28
+ − 1 \documentclass[dvipsnames,14pt,t]{beamer}
+ − 2 \usepackage{beamerthemeplainculight}
+ − 3 \usepackage[T1]{fontenc}
+ − 4 \usepackage[latin1]{inputenc}
+ − 5 \usepackage{mathpartir}
+ − 6 \usepackage[absolute,overlay]{textpos}
+ − 7 \usepackage{ifthen}
+ − 8 \usepackage{tikz}
+ − 9 \usepackage{pgf}
+ − 10 \usepackage{calc}
+ − 11 \usepackage{ulem}
+ − 12 \usepackage{courier}
+ − 13 \usepackage{listings}
+ − 14 \renewcommand{\uline}[1]{#1}
+ − 15 \usetikzlibrary{arrows}
+ − 16 \usetikzlibrary{automata}
+ − 17 \usetikzlibrary{shapes}
+ − 18 \usetikzlibrary{shadows}
+ − 19 \usetikzlibrary{positioning}
+ − 20 \usetikzlibrary{calc}
+ − 21 \usepackage{graphicx}
+ − 22
+ − 23 \definecolor{javared}{rgb}{0.6,0,0} % for strings
+ − 24 \definecolor{javagreen}{rgb}{0.25,0.5,0.35} % comments
+ − 25 \definecolor{javapurple}{rgb}{0.5,0,0.35} % keywords
+ − 26 \definecolor{javadocblue}{rgb}{0.25,0.35,0.75} % javadoc
+ − 27
+ − 28 \lstset{language=Java,
+ − 29 basicstyle=\ttfamily,
+ − 30 keywordstyle=\color{javapurple}\bfseries,
+ − 31 stringstyle=\color{javagreen},
+ − 32 commentstyle=\color{javagreen},
+ − 33 morecomment=[s][\color{javadocblue}]{/**}{*/},
+ − 34 numbers=left,
+ − 35 numberstyle=\tiny\color{black},
+ − 36 stepnumber=1,
+ − 37 numbersep=10pt,
+ − 38 tabsize=2,
+ − 39 showspaces=false,
+ − 40 showstringspaces=false}
+ − 41
+ − 42 \lstdefinelanguage{scala}{
+ − 43 morekeywords={abstract,case,catch,class,def,%
+ − 44 do,else,extends,false,final,finally,%
+ − 45 for,if,implicit,import,match,mixin,%
+ − 46 new,null,object,override,package,%
+ − 47 private,protected,requires,return,sealed,%
+ − 48 super,this,throw,trait,true,try,%
+ − 49 type,val,var,while,with,yield},
+ − 50 otherkeywords={=>,<-,<\%,<:,>:,\#,@},
+ − 51 sensitive=true,
+ − 52 morecomment=[l]{//},
+ − 53 morecomment=[n]{/*}{*/},
+ − 54 morestring=[b]",
+ − 55 morestring=[b]',
+ − 56 morestring=[b]"""
+ − 57 }
+ − 58
+ − 59 \lstset{language=Scala,
+ − 60 basicstyle=\ttfamily,
+ − 61 keywordstyle=\color{javapurple}\bfseries,
+ − 62 stringstyle=\color{javagreen},
+ − 63 commentstyle=\color{javagreen},
+ − 64 morecomment=[s][\color{javadocblue}]{/**}{*/},
+ − 65 numbers=left,
+ − 66 numberstyle=\tiny\color{black},
+ − 67 stepnumber=1,
+ − 68 numbersep=10pt,
+ − 69 tabsize=2,
+ − 70 showspaces=false,
+ − 71 showstringspaces=false}
+ − 72
+ − 73 % beamer stuff
+ − 74 \renewcommand{\slidecaption}{APP 02, King's College London, 9 October 2012}
+ − 75
+ − 76
+ − 77 \begin{document}
+ − 78
+ − 79 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 80 \mode<presentation>{
+ − 81 \begin{frame}<1>[t]
+ − 82 \frametitle{%
+ − 83 \begin{tabular}{@ {}c@ {}}
+ − 84 \\
+ − 85 \LARGE Access Control and \\[-3mm]
+ − 86 \LARGE Privacy Policies (3)\\[-6mm]
+ − 87 \end{tabular}}\bigskip\bigskip\bigskip
+ − 88
+ − 89 %\begin{center}
+ − 90 %\includegraphics[scale=1.3]{pics/barrier.jpg}
+ − 91 %\end{center}
+ − 92
+ − 93 \normalsize
+ − 94 \begin{center}
+ − 95 \begin{tabular}{ll}
+ − 96 Email: & christian.urban at kcl.ac.uk\\
+ − 97 Of$\!$fice: & S1.27 (1st floor Strand Building)\\
29
+ − 98 Slides: & KEATS (also home work is there)\\
+ − 99 & \alert{\bf (I have put a temporary link in there.)}\\
28
+ − 100 \end{tabular}
+ − 101 \end{center}
+ − 102
+ − 103
+ − 104 \end{frame}}
+ − 105 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 106
+ − 107 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 108 \mode<presentation>{
+ − 109 \begin{frame}[c]
+ − 110
+ − 111 \begin{center}
+ − 112 \includegraphics[scale=0.45]{pics/trainwreck.jpg}\\
+ − 113 one general defence mechanism is\\\alert{\bf defence in depth}
+ − 114 \end{center}
+ − 115
+ − 116
+ − 117 \end{frame}}
+ − 118 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 119
+ − 120 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 121 \mode<presentation>{
+ − 122 \begin{frame}<1-2>[c]
+ − 123 \frametitle{Defence in Depth}
+ − 124
+ − 125 \begin{itemize}
+ − 126 \item \alt<1>{overlapping}{{\LARGE\bf overlapping}} systems designed to provide\\ security even if one of them fails.
+ − 127 \end{itemize}
+ − 128
29
+ − 129 \only<2->{
+ − 130 \begin{textblock}{11}(2,12)
+ − 131 \small otherwise your ``added security'' can become the point of failure
+ − 132 \end{textblock}}
28
+ − 133
+ − 134 \end{frame}}
+ − 135 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 136
+ − 137 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 138 \mode<presentation>{
+ − 139 \begin{frame}[c]
+ − 140 \frametitle{PALs}
+ − 141
+ − 142 \begin{itemize}
+ − 143 \item \alert{Permissive Action Links} prevent unauthorised use of nuclear weapons (so the theory)
+ − 144 \end{itemize}
+ − 145
+ − 146 \begin{center}
+ − 147 \includegraphics[scale=0.25]{pics/nuclear1.jpg}\hspace{3mm}
+ − 148 \includegraphics[scale=0.25]{pics/nuclear2.jpg}
+ − 149 \end{center}
+ − 150
+ − 151
+ − 152 \onslide<3->{
+ − 153 modern PALs also include a 2-person rule
+ − 154 }
+ − 155
+ − 156 \only<2->{
+ − 157 \begin{textblock}{11}(3,2)
+ − 158 \begin{tikzpicture}
+ − 159 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm]
+ − 160 {\begin{minipage}{8cm}
+ − 161 US Air Force's Strategic Air Command worried that in times of need the
+ − 162 codes would not be available, so until 1977 quietly decided to set them
+ − 163 to 00000000\ldots
+ − 164 \end{minipage}};
+ − 165 \end{tikzpicture}
+ − 166 \end{textblock}}
+ − 167
+ − 168
+ − 169 \end{frame}}
+ − 170 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 171
+ − 172 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 173 \mode<presentation>{
+ − 174 \begin{frame}[c]
+ − 175
+ − 176 \begin{itemize}
+ − 177 \item until 1998, Britain had nuclear weapons that could be launched from airplanes\bigskip\pause
+ − 178
+ − 179 \item these weapons were armed with a bicycle key
+ − 180
+ − 181 \begin{center}
+ − 182 \begin{tabular}[b]{c}
+ − 183 \includegraphics[scale=1.05]{pics/britkeys1.jpg}\\
29
+ − 184 \small nuclear weapon keys
28
+ − 185 \end{tabular}
+ − 186 \hspace{3mm}
+ − 187 \begin{tabular}[b]{c}
+ − 188 \includegraphics[scale=0.35]{pics/britkeys2.jpg}\\
+ − 189 \small bicycle lock
+ − 190 \end{tabular}
+ − 191 \end{center}\bigskip\pause
+ − 192
+ − 193 \item the current Trident nuclear weapons can be launched from a submarine without any code being transmitted
+ − 194 \end{itemize}
+ − 195
+ − 196 \end{frame}}
+ − 197 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 198
+ − 199
+ − 200
+ − 201 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 202 \mode<presentation>{
+ − 203 \begin{frame}[c]
29
+ − 204 \frametitle{Access Control in Unix}
28
+ − 205
29
+ − 206 \begin{itemize}
+ − 207 \item access control provided by the OS
+ − 208 \item authenticate principals (login)
+ − 209 \item mediate access to files, ports, processes according to \alert{roles} (user ids)\\
+ − 210 \item roles get attached with privileges\bigskip\\%
+ − 211 \hspace{8mm}
+ − 212 \begin{tikzpicture}
+ − 213 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm]
+ − 214 {\begin{minipage}{8cm}
+ − 215 \alert{principle of least privilege:}\\
+ − 216 programs should only have as much privilege as they need
+ − 217 \end{minipage}};
+ − 218 \end{tikzpicture}
+ − 219 \end{itemize}
28
+ − 220
+ − 221 \end{frame}}
+ − 222 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 223
+ − 224 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 225 \mode<presentation>{
+ − 226 \begin{frame}[c]
29
+ − 227 \frametitle{Access Control in Unix (2)}
+ − 228
+ − 229 \begin{itemize}
+ − 230 \item the idea is to restrict access to files and therefore lower the consequences of an attack\\[1cm]\mbox{}
+ − 231 \end{itemize}
+ − 232
+ − 233 \begin{textblock}{1}(2.5,9.5)
+ − 234 \begin{tikzpicture}[scale=1]
+ − 235
+ − 236 \draw[line width=1mm] (-.3, 0) rectangle (1.5,2);
+ − 237 \draw (4.7,1) node {Internet};
+ − 238 \draw (0.6,1.7) node {\footnotesize Interface};
+ − 239 \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unpriviledged\\[-1mm] process\end{tabular}};
+ − 240 \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}priviledged\\[-1mm] process\end{tabular}};
+ − 241
+ − 242 \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);
+ − 243
+ − 244 \draw[white] (1.7,1) node (X) {};
+ − 245 \draw[white] (3.7,1) node (Y) {};
+ − 246 \draw[red, <->, line width = 2mm] (X) -- (Y);
+ − 247
+ − 248 \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1);
+ − 249 \end{tikzpicture}
+ − 250 \end{textblock}
+ − 251
+ − 252 \end{frame}}
+ − 253 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 254
28
+ − 255
29
+ − 256 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 257 \mode<presentation>{
+ − 258 \begin{frame}[t]
+ − 259 \frametitle{Process Ownership}
+ − 260
+ − 261 \begin{itemize}
+ − 262 \item access control in Unix is very coarse
+ − 263 \end{itemize}\bigskip\bigskip\bigskip
+ − 264
+ − 265 \begin{center}
+ − 266 \begin{tabular}{c}
+ − 267 root\\
+ − 268 \hline
+ − 269
+ − 270 user$_1$ user$_2$ \ldots www, mail, lp
+ − 271 \end{tabular}
+ − 272 \end{center}\bigskip\bigskip\bigskip
+ − 273
+ − 274
+ − 275 \textcolor{gray}{\small root has UID $=$ 0}\\\pause
+ − 276 \textcolor{gray}{\small you also have groups that can share access to a file}\\
+ − 277 \textcolor{gray}{\small but it is difficult to exclude access selectively}\\
+ − 278 \end{frame}}
+ − 279 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 280
+ − 281 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 282 \mode<presentation>{
+ − 283 \begin{frame}[c]
+ − 284 \frametitle{Access Control in Unix (2)}
28
+ − 285
+ − 286
+ − 287 \begin{itemize}
29
+ − 288 \item privileges are specified by file access permissions (``everything is a file'')
+ − 289 \item there are 9 (plus 2) bits that specify the permissions of a file
28
+ − 290
29
+ − 291 \begin{center}
+ − 292 \begin{tabular}{l}
+ − 293 \texttt{\$ ls - la}\\
+ − 294 \texttt{-rwxrw-r-{}- \hspace{3mm} foo\_file.txt}
+ − 295 \end{tabular}
+ − 296 \end{center}
+ − 297 \end{itemize}
28
+ − 298
+ − 299 \end{frame}}
+ − 300 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 301
+ − 302
+ − 303 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 304 \mode<presentation>{
+ − 305 \begin{frame}[c]
29
+ − 306 \frametitle{Login Process}
28
+ − 307
+ − 308
+ − 309 \begin{itemize}
29
+ − 310 \item login processes run under UID $=$ 0\medskip
28
+ − 311 \begin{center}
29
+ − 312 \texttt{ps -axl | grep login}
28
+ − 313 \end{center}\medskip
+ − 314
29
+ − 315 \item after login, shells run under UID $=$ user (e.g.~501)\medskip
+ − 316 \begin{center}
+ − 317 \texttt{id cu}
+ − 318 \end{center}\medskip\pause
+ − 319
+ − 320 \item non-root users are not allowed to change the UID --- would break
+ − 321 access control
+ − 322 \item but needed for example for \texttt{passwd}
28
+ − 323 \end{itemize}
+ − 324
+ − 325 \end{frame}}
+ − 326 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 327
+ − 328
+ − 329
+ − 330 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 331 \mode<presentation>{
+ − 332 \begin{frame}[c]
29
+ − 333 \frametitle{Setuid and Setgid}
28
+ − 334
29
+ − 335 The solution is that unix file permissions are 9 + \underline{2 Bits}:
+ − 336 \alert{Setuid} and \alert{Setgid} Bits
+ − 337
+ − 338 \begin{itemize}
+ − 339 \item When a file with setuid is executed, the resulting process will assume the UID given to the owner of the file.
+ − 340 \item This enables users to create processes as root (or another user).\bigskip
28
+ − 341
29
+ − 342 \item Essential for changing passwords, for example.
+ − 343 \end{itemize}
28
+ − 344
29
+ − 345 \begin{center}
+ − 346 \texttt{chmod 4755 fobar\_file}
+ − 347 \end{center}
+ − 348
28
+ − 349 \end{frame}}
29
+ − 350 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 351
28
+ − 352
+ − 353 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 354 \mode<presentation>{
+ − 355 \begin{frame}[c]
29
+ − 356 \frametitle{\begin{tabular}{c}Privilege Separation in\\ OpenSSH\end{tabular}}
28
+ − 357
+ − 358 \begin{center}
29
+ − 359 \begin{tikzpicture}[scale=1]
+ − 360
+ − 361 \draw[line width=1mm] (0, 1.1) rectangle (1.2,2);
+ − 362 \draw (4.7,1) node {Internet};
+ − 363 \draw (0.6,1.7) node {\footnotesize Slave};
+ − 364 \draw[line width=1mm] (0, 0) rectangle (1.2,0.9);
+ − 365 \draw (0.6,1.7) node {\footnotesize Slave};
+ − 366 \draw (0.6,0.6) node {\footnotesize Slave};
+ − 367 \draw (0.6,-0.5) node {\footnotesize \begin{tabular}{c}unpriviledged\\[-1mm] processes\end{tabular}};
+ − 368 \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}priviledged\\[-1mm] process\end{tabular}};
+ − 369
+ − 370 \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);
+ − 371 \draw (-2.9,1.7) node {\footnotesize Monitor};
+ − 372
+ − 373 \draw[white] (1.7,1) node (X) {};
+ − 374 \draw[white] (3.7,1) node (Y) {};
+ − 375 \draw[red, <->, line width = 2mm] (X) -- (Y);
+ − 376
+ − 377 \draw[red, <->, line width = 1mm] (-0.4,1.4) -- (-1.4,1.1);
+ − 378 \draw[red, <->, line width = 1mm] (-0.4,0.6) -- (-1.4,0.9);
+ − 379
+ − 380 \end{tikzpicture}
28
+ − 381 \end{center}
29
+ − 382
+ − 383 \begin{itemize}
+ − 384 \item pre-authorisation slave
+ − 385 \item post-authorisation\bigskip
+ − 386 \item 25\% codebase is privileged, 75\% is unprivileged
+ − 387 \end{itemize}
28
+ − 388 \end{frame}}
29
+ − 389 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
28
+ − 390
+ − 391 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 392 \mode<presentation>{
+ − 393 \begin{frame}[c]
29
+ − 394 \frametitle{Network Applications}
28
+ − 395
29
+ − 396 ideally network application in Unix should be designed as follows:
+ − 397
+ − 398 \begin{itemize}
+ − 399 \item need two distinct processes
+ − 400 \begin{itemize}
+ − 401 \item one that listens to the network; has no privilege
+ − 402 \item one that is privileged and listens to the latter only (but does not trust it)
+ − 403
+ − 404 \end{itemize}
+ − 405
+ − 406 \item to implement this you need a parent process, which forks a child process
+ − 407 \item this child process drops privileges and listens to hostile data\medskip
+ − 408
+ − 409 \item after authentication the parent forks again and the new child becomes the user
+ − 410 \end{itemize}
+ − 411
+ − 412
+ − 413 \end{frame}}
+ − 414 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 415
28
+ − 416
29
+ − 417 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 418 \mode<presentation>{
+ − 419 \begin{frame}[c]
+ − 420 \frametitle{\begin{tabular}{@ {}c@ {}}Famous Security Flaws in Unix\end{tabular}}
+ − 421
+ − 422
+ − 423 \begin{itemize}
+ − 424 \item \texttt{lpr} unfortunately runs with root privileges; you had the option to delete files after printing \ldots\pause\pause
+ − 425 \item for debugging purposes (FreeBSD) Unix provides a ``core dump'', but allowed to follow links \ldots\pause
+ − 426 \item \texttt{mkdir foo} is owned by root\medskip
+ − 427 \begin{center}
+ − 428 \texttt{-rwxr-xr-x 1 root wheel /bin/mkdir}
+ − 429 \end{center}\medskip
+ − 430 it first creates an i-node as root and then changes to ownership to the user's id\\ \textcolor{gray}{\small (automated with a shell script)}
+ − 431 \end{itemize}
+ − 432
+ − 433 \only<1>{
+ − 434 \begin{textblock}{1}(3,3)
+ − 435 \begin{tikzpicture}
+ − 436 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm]
+ − 437 {\begin{minipage}{8cm}
+ − 438 Only failure makes us experts.
+ − 439 -- Theo de Raadt (OpenBSD, OpenSSH)
+ − 440 \end{minipage}};
+ − 441 \end{tikzpicture}
+ − 442 \end{textblock}}
+ − 443
+ − 444
+ − 445
28
+ − 446 \end{frame}}
+ − 447 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 448
+ − 449 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 450 \mode<presentation>{
+ − 451 \begin{frame}[c]
29
+ − 452 \frametitle{\begin{tabular}{@ {}c@ {}}Other Problems\end{tabular}}
28
+ − 453
29
+ − 454 There are thing's you just cannot solve on the programming side:\bigskip
28
+ − 455
29
+ − 456 \begin{itemize}
+ − 457 \item for system maintenance you often have \texttt{cron}-jobs cleaning \texttt{/tmp}\medskip
+ − 458 \begin{itemize}
+ − 459 \item attacker:\\
+ − 460 \texttt{mkdir /tmp/a; cat > /tmp/a/passwd}
+ − 461 \item root:\\\texttt{rm /tmp/*/*}:
+ − 462 \item attacker:\\
+ − 463 \texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a}
+ − 464 \end{itemize}
+ − 465 \end{itemize}
28
+ − 466
+ − 467 \end{frame}}
+ − 468 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 469
+ − 470 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 471 \mode<presentation>{
+ − 472 \begin{frame}[c]
29
+ − 473 \frametitle{\begin{tabular}{@ {}c@ {}}Security Levels\end{tabular}}
+ − 474
+ − 475 Unix essentially can only distinguish between two security levels (root and non-root).
28
+ − 476
+ − 477 \begin{itemize}
29
+ − 478 \item In military applications you often have many security levels (top-secret, secret, confidential, unclassified)\bigskip\pause
28
+ − 479
29
+ − 480 \item Information flow: Bell --- La Pudela model
28
+ − 481
+ − 482 \begin{itemize}
29
+ − 483 \item read: your own level and below
+ − 484 \item write: your own level and above
+ − 485 \end{itemize}
+ − 486 \end{itemize}
28
+ − 487
+ − 488 \end{frame}}
+ − 489 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 490
+ − 491
+ − 492 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 493 \mode<presentation>{
+ − 494 \begin{frame}[c]
29
+ − 495 \frametitle{\begin{tabular}{@ {}c@ {}}Security Levels (2)\end{tabular}}
28
+ − 496
29
+ − 497 \begin{itemize}
+ − 498 \item Bell --- La Pudela preserves data secrecy, but not data integrity\bigskip\pause
+ − 499
+ − 500 \item Biba model is for data integrity
28
+ − 501
29
+ − 502 \begin{itemize}
+ − 503 \item read: your own level and above
+ − 504 \item write: your own level and below
+ − 505 \end{itemize}
+ − 506 \end{itemize}
28
+ − 507
+ − 508 \end{frame}}
+ − 509 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 510
+ − 511 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 512 \mode<presentation>{
+ − 513 \begin{frame}[c]
29
+ − 514 \frametitle{\begin{tabular}{@ {}c@ {}}Access Control in 2000\end{tabular}}
+ − 515
+ − 516 According to Ross Anderson (1st edition of his book), some senior Microsoft people held the
+ − 517 following view:
+ − 518
+ − 519 \begin{center}
+ − 520 \begin{tikzpicture}
+ − 521 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm]
+ − 522 {\begin{minipage}{10.5cm}
+ − 523 \small Access control does not matter. Computers are becoming single-purpose
+ − 524 or single-user devices. Single-purpose devices, such as Web servers that deliver a single service, don't
+ − 525 need much in the way of access control as there's nothing for operating system access controls
+ − 526 to do; the job of separating users from each other is best left to application code. As for the PC
+ − 527 on your desk, if all the software on it comes from a single source, then again there's no need
+ − 528 for the operating system to provide separation. \hfill{}\textcolor{gray}{(in 2000)}
+ − 529 \end{minipage}};
+ − 530 \end{tikzpicture}
+ − 531 \end{center}
+ − 532
+ − 533 \end{frame}}
+ − 534 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 535
+ − 536
+ − 537 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 538 \mode<presentation>{
+ − 539 \begin{frame}[t]
+ − 540 \frametitle{\begin{tabular}{@ {}c@ {}}Research Problems\end{tabular}}
28
+ − 541
+ − 542 \begin{itemize}
29
+ − 543 \item with access control we are back to 1970s\bigskip
28
+ − 544
29
+ − 545 \only<1>{
+ − 546 \begin{tikzpicture}
+ − 547 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm]
+ − 548 {\begin{minipage}{10cm}
+ − 549 \small Going all the way back to early time-sharing systems we systems people regarded the users, and any code they wrote, as the mortal enemies of us and each other. We were like the police force in a violent slum.\\
+ − 550 \mbox{}\hfill--- Roger Needham
+ − 551 \end{minipage}};
+ − 552 \end{tikzpicture}}\pause
+ − 553
+ − 554 \item the largest research area in access control in 2000-07 has been ``Trusted Computing'', but thankfully it
+ − 555 is dead now\bigskip
+ − 556 \item a useful research area is to not just have robust access control, but also usable access control --- by programmers and users\\
+ − 557 (one possible answer is operating system virtualisation, e.g.~Xen, VMWare)\medskip\pause
+ − 558
+ − 559 \item electronic voting
28
+ − 560 \end{itemize}
+ − 561 \end{frame}}
+ − 562 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 563
+ − 564 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 565 \mode<presentation>{
29
+ − 566 \begin{frame}[t]
+ − 567 \frametitle{\begin{tabular}{@ {}c@ {}}Mobile OS\end{tabular}}
28
+ − 568
+ − 569 \begin{itemize}
29
+ − 570 \item iOS and Android solve the defence-in-depth problem by \alert{sandboxing} applications\bigskip
+ − 571
+ − 572 \item you as developer have to specify the resources an application needs
+ − 573 \item the OS provides a sandbox where access is restricted to only these resources
28
+ − 574 \end{itemize}
+ − 575 \end{frame}}
+ − 576 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 577
+ − 578
+ − 579
+ − 580 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 581 \mode<presentation>{
+ − 582 \begin{frame}[c]
29
+ − 583 \frametitle{\begin{tabular}{@ {}c@ {}}Security Theater\end{tabular}}
+ − 584
28
+ − 585
29
+ − 586 Security theater is the practice of investing in countermeasures intended to provide the
+ − 587 \underline{feeling} of improved security while doing little or nothing to actually achieve it.\hfill{}\textcolor{gray}{Bruce Schneier}
28
+ − 588
+ − 589 \end{frame}}
+ − 590 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 591
29
+ − 592 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 593 \mode<presentation>{
+ − 594 \begin{frame}[c]
+ − 595 \frametitle{\begin{tabular}{@ {}c@ {}}\end{tabular}}
+ − 596
+ − 597
+ − 598 Security theater is the practice of investing in countermeasures intended to provide the
+ − 599 \underline{feeling} of improved security while doing little or nothing to actually achieve it.\hfill{}\textcolor{gray}{Bruce Schneier}
+ − 600
+ − 601 \end{frame}}
+ − 602 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ − 603
+ − 604
+ − 605 From: Ross Anderson <Ross.Anderson@cl.cam.ac.uk>
+ − 606 Sender: cl-security-research-bounces@lists.cam.ac.uk
+ − 607 To: cl-security-research@lists.cam.ac.uk
+ − 608 Subject: Tip off
+ − 609 Date: Tue, 02 Oct 2012 13:12:50 +0100
+ − 610
+ − 611 I received the following tip off, and have removed the sender's
+ − 612 coordinates. I suspect it is one of many security vendors who
+ − 613 don't even get the basics right; if you ever go to the RSA
+ − 614 conference, there are a thousand such firms in the hall, each
+ − 615 with several eager but ignorant salesmen. A trying experience
+ − 616
+ − 617 Ross
+ − 618
28
+ − 619
+ − 620 \end{document}
+ − 621
+ − 622 %%% Local Variables:
+ − 623 %%% mode: latex
+ − 624 %%% TeX-master: t
+ − 625 %%% End:
+ − 626