Chapter 3 – Program Security Section 3.4 Targeted Malicious Code Section 3.5 Controls Against Program Threats

In this Section Program Threats Trapdoors Salami Attack Privilege Escalation Man-in-the-Middle Covert Channels Controls Against Program Threats Modularity Mutual Suspicion Hazard Analysis

Targeted Malicious Code So far looked at code written to affect users and machines indiscriminately Targeted Malicious Code – written for a particular system or application with a particular purpose Similar to viruses but with the addition of new techniques

Trapdoor Trapdoor – an undocumented entry point to a module. Inserted for code development “Hooks” to add additional future enhancements Can be legitimate or non-legitmate Software Testing Unit Testing Integration Testing Stubs and Drivers – routines that inject information during testing Control Stubs – used to invoke debugging code Accidently left in place Poor Error Checking

Trapdoors Poorly defined Data Incomplete Mediation Undefined Opcodes – instructions that have not been defined for the processor Trapdoors can be useful Software audits may request trapdoors to be inserted Trap doors should always be documented.

Causes of Trapdoors Forgot to remove Intentionally for Testing Intentionally left for maintenance Intentionally left for covert means of access Trapdoors are not bad. They are not faults until the trapdoor is not shut. A system is not secure if a trapdoor is present but unknown by others

Salami Attack Named after the way scrap meat is used to form salami Salami Attack – merges seemingly inconsequential bits of data to yield something important Classic Salami Attacks Missing ½ cent Missing percentage Taking a bit from a bunch Charging higher fees Why do they happen? Sometimes programmers just except small errors Code many times it to large to look for salami type errors

Rootkits Rootkit – is a piece of malicious code that goes to great lengths not to be discovered If discovered tries to reestablish itself Tries to run itself as “root” on the system (UNIX administrator) Resides between user and OS Intercepts commands in order to keep itself hidden Rootkit Revealer – program written to reveal rootkits XCP rootkit – used to help prevent copying of music

Others Privilege Escalation-Attack is a means for malicious code to be launched by a user with lower privileges but run with higher privileges Interface Illusions - spoofing an attack in which all or part of a web page is false Keystroke Logging – keeps a copy of everything pressed Man-in-the-Middle Attack- Malicious program exists between tow programs Timing Attack – identify how fast something happens

Covert Channels Communication information to people/systems that should not have it Unnoticed communication and accompanies other information Data written to a drive, sent across a network, placed in a file or printout Storage Channel – passes information based on presence or non-presence of data File lock Channel – lock or non-lock of file Timing Channels – varying speed in system or not using assigned computational time

Controls Against Program Threats Development of Controls Specify the system Design the system Implement the system Test the system Review the system at various stages Document the system Manage the system Maintain the systems Typically it is not one person that does all of these

Designing Secure and Usable Systems You can’t retrofit usable security Tools aren’t a solution Min the upper layers Keep the customers satisfied Think Locally; act locally

Modularity Small self-contained units Modularity Isolates Hides Keep it isolated from the effects of other components Encapsulation – is isolation Information Hiding – each component hides its precise implementation of some other design decision from others.

Modularization Process of dividing into subtasks Goal of Modular Units Single-purpose Small Simple Independent Advantages of Modularity Maintenance Understandability Reuse Correctness Testing

Modularity High Cohesion All the elements of a component have a logical and functional reason for being there Low Coupling The degree with which a component depends on other components in the system Encapsulation – does not mean complete isolation Information Hiding – a “black box” approach

Mutual Suspicion Programs are not always trustworthy Mutual suspicion – each program operates as if other routines in the system were malicious or incorrect Confinement – program is strictly prohibited in what system resources can be accessed

Peer Reviews Peer review Hazard analysis Testing Good design Predictions Static analysis Configuration management Analysis of mistakes

Types of Peer Review Review- presented formally Walk-Through – creator leads and controls the discussion Inspection – formal detailed analysis Finding a fault and dealing with it: By learning how, when, and why errors occur By taking action to prevent mistakes By scrutinizing products to find the instances and effects of errors that were missed.

Hazard Analysis/Testing Hazard Analysis – set of systematic techniques to expose potentially hazardous system states. Hazards and Operability Studies Failure Modes and effects analysis Fault tree analysis Testing Unit Testing Integration Testing Function Testing Performance Testing Acceptance Testing Installation Testing Regression Testing Black-box Testing Clear-box Testing Independent Testing Penetration Testing

Good Design Using a philosophy of fault tolerance Having a consistent policy for handling failures Capturing the design rationale and history Using design patterns Passive fault detection – waiting for a system to fail Active fault detection – construct a system that reacts to a failure

Good Design Handling Problems Retrying – restoring the system to previous state and try again Correcting – resorting the system to previous state and correcting some system characteristic before trying again Reporting – restoring and reporting but not trying again

Configuration Management Who is making the changes Corrective change Adaptive change Perfective change Preventive change Configuration Management – is the process by which we control changes during development and maintenance Configuration identification Configuration control and change management Configuration auditing Status accounting