Alcatraz: An isolated environment for experimenting with untrusted software

ACM Transactions on Information and System Security

Volumn 12, Issue 3, 2009, Pages

  Liang, Zhenkai ^a   Sun, Weiqing ^b   Venkatakrishnan, V N ^c   Sekar, R ^d  

^a NATIONAL UNIVERSITY OF SINGAPORE   (Singapore)

^b UNIVERSITY OF TOLEDO   (United States)

^c UNIVERSITY OF ILLINOIS AT CHICAGO   (United States)

^d STONY BROOK UNIVERSITY   (United States)

Author keywords

Isolation; One way isolation

Indexed keywords

CLIENT APPLICATIONS; CONSISTENCY CRITERION; EXECUTION ENVIRONMENTS; IMPLEMENTATION APPROACHES; ISOLATION; MALICIOUS CODES; ONE-WAY ISOLATION; OPERATING SYSTEMS; SEMANTIC CONSISTENCIES; SOFTWARE CONFIGURATIONS; SOFTWARE PATCHES; SYSTEM CHANGES; WRITE OPERATIONS;

CODES (SYMBOLS); COMPUTER OPERATING SYSTEMS; INFORMATION THEORY; SECONDARY EMISSION; SOFTWARE TESTING;

COMPUTER SOFTWARE;

EID: 60349104471     PISSN: 10949224     EISSN: 15577406     Source Type: Journal    
DOI: 10.1145/1455526.1455527     Document Type: Article

References (57)

1. ACHARYA, A. AND RAJE, M. 2000. Mapbox: Using parameterized behavior classes to confine applications. In Proceedings of the USENIX Security Symposium (SECURITY00).
2. ALCATEAZ. http://www.seclab.cs.sunysb.edu/alcatraz.
3. BOCHS. http://bochs.sourceforge.net.
4. BROWN, A. AND PATTERSON, D. 2003. Undo for operators: Building an undoable e-mail store. In Proceedings of the USENIX Annual Technical Conference (USENIX'03).
5. CHEN, P. M. AND NOBL, B. D. 2001. When virtual is better than real. In Proceedings of the Workshop on Hot Topics in Operating Systems (HotOS'01).
6. CHIUEH, T., SANKARAN, H., AND NEOGI, A. 2000. Spout: A transparent distributed execution engine for Java applets. In Proceedings of the International Conference on Distributed Computing Systems (ICDCS'00).
7. CHUTANI, S., ANDERSON, O. T., KAZAR, M. L., LEVERETT, B. W., MASON, W. A., and SIDEBOTHAM, R. N. 1992. The episode file system. In Proceedings of the USENIX Technical Conference (USENIX'92).
8. DAN, A., MOHINDRA, A., RAMASWAMI, R., AND SITARAM, D. 1997. Chakravyuha: A sandbox operating system for the controlled execution of alien code. Tech. rep., IBM T.J. Watson Research Center.
9. FAKEBUST. Fakebust, a malicious code analyzer. http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-09/0251.html.
10. GARFINKEL, T. 2003. Traps and pitfalls: Practical problems in system call interposition based security tools. In Proceedings of the Annual Network & Distributed Systems Security Conference (NDSS'03).
11. GOEL, A., PO, K., FARHADI, K., LI, Z., AND DE LARA, E. 2005. The taser intrusion recovery system. SIGOPS Oper. Syst. Rev. 39, 5, 163-176.
12. GOLDBERG, I., WAGNER, D., THOMAS, R., AND BREWER, E. A. 1996. A secure environment for untrusted helper applications: Confining the wily hacker. In Proceedings of the USENIX Security Symposium (SECURITY'96).
13. JAIN, K. AND SEKAR, R. 2000. User-level infrastructure for system call interposition: A platform for intrusion detection and confinement. In Proceedings of the Annual Network and Distributed System Security (NDSS'00).
14. JAJODIA, S., LIU, P., AND MCCOLLUM, C. D. 1998. Application-level isolation to cope with malicious database users. In Proceedings of the Annual Computer Security Applications Conference (ACSAC'98).
15. KATCHER, J. 1997. Postmark: A new file system benchmark. Tech. rep. TR3022, Network Applicance Inc.
16. KATO, K. AND OYAMA, Y. 2003. Softwarepot: An encapsulated transferable file system for secure software circulation. In Proceedings of the International Symposium on Software Security (ISSS'03).
17. KING, S. T., CHEN, P. M., WANG, Y.-M., VERBOWSKI, C, WANG, H. J., AND LORCH, J. R. 2006. Subvirt: Implementing malware with virtual machines. In Proceedings of the IEEE Symposium on Security and Privacy (SP'06).
18. KORN, D. G. AND KRELL, E. 1990. A new dimension for the UNIX file system. Software: Practice & Experience 20, S1.
19. LAMPSON, B. W. 1973. A note on the confinement problem. Comm. ACM 16, 10, 613-615.
20. LIANG, Z., VENKATAKRISHNAN, V., AND SEKAR, R. 2003. Isolated program execution: An application transparent approach for executing untrusted programs. In Proceedings of the Annual Computer Security Applications Conference (ACSAC'03).
21. LIU, P., JAJODIA, S., AND MCCOLLUM, C.D. 2000. Intrusion confinement by isolation in information systems. J. Comput. Secur. 8.
22. LOFS. Loop back file system. Unix man page.
23. MALKHI, D. AND REITER, M. K. 2000. Secure execution of Java applets using a remote playground. SOFTW. ENGIN. 26, 12.
24. MUNISWAMY-REDDY, K.-K., WRIGHT, C. P., HIMMER, A. P., AND ZADOK, E. 2004. A versatile and user-oriented versioning file system. In Proceedings of the USENIX Conference on File and Storage Technologies (FAST'04).
25. ORMANDY, T. An empirical study into the security exposure to hosts of hostile virtualized environments. http://taviso.decsystem.org/virtsec. pdf.
26. OSMAN, S., SUBHRAVETI, D., SU, G., AND NIEH, J. 2002. The design and implementation of zap: A system for migrating computing environments. In Proceedings of the 5th Symposium on Operating Systems Design and Implementation (OSDI'02).
27. PENDRY, J.-S. AND MCKUSICK, M. K. 1995. Union mounts in 4.4bsd-lite. In Proceedings of the USENIX Technical Conference on UNIX and Advanced Computing Systems (ACS'95).
28. PENDRY, J. S., WILLIAMS, N., AND ZADOK, E. Am-utils user manual, 6.1b3 edition, July 2003. http://www.am-utils.org.
29. PETERSON, Z. AND BURNS, R. 2003. Ext3cow: The design, implementation, and analysis of metadata for a time-shifting file system. Tech. rep. HSSL-2003-03, Hopkins Storage Systems Lab, Department of Computer Science, Johns Hopkins University.
30. PICTUREPAGES. Picturepages software. http://www.canonical.org/ picturepages.
31. PILANIA, D. AND CHIUEH, T. 2003. Design, implementation, and evaluation of an intrusion resilient database system. In Proceedings of the International Conference on Dependable Systems and Networks (DSN'03).
32. PREVELAKIS, V. AND SPINELLIS, D. 2001. Sandboxing applications. In Proceedings of the USENIX Annual Technical Conference: FREENIX Track (USENIX'01).
33. PROVOS, N. 2003. Improving host security with system call policies. In Proceedings of the 11th USENIX Security Symposium (SECURITY03). 257-272.
34. QUINLAN, S. AND DORWARD, S. 2002. Venti: A new approach to archival storage. In Proceedings of the USENIX Conference on File and Storage Technologies (FAST02). Monterey, CA.
35. ROC. Recovery-oriented computing. http://roc.cs.berkeley.edu.
36. ROOME, W. D. 1991. 3DFS: A time-oriented file server. In Proceedings of the USENIX Technical Conference (USENIX'91).
37. SANTRY, D. J., FEELEY, M. J., HUTCHINSON, N. C, AND VEITCH, A. C. 1999. Elephant: The file system that never forgets. In Proceedings of the Workshop on Hot Topics in Operating Systems (HotOS'99).
38. SCOTT, K. AND DAVIDSON, J. 2002. Safe virtual execution using software dynamic translation. In Proceedings of the Annual Computer Security Applications Conference (CSAC'02).
39. SEKAR, R., CAI, Y., AND SEGAL, M. 1998. A specification-based approach for building survivable systems. In Proceedings of the National Information Systems Security Conference (NISSC'98).
40. SEKAR, R. AND UPPULURI, P. 1999. Synthesizing fast intrusion prevention/detection systems from high-level specifications. In Proceedings of the USENIX Security Symposium (SECURITY'99).
41. SOFTGRID. http://www.microsoft.com/systemcenter/softgrid/ default.mspx.
42. SOULES, C., GOODSON, G., STRUNK, J., AND GANGER, G. 2002. Metadata efficiency in a comprehensive versioning file system. In Proceedings of the USENIX Conference on File and Storage Technologies (FAST'02).
43. STRACE. http://www.liacs.nl/~wichert/strace.
44. SUN, W., LIANG, Z., SEKAR, R., AND VENKATAKRISHNAN, V. 2005. One-way isolation: An effective approach for realizing safe execution environments. In Proceedings of the ISOC Network and Distributed Systems Symposium (NDSS'05).
45. SVS. Software virtualization solution. http://www.altiris.com/Products/ SoftwareVirtualizationSolution.aspx.
46. TFS. Translucent file system. SunOS Reference Manual, Sun Microsystems.
47. TIILIKAINEN, T. Rename-them-all, linux freeware version. http://linux.iconet.com.br/system/preview/8622.html.
48. UPPULURI, P. 2003. Intrusion detection/prevention using behavior specifications. Ph.D. thesis, Stony Brook University.
49. VIRTUALPC. http://www.microsoft.com/windows/products/winfamily/ virtualpc/default.mspx.
50. VMWARE. http://www.vmware.com.
51. VMWARE. VMware Converter. http://www.vmware.com/products/ converter.
52. WEBSTONE. http://www.mindcraft.com/webstone.
53. WHITAKER, A., SHAW, M., AND GRIBBLE, S. 2002. Denali: Lightweight virtual machines for distributed and networked applications. In Proceedings of the USENIX Annual Technical Conference (USENIX'02).
54. YU, Y., GUO, F., NANDA, S., CHUNG LAM, L., AND CKER CHIUEH, T. 2006. A feather-weight virtual machine for windows applications. In Proceedings of the 2nd ACM / USENIX Conference on Virtual Execution Environments (VEE'06).
55. ZADOK, E., BADULESCU, I., AND SHENDER, A. 1999. Extending file systems using stackable templates. In Proceedings of the USENIX Annual Technical Conference (UBENIX'99).
56. ZHU, N. 2003. Data versioning systems. Tech. rep., Stony Brook University.
57. ZHU, N. AND CHIUEH, T. 2003. Design, implementation, and evaluation of repairable file service. In Proceedings of the International Conference on Dependable Systems and Networks (DSN'03).