1. CIT 380: Securing Computer SystemsSlide #1 CIT 380: Securing Computer Systems Authentication

2. CIT 380: Securing Computer SystemsSlide #2 Authentication 1.Identity 2.Groups and Roles 3.Network Identities 4.Authentication 5.Biometrics 6.UNIX Authentication

3. What is Identity? Method to determine whether a subject is who he claims to be. Example: –username expresses your identity. (identification) –password verifies the person typing has that identity. (authentication) CIT 380: Securing Computer SystemsSlide #3

4. CIT 380: Securing Computer SystemsSlide #4 Purpose of Identity Access Control –Most systems base access rights on identity of principal executing the process. Accountability –Logging and auditing functions.

5. CIT 380: Securing Computer SystemsSlide #5 Groups and Roles An “entity” may be a set of entities referred to by a single identifier. Principals often need to share access to files, and thus are taken as groups. Can be a member of more than one group. Computer Science Faculty Group Computer Information Technology Student Group

6. Role Based Access Method Access depends on role within the company. If you change roles, your access rights change. Easier for computer administrators to manage role access than individual access rights. CIT 380: Securing Computer SystemsSlide #6

7. CIT 380: Securing Computer SystemsSlide #7 Network Identity Ethernet (MAC) Address –48-bit data link level identifier –example: 00:0B:DB:78:39:8A IP Address –32-bit network level identifier –ex: 10.17.0.101 IPv6 Address –128-bit network level identifier –ex: fe80::2a0:c9ff:fe97:153d/64 Hostname (DNS name) –string application level identifier –ex: www.nku.edu

8. CIT 380: Securing Computer SystemsSlide #8 What is Authentication? Binding of an identity to a subject Based on: 1.What the entity knows (e.g., passwords) 2.What the entity has (e.g., access card) 3.What the entity is (e.g., fingerprints) 4.Where the entity is (e.g., local terminal)

9. Two-factor authentication US Bank –Password, Security Question (Paternal Grandmother’s name), Preselected image with caption Chase Bank –Password, cookie on computer CIT 380: Securing Computer SystemsSlide #9

10. CIT 380: Securing Computer SystemsSlide #10 What You Know Passwords Pass Phrases PINs

11. CIT 380: Securing Computer SystemsSlide #11 What You Have Smart Cards USB Token RFID RFID used for toll collection

12. CIT 380: Securing Computer SystemsSlide #12 USB Tokens and Smart Cards Small device with storage and processor. –USB tokens tend to focus on storage. –Smart cards on processor + small storage. –Differences are growing smaller. Methods of use –By Hand (read card and type one-time password) –USB –Wireless

13. CIT 380: Securing Computer SystemsSlide #13 RFID Radio Frequency Identification Types of Tags –Passive: use power from reader signal –Active: internal power source Applications –Product tracking (EPC barcode replacement) –Transportation payment –Automotive (embedded in car keys) –Passports –Human implants EPC RFID Tag

14. CIT 380: Securing Computer SystemsSlide #14 What You Are: Biometrics Identification by human characteristics: 1.Physiological 2.Behavioral A biometric characteristic should be: 1.universal: everyone should have it 2.unique: no two people should share it 3.permanent: it should not change with time 4.quantifiable: it must be practically measurable

15. CIT 380: Securing Computer SystemsSlide #15 How Biometrics Work 1.User submits sample. 2.Software turns sample into digital template. 3.Software compares template against stored reference template. 4.Authentication based on how closely templates match.

16. CIT 380: Securing Computer SystemsSlide #16

17. CIT 380: Securing Computer SystemsSlide #17

18. CIT 380: Securing Computer SystemsSlide #18 Biometric Measurement Possible Outcomes: 1.Correct person accepted 2.Imposter rejected 3.Correct person rejected (False Rejection) 4.Imposter accepted (False Acceptance)

19. CIT 380: Securing Computer SystemsSlide #19 False Positives and Negatives Tradeoff between False Accept Rate False Reject Rate Crossover Error Rate

20. CIT 380: Securing Computer SystemsSlide #20 Fingerprints Capacitive measurement, using differences in electrical charges of whorls on finger to detect those parts touching chip and those raised.

21. CIT 380: Securing Computer SystemsSlide #21 Brandon Mayfield Fingerprints found in 2004 Madrid bombing. Brandon arrested May 6, 2004. FBI claimed “100 percent positive” match. –Held under a false name. –Then transferred to unidentified location. Spanish police identify fingerprint as belonging to an Algerian man May 21, 2004. Brandon released May 25, 2004.

22. CIT 380: Securing Computer SystemsSlide #22 Eye Biometrics Iris Scan –Lowest false accept/reject rates of any biometric. –Person must hold head still and look into camera. Retinal Scan –Cataracts and pregnancy change retina pattern. –Lower false accept/reject rates than fingerprints. –Intrusive and slow.

23. CIT 380: Securing Computer SystemsSlide #23 Other Types of Biometrics Physiological DNA Face recognition Hand geometric Scent detection Voice recognition Behavioral Gait recognition Keyboard dynamics Mouse dynamics Signatures

24. CIT 380: Securing Computer SystemsSlide #24 Biometrics are not infallible What are False Accept and Reject Rates? Do the characteristics change over time? –Retina changes during pregnancy. –Fingerprint damage due to work/pipe smoking. –Young and old people have fainter fingerprints. Is it accurate in the installed environment? –Is someone observing fingerprint or voiceprint checks? –i.e., did you collect biometric from the person?

25. CIT 380: Securing Computer SystemsSlide #25 Biometrics can be compromised. Unique identifiers, not secrets. –You can change a password. –You can’t change your iris scan. Examples: –You leave your fingerprints every place. –It’s easy to take a picture of your face. Other compromises. –Use faux ATM-style devices to collect biometrics. –Obtain all biometric templates from server.

26. CIT 380: Securing Computer SystemsSlide #26 Use and Misuse of Biometrics Employee identification. –Employee enters login name. –System uses fingerprint to verify employee is who he claims to be. –Problem: Does biometric match the employee? Criminal search (Superbowl 2001) –System uses face recognition to search for criminals in public places. –Problem: Does any biometric in database match anyone in a crowd of people? –Assume system is 99.99% accurate and 1 in 10million people is a terrorist. Result: 1000 false positives for each terrorist.

27. CIT 380: Securing Computer SystemsSlide #27 Location Classic: only allow access from a particular terminal or a particular set of remote hosts. Modern: GPS-based –Location Signature Sensor (LSS) for host and user. –Access rules permit user only to access host with specific LSS values. –Cell-phones track location, and some states use them to track drivers’ speed and locations.

28. CIT 380: Securing Computer SystemsSlide #28 UNIX Authentication UNIX identifies user with a UID –Username is for humans, UID for computers. –15-bit to 32-bit unsigned integer. –UID=0 is the superuser, root. Identity and authentication data stored in –/etc/passwd –/etc/shadow –/etc/group

29. CIT 380: Securing Computer SystemsSlide #29 /etc/{passwd,shadow} /etc/passwd –Username –UID –Default GID –GCOS –Home directory –Login shell /etc/shadow –Username –Encrypted password –Date of last pw change. –Days ‘til change allowed. –Days `til change required. –Expiration warning time. –Expiration date. Central file(s) describing UNIX user accounts. :::

30. /etc/{passwd,shadow} student:x:1000:1000:Example User,,555- 1212,:/home/student:/bin/bash student:$1$w/UuKtLF$otSSvXtSN/xJzUOG FElNz0:13226:0:99999:7 CIT 380: Securing Computer SystemsSlide #30

31. CIT 380: Securing Computer SystemsSlide #31 Groups and GIDs GIDs are 32-bit non-negative integers. Each user has a default GID. –File group ownership set to default GID. –Temporarily change default GID: newgrp. Groups are described in /etc/group –Users may belong to multiple groups. –Format: group name, pw, GID, user list. –wheel:x:10:root,waldenj,bergs

32. CIT 380: Securing Computer SystemsSlide #32 Superuser Powers Superuser can Read any file. Modify any file. Add / remove users. Become any user. Kill any process. Reprioritize processes. Configure network. Set date/time. Shutdown / reboot. Superuser can’t Change read-only filesystem. Decrypt hashed passwords. Modify NFS-mounted filesystems. Read or modify SELinux protected files.

33. CIT 380: Securing Computer SystemsSlide #33 Switching Users The su command allows you to switch users. > id uid=102(wj) gid=102(wj) groups=102(wj) > su Password: # id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm), 6(disk),10(wheel) # su john john$ id uid=1995(john) gid=1995(john) groups=1995(john) john$ exit # exit > id uid=102(wj) gid=102(wj) groups=102(wj)

34. CIT 380: Securing Computer SystemsSlide #34 Real and Effective UIDs Real UID –The UID matching the username you logged in as. Effective UID –The UID that is checked for access control. –The su command changes your EUID. SUID programs –A SUID program executes with an EUID of the owner of the program instead of yours. –/usr/bin/passwd is SUID root. Why?

35. CIT 380: Securing Computer SystemsSlide #35 Key Points 1.Access control is based on identity. 2.Authentication consists of an entity, the user, attempting to convince another entity, the verifier, of the user’s identity 1.something you know 2.something you have 3.something you are 3.Authentication Types 1.Passwords 2.Security Tokens 3.Biometrics

36. CIT 380: Securing Computer SystemsSlide #36 References 1.Phil Agre. “Your Face is not a Bar Code,” http://polaris.gseis.ucla.edu/pagre/bar-code.html, 2003.http://polaris.gseis.ucla.edu/pagre/bar-code.html 2.Ross Anderson, Security Engineering, Wiley, 2001. 3.Matt Bishop, Introduction to Computer Security, Addison-Wesley, 2005. 4.DigitalPersona, http://www.digitalpersona.com/company/news/pressKit.php, 2006.http://www.digitalpersona.com/company/news/pressKit.php 5.Simson Garfinkel, Gene Spafford, and Alan Schwartz, Practical UNIX and Internet Security, 3/e O’Reilly, 2003. 6.Ben Mook, “Md. pilot program tracks drivers’ speed, location via cell phones,” The Daily Record, October 21, 2005, http://www.mddailyrecord.com/pub/5_398_friday/businessnews/172883-1.html 7.Bruce Schneier, “Biometrics: Truths and Fictions,” Cryptogram, http://www.schneier.com/crypto- gram-9808.html#biometrics, 1998.http://www.schneier.com/crypto- gram-9808.html#biometrics 8.Bruce Schneier, “The Curse of the Secret Question,” http://www.schneier.com/essay-081.html, 2005.http://www.schneier.com/essay-081.html 9.Ed Skoudis, Counter Hack Reloaded, Prentice Hall, 2006. 10.Wikipedia, http://en.wikipedia.org/wiki/Biometrics, 2006.http://en.wikipedia.org/wiki/Biometrics 11.Wikipedia, http://en.wikipedia.org/wiki/Fingerprint, 2006.http://en.wikipedia.org/wiki/Fingerprint 12.Wikipedia, http://en.wikipedia.org/wiki/Iris_%28anatomy%29, 2006.http://en.wikipedia.org/wiki/Iris_%28anatomy%29 13.Wikipedia, http://en.wikipedia.org/wiki/RFID, 2006. 14.Wikipedia, http://en.wikipedia.org/wiki/Security_token, 2006. 15.Orville Wilson, “Privacy & Identity - Security and Usability: The viability of Passwords & Biometrics,” http://facweb.cs.depaul.edu/research/vc/CIPLIT2004/ppt/Orville_Wilson.ppt, 2004.http://facweb.cs.depaul.edu/research/vc/CIPLIT2004/ppt/Orville_Wilson.ppt 16.“Simple Anatomy of the Retina,” http://webvision.med.utah.edu/sretina.html, 2006.http://webvision.med.utah.edu/sretina.html