USENIX Association Proceedings of the 9 th USENIX Security Symposium
نویسندگان
چکیده
Designing a suitable con nement mechanism to conne untrusted applications is challenging as such a mechanism needs to satisfy con icting requirements. The main trade-o is between ease of use and exibility. In this paper, we present the design, implementation and evaluation of MAPbox, a con nement mechanism that retains the ease of use of application-class-speci c sandboxes such as the Java applet sandbox and the Janus document viewer sandbox while providing signi cantly more exibility. The key idea is to group application behaviors into classes based on their expected functionality and the resources required to achieve that functionality. Classi cation of application behavior provides a set of labels (e.g., compiler, reader, netclient) that can be used to concisely communicate the expected functionality of programs between the provider and the users. This is similar toMIMEtypes which are widely used to concisely describe the expected format of data les. An end-user lists the set of application behaviors she is willing to allow in a le. With each label, she associates a sandbox that limits access to the set of resources needed to achieve the corresponding behavior. When an untrusted application is to be run, this le is consulted. If the label (or the MAP-type) associated with the application is not found in this le, it is not allowed to run. Else, the MAP-type is used to automatically locate and instantiate the appropriate sandbox. We believe that this may be an acceptable level of user interaction since a similar technique (i.e., MIME-types) has been fairly successful for handling documents with di erent formats. In this paper, we present a set of application behavior classes that we have identi ed based on a study of a diverse suite of applications that includes CGI scripts, programs downloaded from well-known web repositories and applications from the Solaris 5.6 distribution. We describe the implementation and usage of MAPbox. We evaluate MAPbox from two di erent perspectives: its e ectiveness (how well it is able to con ne a suite of untrusted applications) and e ciency (what is the overhead introduced). Finally, we describe our experience with MAPbox and discuss potential limitations of this approach.
منابع مشابه
USENIX Association Proceedings of the 9 th USENIX Security Symposium Denver
We describe Shibboleth, a program to manage private Internet mailing lists. Differing from other mailing list managers, Shibboleth manages lists or groups of lists that are closed, or have membership by invitation only. So instead of focusing on automating the processes of subscribing and unsubscribing readers, we include features like SMTP forgery detection, prevention of outsiders’ ability to...
متن کاملUSENIX Association Proceedings of the 12 th USENIX Security Symposium
Timing attacks are usually used to attack weak computing devices such as smartcards. We show that timing attacks apply to general software systems. Specifically, we devise a timing attack against OpenSSL. Our experiments show that we can extract private keys from an OpenSSL-based web server running on a machine in the local network. Our results demonstrate that timing attacks against network se...
متن کاملUSENIX Association Proceedings of the 9 th USENIX Security Symposium
We describe a system that we have designed and implemented for publishing content on the web. Our publishing scheme has the property that it is very difficult for any adversary to censor or modify the content. In addition, the identity of the publisher is protected once the content is posted. Our system differs from others in that we provide tools for updating or deleting the published content,...
متن کاملUSENIX Association Proceedings of the 10 th USENIX Security Symposium
We present a new approach to fast certi cate revocation centered around the concept of an on-line semi-trusted mediator (SEM). The use of a SEM in conjunction with a simple threshold variant of the RSA cryptosystem (mediated RSA) o ers a number of practical advantages over current revocation techniques. Our approach simpli es validation of digital signatures and enables certi cate revocation wi...
متن کاملUSENIX Association Proceedings of the 12 th USENIX Security Symposium
We report on an observational study of user response following the OpenSSL remote buffer overflows of July 2002 and the worm that exploited it in September 2002. Immediately after the publication of the bug and its subsequent fix we identified a set of vulnerable servers. In the weeks that followed we regularly probed each server to determine whether its administrator had applied one of the rel...
متن کاملUSENIX Association Proceedings of the 9 th USENIX Security Symposium
The JavaTM Virtual Machine is viewed by many as inherently insecure despite all the efforts to improve its security. In this paper we take a different approach to Java security and describe the design and implementation of a system that provides operating system style protection for Java code. We use hardware protection domains to separate Java classes, provide access control on cross domain me...
متن کامل