CHAPTER 3 PROGRAM SECURITY

3.1 Non-Malicious Code and Malicious Code Unintentional Caused from a mistake done by a human such as programmers and developers Many such errors cause program malfunction but do not lead to more serious security vulnerabilities

3.1 Non-Malicious Code and Malicious Code Rogue program General name for unanticipated or undesired effects in programs or program parts, caused by an agent intent on damage Behaves in an unexpected ways It can do anything any other program can such as writing a message on a computer screen, stopping a running program, generating a sound or erasing a stored file Malicious code runs under the user’s authority but without the user’s permission or even knowledge

3.2 Non-Malicious Program Errors Three classic error types: Buffer overflow Incomplete mediation Time-of-check to time-of-use (TOCTTOU)

3.2 Non-Malicious Program Errors 3.2.1 Buffer Overflows A buffer: space in which data can be held Resides in memory; because memory is finite, a buffer’s capacity is finite For this reason, the programmer must declare the buffer’s maximum size so that the compiler can set aside that amount of space Example: char sample[10]; -> compiler set aside 10 bytes to store this buffer sample[10] = ‘A’ -> the subscript is out of bound, we have a problem

3.2 Non-Malicious Program Errors 3.2.2 Incomplete Mediation Consider the previous example from previous slide: http://www.somesite.com/subpage/userinput.asp?parm1=(808)555- 1212&parm2=2009Jan17 The two parameters looks like a telephone number and a date The question now: What would happen if parm2 were submitted as 1800Jan01? Or 1800Feb30? Or 2048Min32 or Ardvark2Many? One way to produce the problem is to try to anticipate them

3.2 Non-Malicious Program Errors 3.2.3 Time-of-Check to Time-of-Use (TOCTTOU) Involves synchronization Access control is a fundamental part of computer security Every requested access must be governed by an access policy stating who is allowed access to what; then the request must be mediated by an access-policy-enforcement agent But an incomplete mediation problem occurs when access is not checked universally TOCTTOU flaw concerns mediation that is performed with a “bait and switch” in the middle Also known as serialization or synchronization flaw

3.2 Non-Malicious Program Errors 3.2.4 Combinations of Non-malicious Program Flaws An attacker may begin a three-pronged attack by using a buffer overflow to disrupt all execution of arbitrary code on a machine The attacker then logs in as the new user and exploits an incomplete mediation flaws as common building blocks Clever attacker uses flaws as common building blocks to build a complex attack

3.3 Virus and Other Malicious Code 3.3.1 Why worry about Malicious Code? Malicious code can do much (harm) It can do anything any other program can such as writing a message on a computer screen, stopping a running program, generating a sound or erasing a stored file Or it can do nothing at all right now; it can be planted to lie dormant, undetected, until some event triggers the code to act Malicious code runs under the user’s authority but without the user’s permission or even knowledge

3.3 Virus and Other Malicious Code 3.3.2 Kinds of Malicious Code Malicious code/rogue program is the general name for unanticipated or undesired effects in programs or programs parts, caused by an agent intent on damage The agent is the writer of the program or the person who causes its distribution A virus is a program that can pass on malicious code to other non-malicious programs by modifying them A virus can be either transient or resident

3.3 Virus and Other Malicious Code 3.3.2.1 Transient virus Has a life that depends on the life of its host; the virus runs when its attached program executes and terminates when its attached program ends 3.3.2.1 Resident virus Locates itself in memory; Then it can remain active or be activates as a stand- alone program, even after its attached program ends

3.3 Virus and Other Malicious Code 3.3.2.3 Types of Malicious Code Code Type Characteristics Virus Attaches itself to program and propagates copies of itself to other program Trojan horse Contains unexpected, additional functionality Logic bomb Triggers action when condition occurs Time bomb Triggers action when specified time occurs Trapdoor Allows unauthorized access to functionality Worm Propagates copies of itself through a network Rabbit Replicates itself without limit to exhaust resources

3.3 Virus and Other Malicious Code 3.3.3 How Viruses Attach 3.3.3.1 Appended Viruses A program virus attaches itself to a program, then whenever the program is run, the virus is activated. Refer to Figure 3-4 page 118 3.3.3.2 Viruses That Surround a Program Virus that runs the original program but has control before and after its execution Refer to Figure 3-5 page 119 3.3.3.3 Integrated Viruses and Replacements Viruses replaces some of its target and integrate itself into the original code of the target Refer to Figure 3-6 page 120

3.3 Virus and Other Malicious Code 3.3.4 Document Viruses It is implemented within a formatted document, such as written document, database, a slide presentation or spreadsheet

3.3 Virus and Other Malicious Code 3.3.5 Homes For Viruses The virus writer may find these qualities appealing in a virus: It is hard to detect It is not easily destroyed or deactivated It spreads infection widely It can re-infect its home program or other programs It is easy to create It is machine independent and operating system independent

3.3 Virus and Other Malicious Code 3.3.6 Prevention of Virus Infection There are six techniques: Use only commercial software acquired from reliable, well-established vendors. Test all new software on an isolated computer. Open attachments only when you know them to be safe. Make a recoverable system image and store it safely Make and retain backup copies of executable system files. Use virus detectors regularly and update them daily.

3.3 Virus and Other Malicious Code 3.3.7 Truth and Misconceptions about viruses Viruses can infect only Microsoft Windows systems (False) Viruses can modify “hidden” or “read-only” files (True) Viruses can appear only in data files, or only in Word documents, or only in programs (False) Viruses spread only on disks or through e-mail (False) Viruses cannot remain in memory after a complete power off/power on reboot (True) Viruses cannot infect hardware (True) Viruses can be malevolent, benign, or benevolent (True)

3.4 Targeted Malicious Code 3.4.1 Trapdoor It is an undocumented entry point to a module Developers insert trapdoors during code development, perhaps to test the module, to provide “hooks” by which to connect future modifications or enhancements, or to allow fail in the future Can allow a programmer access to a program once it is placed in production

3.4 Targeted Malicious Code 3.4.1 Trapdoor Causes of Trapdoors Trapdoors can persist in production programs because the developers Forget to remove them Intentionally leave them in the program for testing Intentionally leave them in the program for maintenance of the finished program Intentionally leave them in the program as a covert means of access to the component after it becomes an accepted part of a production system

3.4 Targeted Malicious Code 3.4.2 Salami Attack A salami attack merges bits of seemingly inconsequential data to yield powerful results Normally, salami attack when the course code of a system is too large or complex to be audited Why Salami Attacks Persist Computer computations are notoriously subject to small errors involving rounding and truncation It is easier for programmers and users to accept a small amount of error as natural and unavoidable

3.4 Targeted Malicious Code 3.4.3 Covert channels: Programs that leaks Information Programs that communicate information to people who should not receive it The communication travels unnoticed, accompanying other, perfectly proper, communications Example: - A programmer who has direct access to data can usually just read the data and write it to another file or print it out - If, however, the programmer is one step removed from the data (outside the organizational owning the data), the programmer must figure how to get the data - One way --> to built-in Trojan horse (once the horse is enabled, it finds and transmits the data - In order to send the data to the others, the programmer has to arrange to extract the data more surreptitiously - Covert channels are a means of extracting the data clandestinely

3.5 Controls Against Program Threats 3.5.1 Development Controls It requires people to: Specify the system Design the system Implement the system Test the system Review the system Document the system Manage the system Maintain the system

3.5 Controls Against Program Threats 3.5.2 Operating System Controls on Use of Programs A trusted software is where we know the code has been rigorously developed and analysed To trust any program, we should look for: Functional correctness Enforcement of integrity Limited privilege Appropriate confidence level Others include: Mutual suspicion Confinement Access log

3.5 Controls Against Program Threats 3.5.3 Administrative Controls Standards of Program Development Administrative controls can be exercised by considering the following standards of: Design Documentation, language and coding style Programming Testing Configuration management