MOPS: an Infrastructure for Examining Security Properties of Software Authors: Hao Chen, David Wagner University of California at Berkeley Publish: ACM Computer and Communication Security 02 Presenter: Xingbo Gao

Outline Problem Definition and Motivation Introduction of Temporal Safety Properties Formal Models and Framework Feasible Applications Strengths, Weakness and Improvements

Problem Definition and Motivation // now in directory “/var/ftp” chroot(“/var/ftp/pub”); -----> confines the root priv. in new dir. chdir(“/var/ftp/pub”); filename=read_from_network(); fd=open(filename, O_RDONLY); root / /var /etc /var/ftp /etc/passwd filename = “../../etc/passwd” ?? /var/ftp/pub

Contribution A New idea to examine security properties of software: verify whether temporal safety properties are obeyed Propose a formal model to automate this verification process

Temporal Safety Property Dictates the order of a sequence of security-relevant operations Can be used to describe many rules for security programs Violating such properties often render the program vulnerable to attack Detecting violations or verifying the satisfaction significantly helps to reduce the software vulnerabilities Manual checking cannot scale to large programs

Formal Model : the set of security-relevant operations : all sequences of security operations that violate the security property : the set of all feasible paths is a regular language: ( : FSA) is a context free language: ( :PDA)

Another Example Before making certain system calls that run untrusted programs, a privileged process must first drop all privileges

Brief Review of ruid, euid and suid Each Unix process has three user ids: ruid: real user id euid: effective user id suid: saved user id real-uid = tom effective-uid = tom saved-uid = root real-uid = tom effective-uid = root saved-uid = root syscall passwd -> seteuid(0)

Temporal Safety Property Example int main(int argc, char *argv[]) { // start with root privilege do_something_with_privilege(); drop_privilege(); execl(“/bin/sh”, “/bin/sh”, NULL); risky syscall } void drop_privilege() { struct passwd *passwd; if ((passwd=getpwuid(getuid())) == NULL) return; fprintf(log, “drop priv for %s”, passwd->pw_name); seteuid(getuid());

Formal Model Cont. ∑={execl(), seteuid(0), seteuid(!0)} (set of security operations) T={[seteuid(!0), execl()], [execl()]} (all feasible traces) T ∩ L(M) = [execl()] An FSA describing Property “Dropping Privileges”

Modular Implementation

Applications Checking proper dropping privilege sendmail 8.10.1 fails to drop root privilege in user IDs sendmail 8.12.0 fails to drop privilege in group IDs Verifying success of system calls OpenSSH 2.5.2 no uid-setting syscalls may fail Checking privilege flow in non-local control flow wu-ftpd 2.4 beta 11 has offending path wu-ftpd 2.4 beta 12 fixed this vulnerability

Strengths and Weakness proposed a novel formal approach to model checking security properties in large programs efficient algorithm and good scalability sound modeling Weakness can raise some false alarms due to approximated modeling reduced precision because of very limited data flow analysis e.g. if-then-else

Possible Improvements Investigate how much data flow analysis can be incorporated into MOPS Improve MOPS while experimenting with checking more security properties in more programs

Questions ?