DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Attack Surface in a Nutshell Daniel Germanus

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Motivation Measure for likelihood of an attack Minimize effort for manual source code audits

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Limitations Only applicable on software systems of similar nature No absolute measure Source code required

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology Attack Surface – the subset of a software system‘s resources an adversary might use to attack the system Resources are divided in three categories: Entry & Exit points, Channels and Untrusted Data Usage of Entry & Exit point framework...

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology – Entry & Exit point framework Methods receiving data from the environment are entry points. Direct entry points: User invokes method and passes parameter data Method reads from a data store Method invokes an API call to the environment and retrieves data

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology – Entry & Exit point framework Methods sending data to the system‘s environment are exit points. Direct exit points: User or another system calls a method and receives data. Method writes to a persistent data store. Method invokes an API call and sends data to the environment.

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology – Entry & Exit point framework Indirect entry and exit points: Existence of intermediate methods within the call chain data stores

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology Channels Data is submitted via channels Network protocols Sockets, RPC,... (not documents  untrusted data (carrier))

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology Untrusted data Files, Databases, Attachments,... Indirect send/receive opportunity for an adversary

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology The Attack Surface can be seen as the triple consisting of Set of Entry and Exit points (M), Set of Channels (C), Set of Untrusted Data items (I)

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Measurement steps

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Measurement Weight mapping Naively: Count of resources Empirically: Higher weights on repeated vulnerability issues Economically: Concerning the related assets, assign a weight reflecting expected losses Damage Potential: Define ordering for each set of identified resources and assign numeric values

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Measurement Example: two FTP daemons, WU-FTPD and ProFTPD Identification of entry & exit points, channels, and data items Define Input and Output set of environmental methods Determine privilege level alternations in methods (static analysis) Determine access rights of methods (static analysis) Determine channels (runtime) Determine data items and their respective access rights (runtime)

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Measurement

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Measurement Damage potential estimation Define ordering in each resource class Assign values

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Calculation ProFTPD Attack Surface: WU-FTPD Attack Surface:

DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Future directions / open questions Impacts of indirect entry and exit points Discovery / Modeling Software Connector Taxonomy Changes for object (component) oriented paradigm Annotations w.r.t. object coupling, attribute usage, data diffusion

DEEDS Meeting Oct., 26th That‘s it Thanks. Related papers have been copied to the DEEDS Wiki