Computer Security: Isolation Principles
47 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What was the main advantage of using VMs in the 1960s?

  • They were the only type of computer available.
  • They replaced all physical computers.
  • They were faster than any physical server.
  • They allowed multiple users to share a single computer. (correct)

    • Covert channels can potentially leak classified data from a secure component to a public component.

    True

    What essential requirement must a hypervisor meet regarding security?

    The hypervisor must protect itself and not be buggy.

    Since 2000, VMs are heavily used in __________ and __________ clouds.

    <p>private, public</p> Signup and view all the answers

    Match each type of server with its function:

    <p>Print server = Manages printing requests Mail server = Sends and receives emails Web server = Hosts websites File server = Stores and manages files</p> Signup and view all the answers

    What is a major drawback of using chroot for application confinement?

    <p>It cannot prevent malicious apps from accessing the network.</p> Signup and view all the answers

    System call interposition completely eliminates the need for user-space monitoring.

    <p>False</p> Signup and view all the answers

    What command must an application make to delete or overwrite files?

    <p>unlink</p> Signup and view all the answers

    The early implementation of monitoring applications in Linux used the ___ system call.

    <p>ptrace</p> Signup and view all the answers

    Match the monitoring methods with their descriptions:

    <p>Linux seccomp = Completely kernel space implementation Program shepherding = Completely user space implementation Systrace = Hybrid implementation ptrace = Process tracing for monitoring</p> Signup and view all the answers

    Which of the following is included in an example policy for a PDF reader?

    <p>network deny all</p> Signup and view all the answers

    It is always easy to manually specify the policy for an app.

    <p>False</p> Signup and view all the answers

    What is the purpose of monitoring an app's system calls?

    <p>To block unauthorized calls and protect the host system.</p> Signup and view all the answers

    What is the main function of a reference monitor in a browser sandbox?

    <p>Mediating requests from applications</p> Signup and view all the answers

    The reference monitor can be killed without consequences to the monitored process.

    <p>False</p> Signup and view all the answers

    What command must be executed by a root user to use chroot?

    <p>chroot /tmp/guest</p> Signup and view all the answers

    In a chroot environment, the application can only access files within the designated ______ directory.

    <p>guest</p> Signup and view all the answers

    Match the escape method to its description:

    <p>Relative paths = Accessing files outside the jail using path traversal Creating a device = Accessing raw disk through a device Sending signals = Interacting with a non-chrooted process Rebooting system = Resetting the system to escape confinement</p> Signup and view all the answers

    Which command is used to initiate a FreeBSD jail?

    <p>jail jail-path hostname IP-addr cmd</p> Signup and view all the answers

    The chroot mechanism allows applications to communicate with processes outside of the jail.

    <p>False</p> Signup and view all the answers

    What issue was identified with Ultrix 4.0 regarding the chroot command?

    <p>The ability for jailed applications to perform path traversal and gain root access.</p> Signup and view all the answers

    Which of the following covert channels can exist in a running system?

    <p>Cache contents</p> Signup and view all the answers

    A Type 1 hypervisor requires a host OS to function.

    <p>False</p> Signup and view all the answers

    What is the primary purpose of a hypervisor in VM isolation?

    <p>To isolate virtual machines from each other.</p> Signup and view all the answers

    Qubes OS runs on top of the _____ hypervisor.

    <p>Xen</p> Signup and view all the answers

    Match the following VMs with their purpose in Qubes OS:

    <p>Vault VM = Pwd/U2F Manager Work VM = Daily work environment Whonix VM = Force all traffic through Tor Disposable VM = Temporary use for security risks</p> Signup and view all the answers

    What type of OS is Qubes OS?

    <p>A desktop/laptop operating system</p> Signup and view all the answers

    In Qubes OS, all access to peripherals is unregulated.

    <p>False</p> Signup and view all the answers

    What feature does every window frame in Qubes OS have?

    <p>Identifies the VM source.</p> Signup and view all the answers

    What is one method that malware uses to avoid reverse engineering?

    <p>Detecting the hypervisor</p> Signup and view all the answers

    Hypervisors provide complete transparency in their operation.

    <p>False</p> Signup and view all the answers

    What is the primary goal of Software Fault Isolation (SFI)?

    <p>To confine applications running in the same address space.</p> Signup and view all the answers

    Malware web pages can detect they are running in a VM using ______ variations.

    <p>timing</p> Signup and view all the answers

    Match the following hypervisor detection methods with their descriptions:

    <p>Timing latency variations = Detects hypervisor presence through operation delays Reduced TLB size = Shares Translation Lookaside Buffer with Guest OS Memory cache behavior = Analyzes differences in memory access patterns Hardware emulation = Replicates older chipsets for virtualization</p> Signup and view all the answers

    Which of the following is NOT a focus of modern hypervisors?

    <p>Security</p> Signup and view all the answers

    SFI runs applications in the same memory segment to improve performance.

    <p>False</p> Signup and view all the answers

    What is one way hypervisors introduce time latency variances?

    <p>By managing how operations are scheduled and executed in a virtualized environment.</p> Signup and view all the answers

    What does the return value SECCOMP_RET_KILL do in a BPF filter?

    <p>Kills the process</p> Signup and view all the answers

    Setting the BPF filter must be done before calling prctl to ensure set-UID and set-GID are ignored.

    <p>True</p> Signup and view all the answers

    What does the command 'docker run --security-opt=no-new-privileges:true nginx' prevent?

    <p>It prevents the process from becoming privileged.</p> Signup and view all the answers

    The Docker command to run a container with a specific seccomp filter is '$ docker run --security-opt=______ nginx'.

    <p>seccomp=filter.json</p> Signup and view all the answers

    Match the BPF actions with their descriptions.

    <p>SECCOMP_RET_ALLOW = Allow the syscall SECCOMP_RET_ERRNO = Return specified error to caller SECCOMP_RET_KILL = Kill the process</p> Signup and view all the answers

    Which Linux capability prevents a process from becoming privileged?

    <p>PR_SET_NO_NEW_PRIVS</p> Signup and view all the answers

    Docker containers can make any syscall without restriction.

    <p>False</p> Signup and view all the answers

    What does 'SCMP_ACT_ERRNO' specify in a seccomp filter?

    <p>It specifies that the syscall will be denied by default.</p> Signup and view all the answers

    In a virtualized environment, the ________ manages multiple guest operating systems.

    <p>Virtual Machine Monitor (VMM)</p> Signup and view all the answers

    What can whoever starts a Docker container specify in terms of BPF policy?

    <p>The syscall filtering policy</p> Signup and view all the answers

    Study Notes

    Computer Security: Isolation

    • Isolation is a confinement principle used in computer security.
    • It's used to prevent untrusted or buggy code from harming the rest of the system.

    Running Untrusted Code

    • Examples of untrusted code include programs from untrusted internet sites, mobile apps, JavaScript, browser extensions, exposed applications (like browsers, PDF viewers, Outlook), and legacy daemons (like sendmail and bind).
    • The goal is to contain any "misbehaving" applications to prevent harm to the system.

    Confinement Approaches

    • Hardware: Run untrusted applications on isolated hardware with an air gap between it and the main system. This is difficult to manage.
    • Virtual Machines: Isolate different operating systems (OSes) on a single machine. A Virtual Machine Monitor (hypervisor) controls the guest OSes.
    • Processes: System Call Interposition (containers) isolate a process within a single operating system.
    • Threads: Software Fault Isolation (SFI) isolates threads sharing the same address space. This technique also addresses the problem of protecting against malicious code that corrupts the kernel or important system libraries.
    • Application-level confinement: e.g., WebAssembly and JavaScript sandboxing in browsers.

    Implementing Confinement

    • Reference Monitor: A key component that mediates requests from applications. It enforces pre-defined confinement policies, and it must be invoked for every application request.
    • Tamper-proof: The reference monitor must not be killed; if killed, the monitored process should also be killed.
    • Example (chroot): Chroot restricts a process to a specific directory within the filesystem to prevent it from accessing files outside its assigned space. Early implementations had vulnerabilities (like relative paths). Modern systems (like FreeBSD jails) address these earlier issues.

    Escaping Jails

    • Early methods of escaping jails involved exploiting relative paths and leveraging vulnerabilities.
    • Modern systems use robust methods to prevent escaping jails.
    • Examples of methods to escape include creating dummy files in undesirable spots within the file system, using chroot and su root to gain root privileges, and exploiting syscalls like access to raw disks.

    Problems with Jails

    • Coarse policies (all or nothing) do not account for the need for applications to access parts of the filesystem outside their designated spaces (e.g., sending attachments).
    • Applications like web browsers need specific access to external files and resources which are not normally allowed.
    • Malicious applications can still try to mess with other machines or crash the host OS.

    System Call Interposition

    • Involves monitoring and blocking unauthorized system calls.
      • Options may be completely in kernel space (e.g. Linux seccomp), or completely in user space (program shepherding, or a combination).
    • Early implementations rely on tracing all system calls through ptrace, which is shown to be inefficient and vulnerable.
    • Examples: unlink, open, write, socket, bind, connect, send

    Hypervisor Isolation

    • Virtual Machines allow multiple applications to run in isolated sections of memory. The hypervisor (like Xen) controls the guest operating systems running in their own isolated environments.
    • An essential security capability is the ability to completely isolate these VMs from one another to prevent exploits.
    • One risk here is covert channels, an unintended channel between VMs. Examples include file locking/status, CPU clock timing. Virtual machines and hypervisors are frequently used in cloud computing environments, in various settings like print, mail, web and file servers.

    Hypervisor Detection

    • Some applications can detect if they are running in a VM environment (e.g., by observing time variations for operations or detecting a reduced TLB size).
    • The perfect hypervisor doesn't exist, and today's hypervisors prioritize compatibility and performance.
    • Hypervisor anomalies can still be detected to reveal the existence of the hypervisor.

    Software Fault Isolation (SFI)

    • Aims to confine applications running in the same address space.
    • Protects the kernel and JVM from corruption by applications.
    • A simple solution is to run applications in separate address spaces, but this can be slow if communication is frequent.
    • A technique for partitioning a process's memory into segments, and adding guards before unsafe instructions (like jmps, load and store operations).
    • Allows for cross domain calls, through the use of special stubs within the jump table.
    • Limits are in place on how complex applications can run, because the number of instructions and registers needed to run specific code can create guard conditions which lead to a reduced performance.

    Confinement Summary

    • Core methods for sandboxing include physical air gaps, virtual air gaps (hypervisors), system calls interposition (SCI), Software Fault Isolation (SFI) and application-specific techniques like Javascript sandboxing in browsers.
    • Frequent communication between applications may not be compatible with strict isolation; this means many systems must manage these needs.
    • Specifying exactly which systems calls and actions are allowed, and preventing covert channels are the hardest aspects of creating a secure sandboxing environment.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Computer Security Isolation PDF

    Description

    This quiz covers the concept of isolation in computer security, focusing on how to manage untrusted code effectively. Explore various confinement approaches including hardware isolation, virtual machines, and process isolation techniques. Test your knowledge on protecting systems from harmful applications.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser