Notes for November 21, 2000

  1. Greetings and Felicitations!
    1. a. Turn back midterm
    2. b. Go over project
    3. Puzzle of the day
  2. Identity
    1. Principal and identity
    2. Users, groups, roles
    3. Identity on the web
    4. Host identity: static and dynamic identifiers
    5. State and cookies
    6. Anonymous remailers: type 1 and type 2 (mixmaster)
  3. Privilege in Languages
    1. Nesting program units
    2. Temporary upgrading of privileges
  4. Access Control Lists
    1. UNIX method
    2. ACLs: describe, revocation issue
  5. MULTICS ring mechanism
      rings 40-63: cannot access a
      rings 0-32: can access d
      rings 36-63: cannot access d
  6. Capabilities
    1. Capability-based addressing: show picture of accessing object
    2. Show process limiting access by not inheriting all parent's capabilities
    3. Revocation: use of a global descriptor table
  7. Lock and Key
      R = (E1(K), E2(K), ..., En(K)) and any process with access to any of the Dis can access the file

Puzzle of the Day

Your UNIX system has been attacked. The uucp entry in your /etc/passwd file has a UID of 0. You have run ps to see if any unusual processes were executing. None were. You ran ls to find any unusual files or directories. None were reported. You ran du to determine if the size of any file system was unusually large (indicating hidden files). Nope.

You suspect that someone has, somehow, hidden files (or directories) and an executing process. You decide to start at the /dev directory, to see if they created any new device files. Again, an ls lists only those files you expect to see. But you are still suspicious, and want to confirm the results.

  1. What would you do?
  2. You still suspect that the attacker left an illicit process executing. But ps showed nothing. How would you confirm or refute your suspicion?

Matt Bishop
Office: 3059 Engineering Unit II Phone: +1 (530) 752-8060
Fax: +1 (530) 752-4767
Copyright Matt Bishop, 2000. All federal and state copyrights reserved for all original material presented in this course through any medium, including lecture or print.

Page last modified on 11/22/2000