@cs.wisc.edu Trent Jaeger tjaeger@cse.psu.edu Somesh Jha jha@cs.wisc.edu March 1 st, 2006 Second Annual Security-enhanced Linux Symposium
Towards Automated Authorization Policy Enforcement
Towards Automated Authorization Policy Enforcement Vinod Ganapathy Univ. of Wisconsin-Madison vg@cs.wisc.edu Trent Jaeger Pennsylvania State Univ. tjaeger@cse.psu.edu Somesh Jha Univ. of Wisconsin-Madison
Producing Minimal Hook Placements to Enforce Authorization Policies
Producing Minimal Hook Placements to Enforce Authorization Policies Divya Muthukumaran, Nirupama Talele, and Trent Jaeger Prnn State University With Vinod Ganapathy (Rutgers) and Gang Tan (Lehigh) Security
Runtime Analysis. November 28, Systems and Internet Infrastructure Security Laboratory (SIIS) Page 1
Runtime Analysis November 28, 2011 Page 1 Analysis So Far Prove whether a property always holds May analysis Prove whether a property can hold Must analysis Key step: abstract interpretation to overapproximate
Retrofitting Legacy Code for Authorization Policy Enforcement
Retrofitting Legacy Code for Authorization Policy Enforcement Vinod Ganapathy, Trent Jaeger, and Somesh Jha Presented by Kevin Butler CSE 544-13 February 2007 Systems and Internet Infrastructure Security
RETROFITTING LEGACY CODE FOR AUTHORIZATION POLICY ENFORCEMENT. Vinod Ganapathy
RETROFITTING LEGACY CODE FOR AUTHORIZATION POLICY ENFORCEMENT by Vinod Ganapathy A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy (Computer Sciences)
SoK: Eternal War in Memory Laszlo Szekeres, Mathias Payer, Tao Wei, and Dawn Song In: Oakland 14
SoK: Eternal War in Memory Laszlo Szekeres, Mathias Payer, Tao Wei, and Dawn Song In: Oakland 14 Presenter: Mathias Payer, EPFL http://hexhive.github.io 1 Memory attacks: an ongoing war Vulnerability classes
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Automatic Placement of Authorization Hooks in the Linux Security Modules Framework
Automatic Placement of Authorization Hooks in the Linux Security Modules Framework Vinod Ganapathy vg@cs.wisc.edu University of Wisconsin, Madison Joint work with Trent Jaeger tjaeger@cse.psu.edu Pennsylvania
Producing Hook Placements to Enforce Expected Access Control Policies
Producing Hook Placements to Enforce Expected Access Control Policies Divya Muthukumaran 1, Nirupama Talele 2, Trent Jaeger 2, and Gang Tan 3 1 Imperial College, London, United Kingdom 2 The Pennsylvania
Operating System Security: Building Secure Distributed Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Operating System Security:
Module: Future of Secure Programming
Module: Future of Secure Programming Professor Trent Jaeger Penn State University Systems and Internet Infrastructure Security Laboratory (SIIS) 1 Programmer s Little Survey Problem What does program for
Separating Access Control Policy, Enforcement, and Functionality in Extensible Systems. Robert Grimm University of Washington
Separating Access Control Policy, Enforcement, and Functionality in Extensible Systems Robert Grimm University of Washington Extensions Added to running system Interact through low-latency interfaces Form
Wedge: Splitting Applications into Reduced-Privilege Compartments
Wedge: Splitting Applications into Reduced-Privilege Compartments Andrea Bittau Petr Marchenko Mark Handley Brad Karp University College London April 17, 2008 Vulnerabilities threaten sensitive data Exploits
PtrSplit: Supporting General Pointers in Automatic Program Partitioning
PtrSplit: Supporting General Pointers in Automatic Program Partitioning Shen Liu Gang Tan Trent Jaeger Computer Science and Engineering Department The Pennsylvania State University 11/02/2017 Motivation
Advanced Systems Security: Multics
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Association Pattern Mining. Lijun Zhang
Association Pattern Mining Lijun Zhang zlj@nju.edu.cn http://cs.nju.edu.cn/zlj Outline Introduction The Frequent Pattern Mining Model Association Rule Generation Framework Frequent Itemset Mining Algorithms
in memory: an evolution of attacks Mathias Payer Purdue University
in memory: an evolution of attacks Mathias Payer Purdue University Images (c) MGM, WarGames, 1983 Memory attacks: an ongoing war Vulnerability classes according to CVE Memory
Sandboxing Untrusted Code: Software-Based Fault Isolation (SFI)
Sandboxing Untrusted Code: Software-Based Fault Isolation (SFI) Brad Karp UCL Computer Science CS GZ03 / M030 9 th December 2011 Motivation: Vulnerabilities in C Seen dangers of vulnerabilities: injection
The Evolution of Secure Operating Systems
The Evolution of Secure Operating Systems Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University 1 Operating Systems
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Control-Flow-Graph-Based Aspect Mining
Control-Flow-Graph-Based Aspect Mining Jens Krinke FernUniversität in Hagen, Germany krinke@acm.org Silvia Breu NASA Ames Research Center, USA silvia.breu@gmail.com Abstract Aspect mining tries to identify
Understanding and Automatically Preventing Injection Attacks on Node.js
Understanding and Automatically Preventing Injection Attacks on Node.js Michael Pradel TU Darmstadt Joint work with Cristian Staicu (TU Darmstadt) and Ben Livshits (Microsoft Research, Redmond) 1 Why JavaScript?
Information Flow Control For Standard OS Abstractions
Information Flow Control For Standard OS Abstractions Maxwell Krohn, Alex Yip, Micah Brodsky, Natan Cliffer, Frans Kaashoek, Eddie Kohler, Robert Morris MIT SOSP 2007 Presenter: Lei Xia Mar. 2 2009 Outline
Module: Cloud Computing Security
Module: Computing Security Professor Trent Jaeger Penn State University Systems and Internet Infrastructure Security Laboratory (SIIS) 1 Computing Is Here Systems and Internet Infrastructure Security (SIIS)
Locating Faults Through Automated Predicate Switching
Locating Faults Through Automated Predicate Switching Authored by Xiangyu Zhang, Neelam Gupta, Rajiv Gupta The University of Arizona ICSE 2006 Presented by Jing Pu Authors 1 Neelam Gupta The University
Topics : Analysis of Software Systems. Side channel analysis. Remote Timing Attacks are Practical
Topics 7-654: Analysis of Software Systems Spring 2005 4/2/2005 Timing attack Algorithms leak information Nice example of practice trumping theoretical security Hardening algorithms: randomization Privilege
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Securing Software Applications Using Dynamic Dataflow Analysis. OWASP June 16, The OWASP Foundation
Securing Software Applications Using Dynamic Dataflow Analysis Steve Cook OWASP June 16, 2010 0 Southwest Research Institute scook@swri.org (210) 522-6322 Copyright The OWASP Foundation Permission is granted
CSE Computer Security
CSE 543 - Computer Security Lecture 25 - Virtual machine security December 6, 2007 URL: http://www.cse.psu.edu/~tjaeger/cse543-f07/ 1 Implementation and Results Experimental Platform Exact specification
Contego: Capability-Based Access Control for Web Browsers
Contego: Capability-Based Access Control for Web Browsers Tongbo Luo and Wenliang Du Department of Electrical Engineering & Computer Science, Syracuse University, Syracuse, New York, USA, {toluo,wedu}@syr.edu
The Evolution of Secure Operating Systems
The Evolution of Secure Operating Systems Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University 1 Operating Systems
AutoISES: Automatically Inferring Security Specifications and Detecting Violations
: Automatically Inferring Security Specifications and Detecting Violations (U. of Illinois at Urbana-Champaign) Xiaolan (Catherine) Zhang (IBM Research) Xiao Ma, Weiwei Xiong, Yuanyuan Zhou (U. of Illinois
Secure Virtual Architecture: Using LLVM to Provide Memory Safety to the Entire Software Stack
Secure Virtual Architecture: Using LLVM to Provide Memory Safety to the Entire Software Stack John Criswell, University of Illinois Andrew Lenharth, University of Illinois Dinakar Dhurjati, DoCoMo Communications
SentinelOne Technical Brief
SentinelOne Technical Brief SentinelOne unifies prevention, detection and response in a fundamentally new approach to endpoint protection, driven by behavior-based threat detection and intelligent automation.
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 1 Operating System Quandary Q: What is the primary goal of
Control Flow Integrity & Software Fault Isolation. David Brumley Carnegie Mellon University
Control Flow Integrity & Software Fault Isolation David Brumley Carnegie Mellon University Our story so far Unauthorized Control Information Tampering http://propercourse.blogspot.com/2010/05/i-believe-in-duct-tape.html
Buffer overflow background
and heap buffer background Comp Sci 3600 Security Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Address Space and heap buffer
Advanced Systems Security: Securing Commercial Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
What's New with SELinux
What's New with SELinux Stephen D. Smalley sds@tycho.nsa.gov National Information Assurance Research Laboratory National Security Agency National Information Assurance Research Laboratory 1 Advances in
6.858 Quiz 2 Review. Android Security. Haogang Chen Nov 24, 2014
6.858 Quiz 2 Review Android Security Haogang Chen Nov 24, 2014 1 Security layers Layer Role Reference Monitor Mandatory Access Control (MAC) for RPC: enforce access control policy for shared resources
CCured. One-Slide Summary. Lecture Outline. Type-Safe Retrofitting of C Programs
CCured Type-Safe Retrofitting of C Programs [Necula, McPeak,, Weimer, Condit, Harren] #1 One-Slide Summary CCured enforces memory safety and type safety in legacy C programs. CCured analyzes how you use
Module: Operating System Security. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Operating System Security Professor Trent Jaeger 1 OS Security So, you have built an operating system that enables user-space processes to
Module: Future of Secure Programming
Module: Future of Secure Programming Professor Trent Jaeger Penn State University Systems and Internet Infrastructure Security Laboratory (SIIS) 1 Programmer s Little Survey Problem What does program for
Outline. V Computer Systems Organization II (Honors) (Introductory Operating Systems) Language-based Protection: Solution
Outline V22.0202-001 Computer Systems Organization II (Honors) (Introductory Operating Systems) Lecture 21 Language-Based Protection Security April 29, 2002 Announcements Lab 6 due back on May 6th Final
HeapMD: Identifying Heap-based Bugs using Anomaly Detection
HeapMD: Identifying Heap-based Bugs using Anomaly Detection Trishul M. Chilimbi Microsoft Research Redmond, WA trishulc@microsoft.com Vinod Ganapathy University of Wisconsin Madison, WI vg@cs.wisc.edu
Leveraging Data Invariants in Model Inference for Test Case Generation
Leveraging Data Invariants in Model Inference for Test Case Generation Roykrong Sukkerd Abstract Testing is an effective mean to find bugs in systems, but manually writing test cases is often tedious.
Using Software Transactional Memory In Interrupt-Driven Systems
Using Software Transactional Memory In Interrupt-Driven Systems Department of Mathematics, Statistics, and Computer Science Marquette University Thesis Defense Introduction Thesis Statement Software transactional
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
Mining Generalised Emerging Patterns
Mining Generalised Emerging Patterns Xiaoyuan Qian, James Bailey, Christopher Leckie Department of Computer Science and Software Engineering University of Melbourne, Australia {jbailey, caleckie}@csse.unimelb.edu.au
Topics in Systems and Program Security
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Topics in Systems and
MC: Meta-level Compilation
MC: Meta-level Compilation Extending the Process of Code Compilation with Application-Specific Information for the layman developer (code monkey) Gaurav S. Kc 8 th October, 2003 1 Outline Dawson Engler
SentinelOne Technical Brief
SentinelOne Technical Brief SentinelOne unifies prevention, detection and response in a fundamentally new approach to endpoint protection, driven by machine learning and intelligent automation. By rethinking
Assurance for Defense in Depth via Retrofitting
Assurance for Defense in Depth via Retrofitting Vinod Ganapathy Rutgers University vinodg@cs.rutgers.edu Trent Jaeger The Pennsylvania State University tjaeger@cse.psu.edu Gang Tan Lehigh University gtan@cse.lehigh.edu
Efficient Processing of Multiple DTW Queries in Time Series Databases
Efficient Processing of Multiple DTW Queries in Time Series Databases Hardy Kremer 1 Stephan Günnemann 1 Anca-Maria Ivanescu 1 Ira Assent 2 Thomas Seidl 1 1 RWTH Aachen University, Germany 2 Aarhus University,
Presentation Outline. Paper Summary. Introduction. Architecture. Workarounds. Method Validation. Future Work
Presentation Outline Paper Summary Introduction Architecture Workarounds Method Validation Future Work Paper Summary Objective: Using automatic workarounds as a form of self healing for component based
Tracerory - Dynamic Tracematches and Unread Memory Detection for C/C++
Tracerory - Dynamic Tracematches and Unread Memory Detection for C/C++ by Jonathan Eyolfson A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Master
Workload Characterization using the TAU Performance System
Workload Characterization using the TAU Performance System Sameer Shende, Allen D. Malony, and Alan Morris Performance Research Laboratory, Department of Computer and Information Science University of
CSE Computer Security
CSE 543 - Computer Security Lecture 17 - Language-based security October 25, 2007 URL: http://www.cse.psu.edu/~tjaeger/cse543-f07/ 1 Engineering Disaster? Millions of Bots Compromised applications Programming
ViryaOS RFC: Secure Containers for Embedded and IoT. A proposal for a new Xen Project sub-project
ViryaOS RFC: Secure Containers for Embedded and IoT A proposal for a new Xen Project sub-project Stefano Stabellini @stabellinist The problem Package applications for the target Contain all dependencies
Inductive Programming
Inductive Programming A Unifying Framework for Analysis and Evaluation of Inductive Programming Systems Hofmann, Kitzelmann, Schmid Cognitive Systems Group University of Bamberg AGI 2009 CogSys Group (Univ.
Justifying Integrity Using a Virtual Machine Verifier
Justifying Integrity Using a Virtual Machine Verifier Joshua Schiffman, Thomas Moyer, Christopher Shal, Trent Jaeger, and Patrick McDaniel ACSAC 09 1 1 Cloudy Horizons Utility-based cloud computing is
ISOLATION DEFENSES GRAD SEC OCT
ISOLATION DEFENSES GRAD SEC OCT 03 2017 ISOLATION Running untrusted code in a trusted environment Setting Possibly with multiple tenants OS: users / processes Browser: webpages / browser extensions Cloud:
A Characterization of Shared Data Access Patterns in UPC Programs
IBM T.J. Watson Research Center A Characterization of Shared Data Access Patterns in UPC Programs Christopher Barton, Calin Cascaval, Jose Nelson Amaral LCPC `06 November 2, 2006 Outline Motivation Overview
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
Optimal k-anonymity with Flexible Generalization Schemes through Bottom-up Searching
Optimal k-anonymity with Flexible Generalization Schemes through Bottom-up Searching Tiancheng Li Ninghui Li CERIAS and Department of Computer Science, Purdue University 250 N. University Street, West
Advanced Systems Security: Virtual Machine Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Copyright
1 Security Test EXTRA Workshop : ANSWER THESE QUESTIONS 1. What do you consider to be the biggest security issues with mobile phones? 2. How seriously are consumers and companies taking these threats?
CSCI 420: Mobile Application Security. Lecture 7. Prof. Adwait Nadkarni. Derived from slides by William Enck, Patrick McDaniel and Trent Jaeger
CSCI 420: Mobile Application Security Lecture 7 Prof. Adwait Nadkarni Derived from slides by William Enck, Patrick McDaniel and Trent Jaeger 1 cryptography < security Cryptography isn't the solution to
Indrajit Roy, Srinath T.V. Setty, Ann Kilzer, Vitaly Shmatikov, Emmett Witchel The University of Texas at Austin
Airavat: Security and Privacy for MapReduce Indrajit Roy, Srinath T.V. Setty, Ann Kilzer, Vitaly Shmatikov, Emmett Witchel The University of Texas at Austin Computing in the year 201X 2 Data Illusion of
Refinement Types for TypeScript
Refinement Types for TypeScript Panagiotis Vekris Benjamin Cosman Ranjit Jhala University of California, San Diego PLDI 16 Thursday, June 16 Extensible static analyses for modern scripting languages 2
Virtual Machine Security
Virtual Machine Security CSE443 - Spring 2012 Introduction to Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ 1 Operating System Quandary Q: What is the primary goal
Top Nine Kubernetes Settings You Should Check Right Now to Maximize Security
White Paper Top Nine Kubernetes Settings You Should Check Right Now to Maximize Security If you use Kubernetes, you know how much it can increase development velocity and reduce operational complexity.
Recognition of Animal Skin Texture Attributes in the Wild. Amey Dharwadker (aap2174) Kai Zhang (kz2213)
Recognition of Animal Skin Texture Attributes in the Wild Amey Dharwadker (aap2174) Kai Zhang (kz2213) Motivation Patterns and textures are have an important role in object description and understanding
Labels and Information Flow
Labels and Information Flow Robert Soulé March 21, 2007 Problem Motivation and History The military cares about information flow Everyone can read Unclassified Few can read Top Secret Problem Motivation
Microsoft Windows HPC Server 2008 R2 for the Cluster Developer
50291B - Version: 1 02 May 2018 Microsoft Windows HPC Server 2008 R2 for the Cluster Developer Microsoft Windows HPC Server 2008 R2 for the Cluster Developer 50291B - Version: 1 5 days Course Description:
Bionic. Christoph. Code analysis, quality and security overview. July 26 th 2017
Bionic Code analysis, quality and security overview Christoph July 26 th 2017 stat /proc/self PhD on reflective OS architectures FOSS enthusiast (Linux fan since kernel 0.95) Tech support @ FraLUG (including
Data Mining with Oracle 10g using Clustering and Classification Algorithms Nhamo Mdzingwa September 25, 2005
Data Mining with Oracle 10g using Clustering and Classification Algorithms Nhamo Mdzingwa September 25, 2005 Abstract Deciding on which algorithm to use, in terms of which is the most effective and accurate
Speculative Synchronization
Speculative Synchronization José F. Martínez Department of Computer Science University of Illinois at Urbana-Champaign http://iacoma.cs.uiuc.edu/martinez Problem 1: Conservative Parallelization No parallelization
Computer Security 3e. Dieter Gollmann. Chapter 5: 1
Computer Security 3e Dieter Gollmann www.wiley.com/college/gollmann Chapter 5: 1 Chapter 5: Access Control Chapter 5: 2 Introduction Access control: who is allowed to do what? Traditionally, who is a person.
Automated Documentation Inference to Explain Failed Tests
Automated Documentation Inference to Explain Failed Tests Sai Zhang University of Washington Joint work with: Cheng Zhang, Michael D. Ernst A failed test reveals a potential bug Before bug-fixing, programmers
OS Structure. Kevin Webb Swarthmore College January 25, Relevant xkcd:
OS Structure Kevin Webb Swarthmore College January 25, 2018 Relevant xkcd: One of the survivors, poking around in the ruins with the point of a spear, uncovers a singed photo of Richard Stallman. They
Generating String Attack Inputs Using Constrained Symbolic Execution. presented by Kinga Dobolyi
Generating String Attack Inputs Using Constrained Symbolic Execution presented by Kinga Dobolyi What is a String Attack? Web applications are 3 tiered Vulnerabilities in the application layer Buffer overruns,
Screen Fingerprints: A Novel Modality for Active Authentication
Security: DArPA Screen Fingerprints: A Novel Modality for Active Authentication Vishal M. Patel, University of Maryland, College Park Tom Yeh, University of Colorado, Boulder Mohammed E. Fathy and Yangmuzi
Equivalence Class Partitioning. Equivalence Partitioning. Definition and Example. Example set of classes
Equivalence Class Partitioning Equivalence Partitioning From S. Somé, A. Williams 1 Suppose that we were going to test a method that implements the absolute value function for integers. Definition public
Improving Error Checking and Unsafe Optimizations using Software Speculation. Kirk Kelsey and Chen Ding University of Rochester
Improving Error Checking and Unsafe Optimizations using Software Speculation Kirk Kelsey and Chen Ding University of Rochester Outline Motivation Brief problem statement How speculation can help Our software
Operating System Security, Continued CS 136 Computer Security Peter Reiher January 29, 2008
Operating System Security, Continued CS 136 Computer Security Peter Reiher January 29, 2008 Page 1 Outline Designing secure operating systems Assuring OS security TPM and trusted computing Page 2 Desired
Today Program Analysis for finding bugs, especially security bugs problem specification motivation approaches remaining issues
Finding Bugs Last time Run-time reordering transformations Today Program Analysis for finding bugs, especially security bugs problem specification motivation approaches remaining issues CS553 Lecture Finding
Chapter 14: Protection. Operating System Concepts 9 th Edition
Chapter 14: Protection Silberschatz, Galvin and Gagne 2013 Chapter 14: Protection Goals of Protection Principles of Protection Domain of Protection Access Matrix Implementation of Access Matrix Access
Advanced Systems Security: Ordinary Operating Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
IS THERE A HOLE IN YOUR RISC-V SECURITY STACK? JOTHY ROSENBERG DOVER MICROSYSTEMS
IS THERE A HOLE IN YOUR RISC-V SECURITY STACK? JOTHY ROSENBERG DOVER MICROSYSTEMS I understand the difference in destruction is dramatic, but this has a whiff of August 1945. Someone just used a new weapon,
Combining program verification with component-based architectures. Alexander Senier BOB 2018 Berlin, February 23rd, 2018
Combining program verification with component-based architectures Alexander Senier BOB 2018 Berlin, February 23rd, 2018 About Componolit 2 What happens when we use what's best? 3 What s Best? Mid-90ies:
STING: Finding Name Resolution Vulnerabilities in Programs
STING: Finding Name Resolution ulnerabilities in Programs Hayawardh ijayakumar, Joshua Schiffman, Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department
Zing Vision. Answering your toughest production Java performance questions
Zing Vision Answering your toughest production Java performance questions Outline What is Zing Vision? Where does Zing Vision fit in your Java environment? Key features How it works Using ZVRobot Q & A
A Comparison of Capacity Management Schemes for Shared CMP Caches
A Comparison of Capacity Management Schemes for Shared CMP Caches Carole-Jean Wu and Margaret Martonosi Princeton University 7 th Annual WDDD 6/22/28 Motivation P P1 P1 Pn L1 L1 L1 L1 Last Level On-Chip
Low level security. Andrew Ruef
Low level security Andrew Ruef What s going on Stuff is getting hacked all the time We re writing tons of software Often with little regard to reliability let alone security The regulatory environment
Advanced Systems Security: Security Goals
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Infrastructure Middleware (Part 1): Hardware Abstraction Layer (HAL)
Infrastructure Middleware (Part 1): Douglas C. Schmidt d.schmidt@vanderbilt.edu www.dre.vanderbilt.edu/~schmidt Institute for Software Integrated Systems Vanderbilt University Nashville, Tennessee, USA
LDetector: A low overhead data race detector for GPU programs
LDetector: A low overhead data race detector for GPU programs 1 PENGCHENG LI CHEN DING XIAOYU HU TOLGA SOYATA UNIVERSITY OF ROCHESTER 1 Data races in GPU Introduction & Contribution Impact correctness
Large-Scale API Protocol Mining for Automated Bug Detection
Large-Scale API Protocol Mining for Automated Bug Detection Michael Pradel Department of Computer Science ETH Zurich 1 Motivation LinkedList pinconnections =...; Iterator i = pinconnections.iterator();