A Building Block Approach to Intrusion Detection
|
|
|
- Jared Allison
- 6 years ago
- Views:
Transcription
1 A Building Block Approach to Intrusion Detection Mark J. Crosbie Hewlett-Packard Company Benjamin A. Kuperman CERIAS, Purdue University 1
2 Who are we? Mark Crosbie Security Architect at Hewlett-Packard Designed and implemented IDS/9000 Benjamin Kuperman PhD student at CERIAS, Purdue Worked with HP on IDS/9000 Designed and implemented detection templates 2
3 For more information... Product is available for zero-cost for HP-UX 11.0 and 11i systems. Download from Part number is J5083AA More information at Contact Mark Crosbie for further details. 3
4 What did we build? Kernel level audit source designed to support Intrusion Detection. An analysis engine that dynamically loads/unloads configurable detection template bytecode. Detection templates Detect the building blocks of intrusions. Automated intrusion response mechanism. GUI, manual, product support, etc etc... 4
5 5
6 Why choose system call audit? Kernel has the only reliable view of system state. System calls do not have unintended side effects (compare to library audit). Trustworthiness of data. Ambiguity can be resolved at kernel level: mapping inodes/file descriptors to pathnames. symbolic/hard links, chroot. Reliable capture of before and after state. 6
7 Requirement of audit system Audit record must capture as much state as possible. Save before/after state of objects for modification actions (e.g. chmod, chown). Do not query system while processing record. Resolve ambiguity in the kernel symbolic links, hard links. inodes mapped to pathnames. chroot environments. Data format must be machine parseable. Data presented in timely and efficient manner. 7
8 What is a Building Block? Attacks Definition: An abstraction of attack activities undertaken to exploit a vulnerability. Building Blocks Vulnerabilities 8
9 Building Blocks Detected Login/logout activities, including su. Local and remote filesystem changes: Directories and files. Creation, deletion, attribute changes. Changes to files owned by others. Unusual Log file modifications. Creation of setuid backdoors. Race condition (TOCTTOU) attacks. Unexpected change in privileges. 9
10 Some sample alerts Unexpected change in privilege levels with UID:100(GID:20) EUID:0(EGID:20) executing /usr/bin/ksh(1,42 246," ") with arguments["/usr/bin/ksh", "-c", "foobar"] and system call kern_setuid as PID:19854 UID:0 (EUID:0) Reference:/dev/emsagent_fifo currently kern_open:/dev/emsagent_fifo(8,1282," ") was kern_mknod:/dev/emsagent_fifo(0,-1,"ffffffff") program running is /etc/opt/resmon/lbin/emsagent(1,1429," ") with arguments ["/etc/opt/resmon/lbin/emsagent"] probable ATTACKER was UID:10 User 0 opened for modification/truncation "/etc/opt/resmon/pipe/ " executing /etc/opt/resmon/lbin/p_client(1,473," ") with arguments ["/etc/opt/resmon/lbin/p_client"] as PID:
11 Automated Response Active response to a recent intrusion event. Examples of responses: Locking a user account. Collecting additional system state information. Recovering from configuration changes. E.g. changes made under /etc Recovering from Trojan Horses: Replacing files changed in /sbin or /usr/bin. Recovering from a web server hack. rsync web pages from remote source/cdrom. 11
12 Performance Difficult to measure - why? What is a typical system load? How is the IDS to be configured? Rate of intrusive activity? Bursty? How to measure performance impact? System throughput, CPU time, response time. IDS load, IDS throughput, IDS response time. See paper for more details on our performance tests. 12
13 What IDS/9000 does not do. Does not fix pre-existing vulnerabilities. Does not prevent activities from occurring. Does not detect changes made to local filesystems mounted on remote systems. No file signature scanning. Not currently a network IDS. 13
14 Conclusions Possible to detect Building Blocks of intrusions. By building the IDS and audit system together: More context for making decisions. Reliable detection. Data is tailored to detection. IDS can be used for more than security tasks: monitor admins, misbehaving programs Performance measurement is environmentally sensitive. 14
Data Security and Privacy. Unix Discretionary Access Control
Data Security and Privacy Unix Discretionary Access Control 1 Readings for This Lecture Wikipedia Filesystem Permissions Other readings UNIX File and Directory Permissions and Modes http://www.hccfl.edu/pollock/aunix1/filepermissions.htm
A Building Block Approach to Intrusion Detection
A Building Block Approach to Intrusion Detection Mark J. Crosbie Hewlett-Packard Company Cupertino, CA 95014 mcrosbie@cup.hp.com Benjamin A. Kuperman CERIAS, Purdue University West Lafayette, IN 47907
OS Security III: Sandbox and SFI
1 OS Security III: Sandbox and SFI Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab2 VMs on lab machine Extension? 3 Users and processes FACT: although ACLs use users as subject, the OS
Hardware. Ahmet Burak Can Hacettepe University. Operating system. Applications programs. Users
Operating System Security Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr Computer System Components Hardware Provides basic computing resources (CPU, memory, I/O devices). Operating system Controls
Operating System Security
Operating System Security Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr 1 Computer System Components Hardware Provides basic computing resources (CPU, memory, I/O devices). Operating system
Processes are subjects.
Identification and Authentication Access Control Other security related things: Devices, mounting filesystems Search path Race conditions NOTE: filenames may differ between OS/distributions Principals
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 13: Operating System Security Department of Computer Science and Engineering University at Buffalo 1 Review Previous topics access control authentication session
Secure Architecture Principles
Computer Security Course. Secure Architecture Principles Slides credit: Dan Boneh What Happens if you can t drop privilege? In what example scenarios does this happen? A service loop E.g., ssh Solution?
Computer Security. 04r. Pre-exam 1 Concept Review. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 04r. Pre-exam 1 Concept Review Paul Krzyzanowski Rutgers University Spring 2018 February 15, 2018 CS 419 2018 Paul Krzyzanowski 1 Key ideas from the past four lectures February 15, 2018
Symlink attacks. Do not assume that symlinks are trustworthy: Example 1
Symlink attacks Do not assume that symlinks are trustworthy: Example 1 Application A creates a file for writing in /tmp. It assumes that since the file name is unusual, or because it encodes A's name or
Discretionary Access Control
Operating System Security Discretionary Seong-je Cho ( 조성제 ) (sjcho at dankook.ac.kr) Fall 2018 Computer Security & Operating Systems Lab, DKU - 1-524870, F 18 Discretionary (DAC) Allows the owner of the
Information Security CS 526
Information Security CS 526 s Security Basics & Unix Access Control 1 Readings for This Lecture Wikipedia CPU modes System call Filesystem Permissions Other readings UNIX File and Directory Permissions
TOCTTOU Vulnerabilities in UNIX-Style File Systems: An Anatomical Study
TOCTTOU Vulnerabilities in UNIX-Style File Systems: An Anatomical Study Jinpeng Wei and Calton Pu Georgia Institute of Technology 4th USENIX Conference on File and Storage Technologies December 15, 2005.
3/7/18. Secure Coding. CYSE 411/AIT681 Secure Software Engineering. Race Conditions. Concurrency
Secure Coding CYSE 411/AIT681 Secure Software Engineering Topic #13. Secure Coding: Race Conditions Instructor: Dr. Kun Sun String management Pointer Subterfuge Dynamic memory management Integer security
Operating system security models
Operating system security models Unix security model Windows security model MEELIS ROOS 1 General Unix model Everything is a file under a virtual root diretory Files Directories Sockets Devices... Objects
Dynamic Detection and Prevention of Race Conditions in File Accesses
Dynamic Detection and Prevention of Race Conditions in File Accesses Eugene Tsyrklevich eugene@securityarchitects.com Outline What are race conditions? How can we prevent them? Implementation description
CIS 5373 Systems Security
CIS 5373 Systems Security Topic 3.1: OS Security Basics of secure design Endadul Hoque Slide Acknowledgment Contents are based on slides from Ninghui Li (Purdue), John Mitchell (Stanford), Dan Boneh (Stanford)
I m paranoid, but am I paranoid enough? Steven M. Bellovin February 20,
I m paranoid, but am I paranoid enough? Steven M. Bellovin February 20, 2007 1 Special Techniques for Secure Programs Buffer overflows are bad in any case Some problems are only a risk for secure programs
CIS Operating Systems File Systems Security. Professor Qiang Zeng Fall 2017
CIS 5512 - Operating Systems File Systems Security Professor Qiang Zeng Fall 2017 Previous class File and directory Hard link and soft link Mount Layered structure File system design Naïve: linked list
Secure Software Programming and Vulnerability Analysis
Secure Software Programming and Vulnerability Analysis Christopher Kruegel chris@auto.tuwien.ac.at http://www.auto.tuwien.ac.at/~chris Race Conditions Secure Software Programming 2 Overview Parallel execution
Strategic Infrastructure Security
Strategic Infrastructure Security Course Number: SCPSIS Length: Certification Exam There are no exams currently associated with this course. Course Overview This course picks up right where Tactical Perimeter
CYSE 411/AIT681 Secure Software Engineering Topic #13. Secure Coding: Race Conditions
CYSE 411/AIT681 Secure Software Engineering Topic #13. Secure Coding: Race Conditions Instructor: Dr. Kun Sun 1 Secure Coding String management Pointer Subterfuge Dynamic memory management Integer security
Security. Advanced Operating Systems and Virtualization Alessandro Pellegrini A.Y. 2017/2018
Security Advanced Operating Systems and Virtualization Alessandro Pellegrini A.Y. 2017/2018 Basic Security Aspects 1. Systems must be usable by legitimate users only 2. Access is granted on the basis of
Exploiting Unix File-System Races via Algorithmic Complexity Attacks
Exploiting Unix File-System Races via Algorithmic Complexity Attacks Xiang Cai, Yuwei Gui, and Rob Johnson (Stony Brook University). IEEE Symposium on Security and Privacy, May 2009. Agenda Introduction
An active intrusion-confronting system using fake session and honeypot
An active intrusion-confronting system using fake session and honeypot Myung-Sub Lee, Chang-Hyeon Park Department of Computer Engineering Yeungnam University, #214-1, Dae-dong, Kyungsan, Kyungbuk, 712-749,
Pre-Assessment Answers-1
Pre-Assessment Answers-1 0Pre-Assessment Answers Lesson 1 Pre-Assessment Questions 1. What is the name of a statistically unique number assigned to all users on a Windows 2000 system? a. A User Access
Advanced Systems Security: Ordinary Operating Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Anatomy of a Real-Time Intrusion Prevention System
Anatomy of a Real-Time Intrusion Prevention System Koller, R.; Rangaswami, R.; Marrero, J.; Hernandez, I.; Smith, G.; Barsilai, M.; Necula, S.; Sadjadi, S.M.; Tao Li; Merrill, K., Autonomic Computing,
Sandboxing. (1) Motivation. (2) Sandboxing Approaches. (3) Chroot
Sandboxing (1) Motivation Depending on operating system to do access control is not enough. For example: download software, virus or Trojan horse, how to run it safely? Risks: Unauthorized access to files,
Exploiting capabilities Parcel root power, the dark side of capabilities
Exploiting capabilities Parcel root power, the dark side of capabilities Date of writing : 14/05/2010 Author : Emeric Nasi emeric.nasi@sevagas.com Note : In order to understand this document it is strongly
Software Security and Exploitation
COMS E6998-9: 9: Software Security and Exploitation Lecture 8: Fail Secure; DoS Prevention; Evaluating Components for Security Hugh Thompson, Ph.D. hthompson@cs.columbia.edu Failing Securely and Denial
IDS: Signature Detection
IDS: Signature Detection Idea: What is bad, is known What is not bad, is good Determines whether a sequence of instructions being executed is known to violate the site security policy Signatures: Descriptions
CS 356 Operating System Security. Fall 2013
CS 356 Operating System Security Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5 Database
0x1A Great Papers in Computer Security
CS 380S 0x1A Great Papers in Computer Security Vitaly Shmatikov http://www.cs.utexas.edu/~shmat/courses/cs380s/ slide 1 After All Else Fails Intrusion prevention Find buffer overflows and remove them Use
Information System Audit Engr. Abdul-Rahman Mahmood MS, PMP, MCP, QMR(ISO9001:2000)
Information System Audit Engr. Abdul-Rahman Mahmood MS, PMP, MCP, QMR(ISO9001:2000) armahmood786@yahoo.com alphasecure@gmail.com alphapeeler.sf.net/pubkeys/pkey.htm http://alphapeeler.sourceforge.net pk.linkedin.com/in/armahmood
system to cover their tracks, the HIDS can provide an independent audit trail of the attack.
A host-based IDS (HIDS) works differently from a network-based version of IDS. While a network-based IDS resides on a network segment and monitors activities across that segment, a host-based IDS resides
intelop Stealth IPS false Positive
There is a wide variety of network traffic. Servers can be using different operating systems, an FTP server application used in the demilitarized zone (DMZ) can be different from the one used in the corporate
Outline. UNIX security ideas Users and groups File protection Setting temporary privileges. Examples. Permission bits Program language components
UNIX security Ulf Larson (modified by Erland Jonsson/Magnus Almgren) Computer security group Dept. of Computer Science and Engineering Chalmers University of Technology, Sweden Outline UNIX security ideas
Processes are subjects.
Identification and Authentication Access Control Other security related things: Devices, mounting filesystems Search path TCP wrappers Race conditions NOTE: filenames may differ between OS/distributions
Introduction to Linux
Introduction to Operating Systems All computers that we interact with run an operating system There are several popular operating systems Operating Systems OS consists of a suite of basic software Operating
Managing and Maintaining a Microsoft Windows Server 2003 Environment
COURSE OVERVIEW This course combines five days of instructor-led training with additional e-learning content to provide students with the knowledge and skills that are required to manage accounts and resources,
The Taser Intrusion Recovery System
The Taser Intrusion Recovery System Ashvin Goel, Kenneth Po, Kamran Farhadi, Zheng Li, Eyal de Lara Dept. of Electrical and Computer Engineering, Dept. of Computer Science University of Toronto ABSTRACT
DETERMINING INTRUSION ACTIVITY FOR FILE-SYSTEM RECOVERY. Kai Yi Po
DETERMINING INTRUSION ACTIVITY FOR FILE-SYSTEM RECOVERY by Kai Yi Po A thesis submitted in conformity with the requirements for the degree of Master of Applied Science Graduate Department of Electrical
CSE543 - Introduction to Computer and Network Security. Module: Operating System Security
CSE543 - Introduction to Computer and Network Security Module: Operating System Security Professor Trent Jaeger 1 OS Security An secure OS should provide (at least) the following mechanisms Memory protection
Ehi Ethical Hacking and Countermeasures Version 6. MAC OS X Hacking
Ehi Ethical Hacking and Countermeasures Version 6 Module XXXIV MAC OS X Hacking News Source: http://www.zdnet.com.au/ Module Objective This module will familiarize you with: Introduction to MAC OS Vulnerabilities
I m paranoid, but am I paranoid enough? Steven M. Bellovin October 2,
I m paranoid, but am I paranoid enough? Steven M. Bellovin October 2, 2008 1 Special Techniques for Secure Programs Buffer overflows are bad in any case Some problems are only a risk for secure programs
Secure Programming II. Steven M. Bellovin September 29,
Secure Programming II Steven M. Bellovin September 29, 2014 1 I m paranoid, but am I paranoid enough? Steven M. Bellovin September 29, 2014 2 Special Techniques for Secure Programs Buffer overflows are
Exercise 4: Access Control and Filesystem Security
Exercise 4: Access Control and Filesystem Security Introduction Duration: 90 min Maximum Points: 30 Note: The solutions of theorethical assignments should be handed out before the practical part in the
Datasäkerhet/Data security EDA625 Lect5
Ch. 6 Unix security Datasäkerhet/Data security EDA625 Lect5 Understand the security features of a typical operating system Users/passwords login procedure user superuser (root) access control (chmod) devices,
STING: Finding Name Resolution Vulnerabilities in Programs
STING: Finding Name Resolution ulnerabilities in Programs Hayawardh ijayakumar, Joshua Schiffman, Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department
Unit 2: Manage Files Graphically with Nautilus Objective: Manage files graphically and access remote systems with Nautilus
Linux system administrator-i Unit 1: Get Started with the GNOME Graphical Desktop Objective: Get started with GNOME and edit text files with gedit Unit 2: Manage Files Graphically with Nautilus Objective:
TEL2821/IS2150: INTRODUCTION TO SECURITY Lab: Operating Systems and Access Control
TEL2821/IS2150: INTRODUCTION TO SECURITY Lab: Operating Systems and Access Control Version 1.0, Last Edited 09/20/2005 Name of Students: Date of Experiment: Part I: Objective The objective of the exercises
11/3/71 SYS BREAK (II)
11/3/71 SYS BREAK (II) break -- set program break SYNOPSIS sys break; addr / break = 17. break sets the system s idea of the highest location used by the program to addr. Locations greater than addr and
File System. yihshih
File System yihshih Files % ls l d rwx--x--x 7 wutzh gcs 1024 Sep 22 17:25 public_html File type File access mode # of links File user owner File group owner File size File last modify time 2 File name
An efficient method to avoid path lookup in file access auditing in IO path to improve file system IO performance
Technical Disclosure Commons Defensive Publications Series March 21, 2017 An efficient method to avoid path lookup in file access auditing in IO path to improve file system IO performance Arun Vishnu P
6.858 Lecture 4 OKWS. Today's lecture: How to build a secure web server on Unix. The design of our lab web server, zookws, is inspired by OKWS.
6.858 Lecture 4 OKWS Administrivia: Lab 1 due this Friday. Today's lecture: How to build a secure web server on Unix. The design of our lab web server, zookws, is inspired by OKWS. Privilege separation
2. INTRUDER DETECTION SYSTEMS
1. INTRODUCTION It is apparent that information technology is the backbone of many organizations, small or big. Since they depend on information technology to drive their business forward, issues regarding
Linux System Administration
System Processes Objective At the conclusion of this module, the student will be able to: Describe and define a process Identify a process ID, the parent process and the child process Learn the PID for
Operating Systems Security
Operating Systems Security CS 166: Introduction to Computer Systems Security 1 Acknowledgements Materials from the CS167 lecture slides by Tom Doeppner included with permission Some slides 2016-2018 J.
A Prevention Model for Algorithmic Complexity Attacks
A Prevention Model for Algorithmic Complexity Attacks Ms Suraiya Khan, Dr Issa Traore Information Security and Object Technology (ISOT) Lab University of Victoria Victoria, BC, Canada http://www.isot.ece.uvic.ca
Protection. CSE473 - Spring Professor Jaeger. CSE473 Operating Systems - Spring Professor Jaeger
Protection CSE473 - Spring 2008 Professor Jaeger www.cse.psu.edu/~tjaeger/cse473-s08/ Protection Protect yourself from untrustworthy users in a common space They may try to access your resources Or modify
Defense-in-Depth Against Malicious Software. Speaker name Title Group Microsoft Corporation
Defense-in-Depth Against Malicious Software Speaker name Title Group Microsoft Corporation Agenda Understanding the Characteristics of Malicious Software Malware Defense-in-Depth Malware Defense for Client
MASSACHUSETTS INSTITUTE OF TECHNOLOGY Fall Quiz II
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.893 Fall 2009 Quiz II All problems are open-ended questions. In order to receive credit you must answer
Wrapup. CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger.
Wrapup CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/ Final 2 The final is on Tuesday, May 8, 8:00 in 160 Willard (here) Be late
IMC inode Intelligent Client v7.0 (E0106) Copyright (c) Hewlett-Packard Development Company, L.P. and its licensors.
IMC inode Intelligent Client v7.0 (E0106) Copyright (c) 2011-2014 Hewlett-Packard Development Company, L.P. and its licensors. Table of Contents 1. What's New in this Release 2. Problems Fixed in this
ACS / Computer Security And Privacy. Fall 2018 Mid-Term Review
ACS-3921-001/4921-001 Computer Security And Privacy Fall 2018 Mid-Term Review ACS-3921/4921-001 Slides Used In The Course A note on the use of these slides: These slides has been adopted and/or modified
General Pr0ken File System
General Pr0ken File System Hacking IBM s GPFS Felix Wilhelm & Florian Grunow 11/2/2015 GPFS Felix Wilhelm && Florian Grunow #2 Agenda Technology Overview Digging in the Guts of GPFS Remote View Getting
Filesystem Hierarchy and Permissions
2 and Prepared by Steven Gordon on 19 April 2017 Common/Reports/linux-file-permissions.tex, r1417 1 Multiuser and Server Operating System systems are commonly used as a multi-user system E.g. multiple
lsx [ls_options ] [names]
![lsx [ls_options ] [names]](/thumbs/74/71205615.jpg "lsx [ls_options ] [names]")
NAME ls, lc, l, ll, lsf, lsr, lsx - list contents of directories SYNOPSIS ls [-abcdefgilmnopqrstuxacfhlr1] [names] lc [-abcdefgilmnopqrstuxacfhlr1] [names] l [ls_options ] [names] ll [ls_options ] [names]
Filesystem Hierarchy and Permissions
and Linux Prepared by Steven Gordon on 19 April 2017 Common/Reports/linux-file-permissions.tex, r1417 1/15 Multiuser and Server Operating System Linux systems are commonly used as a multi-user system E.g.
Hackveda Training - Ethical Hacking, Networking & Security
Hackveda Training - Ethical Hacking, Networking & Security Day1: Hacking windows 7 / 8 system and security Part1 a.) Windows Login Password Bypass manually without CD / DVD b.) Windows Login Password Bypass
CIS 5373 Systems Security
CIS 5373 Systems Security Topic 3.2: OS Security Access Control Endadul Hoque Slide Acknowledgment Contents are based on slides from Ninghui Li (Purdue), John Mitchell (Stanford), Bogdan Carbunar (FIU)
Do as I Say not as I Do Stealth Modification of Programmable Logic Controllers I/O by Pin Control Attack
Do as I Say not as I Do Stealth Modification of Programmable Logic Controllers I/O by Pin Control Attack ALI ABBASI SYSSEC GROUP, RUHR UNIVERSITY BOCHUM, GERMANY & SCS GROUP UNIVERSITY OF TWENTE, NETHERLANDS
Different attack manifestations Network packets OS calls Audit records Application logs Different types of intrusion detection Host vs network IT
Different attack manifestations Network packets OS calls Audit records Application logs Different types of intrusion detection Host vs network IT environment (e.g., Windows vs Linux) Levels of abstraction
Linux Capabilities & Set-UID Vulnerability
Copyright: The development of this document is funded by Higher Education of Academy. Permission is granted to copy, distribute and /or modify this document under a license compliant with the Creative
Files. Computer Center, CS, NCTU. % ls l. d rwx--x--x 7 liuyh gcs 1024 Sep 22 17:25 public_html. File type. File access mode.
File System Files % ls l d rwx--x--x 7 liuyh gcs 1024 Sep 22 17:25 public_html File type File access mode # of inodes File user owner File group owner File size File last modify time 2 File name Outline
Building blocks for Unix power tools
for Unix power tools Now that we have given a good overview of a lot of the better Unix tools, I want to take some time to talk about our toolset for building Unix programs. The most important of these
University of Wisconsin-Madison
Evolving RPC for Active Storage Muthian Sivathanu Andrea C. Arpaci-Dusseau Remzi H. Arpaci-Dusseau University of Wisconsin-Madison Architecture of the future Everything is active Cheaper, faster processing
Saving the Project Brief document under its own name
HOW TO USE THIS TEMPLATE: Introduction The template reflects the steps set out in the PRINCE2 Method and is designed to prompt the Project Manager and help in the creation of the. The information for the
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 6 Intrusion Detection First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Intruders significant issue hostile/unwanted
Advanced Systems Security: Confused Deputy
Advanced Systems Security: Confused Deputy Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University 1 Talk Outline
Confinement (Running Untrusted Programs)
Confinement (Running Untrusted Programs) Chester Rebeiro Indian Institute of Technology Madras Untrusted Programs Untrusted Application Entire Application untrusted Part of application untrusted Modules
Understanding user namespaces
Understanding user namespaces Understanding user namespaces Michael Kerrisk, man7.org c 2018 mtk@man7.org 31 January 2018, San Jose, CA, USA Outline 1 Introduction 3 2 Some background: capabilities 6 3
HP-UX Security I. Ideal candidate for this course Experienced system and network administrators responsible for securing and monitoring HP-UX systems
Course Data Sheet HP-UX Security I Course description This course teaches you about the most common HP-UX system security vulnerabilities, and introduces a variety of tools and techniques that can be used
CS 380S. TOCTTOU Attacks. Don Porter. Some slides courtesy Vitaly Shmatikov and Emmett Witchel. slide 1
CS 380S TOCTTOU Attacks Don Porter Some slides courtesy Vitaly Shmatikov and Emmett Witchel slide 1 Definitions TOCTTOU Time of Check To Time of Use Check Establish some precondition (invariant), e.g.,
TEL2821/IS2150: INTRODUCTION TO SECURITY Lab: Operating Systems and Access Control
TEL2821/IS2150: INTRODUCTION TO SECURITY Lab: Operating Systems and Access Control Version 2.0, Last Edited 10/1/2006 Students Name: Date of Experiment: Part I: Objective The objective of the exercises
SINGLE COURSE. NH9000 Certified Ethical Hacker 104 Total Hours. COURSE TITLE: Certified Ethical Hacker
NH9000 Certified Ethical Hacker 104 Total Hours COURSE TITLE: Certified Ethical Hacker COURSE OVERVIEW: This class will immerse the student into an interactive environment where they will be shown how
Standard Content Guide
Standard Content Guide Express Express 4.0 with CORR-Engine March 12, 2013 Copyright 2013 Hewlett-Packard Development Company, L.P. Confidential computer software. Valid license from HP required for possession,
CS390S, Week 6: Shells and Environment
CS390S, Week 6: Shells and Environment Pascal Meunier, Ph.D., M.Sc., CISSP February 13, 2008 Developed thanks to support and contributions from Symantec Corporation, support from the NSF SFS Capacity Building
ADVANCED OPERATING SYSTEMS
ADVANCED OPERATING SYSTEMS UNIT I INTRODUCTION TO UNIX/LINUX KERNEL BY MR.PRASAD SAWANT Prof.Prasad Sawant,Assitiant Professor,Dept. Of CS PCCCS PREREQUISITES: 1. Working knowledge of C programming. 2.
HP - HP0-P17. HP-UX 11i v3 Security Administration. QUESTION: 1 After running /usr/sbin/pwck, the following output is displayed:
1 HP - HP0-P17 HP-UX 11i v3 Security Administration QUESTION: 1 After running /usr/sbin/pwck, the following output is displayed: smbnull:*:101:101::/home/smbnull:/sbin/sh Login directory not found What
CS140 Operating Systems Final December 12, 2007 OPEN BOOK, OPEN NOTES
CS140 Operating Systems Final December 12, 2007 OPEN BOOK, OPEN NOTES Your name: SUNet ID: In accordance with both the letter and the spirit of the Stanford Honor Code, I did not cheat on this exam. Furthermore,
Introduction to Computer Security
Introduction to Computer Security UNIX Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Genesis: UNIX vs. MULTICS MULTICS (Multiplexed Information and Computing Service) a high-availability,
Access Control. CMPSC Spring 2012 Introduction Computer and Network Security Professor Jaeger.
Access Control CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ Access Control Describe the permissions available to computing processes
CS 642 Homework #4. Due Date: 11:59 p.m. on Tuesday, May 1, Warning!
CS 642 Homework #4 Due Date: 11:59 p.m. on Tuesday, May 1, 2007 Warning! In this assignment, you will construct and launch attacks against a vulnerable computer on the CS network. The network administrators
IBM V7000 Unified R1.4.2 Asynchronous Replication Performance Reference Guide
V7 Unified Asynchronous Replication Performance Reference Guide IBM V7 Unified R1.4.2 Asynchronous Replication Performance Reference Guide Document Version 1. SONAS / V7 Unified Asynchronous Replication
HP Data Protector A disaster recovery support for Microsoft Windows 7 and Windows Server 2008 R2
HP Data Protector A.06.11 disaster recovery support for Microsoft Windows 7 and Windows Server 2008 R2 Technical white paper Table of contents Introduction... 2 Installation... 2 Preparing for Disaster
412 Notes: Filesystem
412 Notes: Filesystem A. Udaya Shankar shankar@cs.umd.edu December 5, 2012 Contents 1 Filesystem interface 2 2 Filesystem implementation 3 3 FAT (mostly from Wikepedia) 5 4 UFS (mostly from Wikepedia)
Enterprise Network Security. Accessing the WAN Chapter 4
Enterprise Network Security Accessing the WAN Chapter 4 ITE I Chapter 6 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Objectives Describe the general methods used to mitigate security threats
.NET Secure Coding for Client-Server Applications 4-Day hands on Course. Course Syllabus
.NET Secure Coding for Client-Server Applications 4-Day hands on Course Course Syllabus Course description.net Secure Coding for Client-Server Applications 4-Day hands on Course Secure programming is the