1. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Attack Surface in a Nutshell Daniel Germanus

2. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Motivation Measure for likelihood of an attack Minimize effort for manual source code audits

3. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Limitations Only applicable on software systems of similar nature No absolute measure Source code required

4. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology Attack Surface – the subset of a software system‘s resources an adversary might use to attack the system Resources are divided in three categories: Entry & Exit points, Channels and Untrusted Data Usage of Entry & Exit point framework...

5. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology – Entry & Exit point framework Methods receiving data from the environment are entry points. Direct entry points: User invokes method and passes parameter data Method reads from a data store Method invokes an API call to the environment and retrieves data

6. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology – Entry & Exit point framework Methods sending data to the system‘s environment are exit points. Direct exit points: User or another system calls a method and receives data. Method writes to a persistent data store. Method invokes an API call and sends data to the environment.

7. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology – Entry & Exit point framework Indirect entry and exit points: Existence of intermediate methods within the call chain data stores

8. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology Channels Data is submitted via channels Network protocols Sockets, RPC,... (not documents  untrusted data (carrier))

9. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology Untrusted data Files, Databases, Email Attachments,... Indirect send/receive opportunity for an adversary

10. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Terminology The Attack Surface can be seen as the triple consisting of Set of Entry and Exit points (M), Set of Channels (C), Set of Untrusted Data items (I)

11. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Measurement steps

12. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Measurement Weight mapping Naively: Count of resources Empirically: Higher weights on repeated vulnerability issues Economically: Concerning the related assets, assign a weight reflecting expected losses Damage Potential: Define ordering for each set of identified resources and assign numeric values

13. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Measurement Example: two FTP daemons, WU-FTPD and ProFTPD Identification of entry & exit points, channels, and data items Define Input and Output set of environmental methods Determine privilege level alternations in methods (static analysis) Determine access rights of methods (static analysis) Determine channels (runtime) Determine data items and their respective access rights (runtime)

14. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Measurement

15. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Measurement Damage potential estimation Define ordering in each resource class Assign values

16. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Calculation ProFTPD Attack Surface: WU-FTPD Attack Surface:

17. DEEDS Meeting Jan., 16th 2007 Dependable, Embedded Systems and Software Group Department of Computer Science Darmstadt University of Technology Future directions / open questions Impacts of indirect entry and exit points Discovery / Modeling Software Connector Taxonomy Changes for object (component) oriented paradigm Annotations w.r.t. object coupling, attribute usage, data diffusion

18. DEEDS Meeting Oct., 26th 2006 18 That‘s it Thanks. Related papers have been copied to the DEEDS Wiki