Exploiting concurrency vulnerabilities in system call wrappers

1st USENIX Workshop on Offensive Technologies, WOOT 2007

Volumn , Issue , 2007, Pages

  Watson, Robert N M ^a  

^a UNIVERSITY OF CAMBRIDGE   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

SECURITY MODEL; SYSTEM CALL INTERPOSITION; SYSTEM CALLS; THEORY AND PRACTICE;

EID: 85084162296     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (25)

1. Kernel Authorization. Technical Note TN2127, Apple Computer, Inc., 2007. http://developer.apple.com/technotes/ tn2005/tn2127.html.
2. R. P. Abbott, J. S. Chin, J. E. Donnelley, W. L. Konigsford, S. Tokubo, and D. A. Webb. Security Analysis and Enhancements of Computer Operating Systems. Technical Report NBSIR 76-1041, National Bureau of Standards, April 1976.
3. M. Accetta, R. Baron, D. Golub, R. Rashid, A. Tevanian, and M. Young. Mach: A New Kernel Foundation for UNIX Development. Technical report, August 1986.
4. James P. Anderson. Computer Security Technology Planning Study. Technical report, Electronic Systems Division, Air Force Systems Command, Hanscom Field, Bedford, MA 01730, October 1972.
5. Richard Bisbey and Dennis Hollingworth. Protection Analysis: Final Report. Technical Report ISI/SR-78-13, Information Sciences Institute, University of Southern California, May 1978.
6. Matt Bishop and Michael Dilger. Checking for race conditions in file accesses. Computing Systems, 9(2):131–152, Spring 1996.
7. Pawel Jakub Dawidek and Slawomir Zak. CerbNG: system firewall mechanism, 2007. http://cerber.sourceforge.net/.
8. Drew Dean and Alan J. Hu. Fixing Races for Fun and Profit: How to use access(2). In Proc. 13th USENIX Security Symposium, August 2004.
9. Elad Efrat. kauth: kernel authorization framework. In NetBSD Kernel Developer’s Manual. January 2007. http://www.netbsd.org/ ~elad/recent/man/kauth.9.html.
10. William L. Fithen. Follow the Rules Regarding Concurrency Management. BuildSecurityIn, October 2005. https://buildsecurityin.us-cert.gov/daisy/bsi/articles/ knowledge/guidelines/332.html.
11. Timothy Fraser. LOMAC: Low Water-Mark Integrity Protection for COTS Environments. In Proc. 2000 IEEE Symposium on Security and Privacy, 2000.
12. Timothy Fraser, Lee Badger, and Mark Feldman. Hardening COTS Software with Generic Software Wrappers. In Proc. 1999 IEEE Symposium on Security and Privacy, May 1999.
13. T. Garfinkel, B. Pfa, and M. Rosenblum. Ostia: A delegating architecture for secure system call interposition. In Proc. Internet Society 2003, 2003.
14. Tal Garfinkel. Traps and Pitfalls: Practical Problems in in System Call Interposition Based Security Tools. In Proc. Network and Distributed Systems Security Symposium, February 2003.
15. Douglas P. Ghormley, David Patrou, Steven H. Rodrigues, and Thomas E. Anderson. SLIC: An Extensibility System for Commodity Operating Systems. In Proc. USENIX Annual Technical Conference (NO 98), June 1998.
16. Kristaps Johnson and Maikls Deksters. sysjail: systrace userland virtualization, 2007. http://sysjail.bsd.lv/.
17. Poul-Henning Kamp and Robert N. M. Watson. Jails: Confining the omnipotent root. In Proc. 2nd International SANE Conference, 2000.
18. Calvin Ko, Timothy Fraser, Lee Badger, and Douglas Kilpatrick. Detecting and Countering System Intrusions Using Software Wrappers. In Proc. 9th Usenix Security Symposium, August 2000.
19. Todd C. Miller. Sudo, 2007. http://www.gratisoft.us/sudo/.
20. Niels Provos. Improving Host Security with System Call Policies. In Proc. 12th USENIX Security Symposium, Washington, DC, August 2003.
21. Mark Seaborn. Plash: tools for practical least privilege, 2007. http://plash.beasts.org/.
22. Ray Spencer, Stephen Smalley, Peter Loscocco, Mike Hibler, David Anderson, and Jay Lepreau. The Flask Security Architecture: System Support for Diverse Security Policies. In Proc. 8th USENIX Security Symposium, August 1999.
23. Robert Watson, Brian Feldman, Adam Migus, and Chris Vance. Design and Implementation of the TrustedBSD MAC Framework. In Proc. Third DARPA Information Survivability Conference and Exhibition (DISCEX), IEEE, April 2003.
24. Chris Wright, Crispan Cowan, James Morris, Stephen Smalley, and Greg Kroah-Hartman. Linux Security Modules: General Security Support for the Linux Kernel. In Proc. 11th USENIX Security Symposium, August 2002.
25. Michal Zalewski. Delivering Signals for Fun and Profit: Understanding, exploiting and preventing signal-handling related vulnerabilities. 2001. http://www.bindview.com/Services/Razor/Papers/2001/signals.cfm.