Expressing Human Trust in Distributed Systems: the Mismatch Between - - PowerPoint PPT Presentation

▶
expressing human trust in distributed systems the
SMART_READER_LITE
LIVE PREVIEW

Expressing Human Trust in Distributed Systems: the Mismatch Between - - PowerPoint PPT Presentation

Dec 29, 2022 231 likes •622 views

Expressing Human Trust in Distributed Systems: the Mismatch Between Tools and Reality Sean W. Smith Department of Computer Science Dartmouth College Hanover, NH USA http://www.cs.dartmouth.edu/~sws/ April 15, 2005 joint work with various

slide-1
SLIDE 1

Vox Clamantis in Deserto

Expressing Human Trust in Distributed Systems: the Mismatch Between Tools and Reality

Sean W. Smith Department of Computer Science Dartmouth College Hanover, NH USA http://www.cs.dartmouth.edu/~sws/ April 15, 2005 joint work with various students

slide-2
SLIDE 2

Vox Clamantis in Deserto

Overview

?

  • Background on PKI
  • Problems with mental models
  • Problems with expressiveness
  • (research)
slide-3
SLIDE 3

Vox Clamantis in Deserto

Public Key Cryptography

slide-4
SLIDE 4

Vox Clamantis in Deserto

Public Key Cryptography Infrastructure

slide-5
SLIDE 5

Vox Clamantis in Deserto

Public Key Cryptography Infrastructure

Basic Uses:

  • Signed communication
  • Encrypted communication
  • Authentication
slide-6
SLIDE 6

Vox Clamantis in Deserto

Public Key Cryptography Infrastructure

Basic Problem: Basic Approach: Basic Uses: Basic Worries:

  • Signed communication
  • Encrypted communication
  • Authentication
  • Alice needs to learn Bob's public key
  • A CA
  • signs an X.509 identity cert
  • binding Bob's name to his public key
  • How does Alice obtain Bob's cert?
  • How does she decide to believe his CA?
  • How does she check if this CA has

changed its mind?

slide-7
SLIDE 7

Vox Clamantis in Deserto

Problem: Mental Models

Does what people think the machines do match what the machines really do?

  • digital signatures on office documents
  • server-side SSL
  • client-side SSL
  • passwords
slide-8
SLIDE 8

Vox Clamantis in Deserto

Digital Signatures

If Alice's tools tell her that X has a valid signature from Bob, should she conclude that Bob signed that virtual piece of paper? With a quick exploration, we could subvert:

  • Word (without macros)
  • Excel (without macros*)
  • PDF
  • HTML email

using:

  • PGP and S/MIME signatures
  • DST's CertainSEnd
  • Assured Office/ProSigner/E-Lock
  • Acrobat Visible Signatures
slide-9
SLIDE 9

Vox Clamantis in Deserto

Server-Side SSL

SERVER CERT SERVER PRIVATE KEY `

If Alice's browser tells her that she has an https connection to bob.com, should she believe it?

slide-10
SLIDE 10

Vox Clamantis in Deserto

Standard Browser Signals

slide-11
SLIDE 11

Vox Clamantis in Deserto

Standard Browser Signals

SSL warning window

slide-12
SLIDE 12

Vox Clamantis in Deserto

Standard Browser Signals

"https", security icons

slide-13
SLIDE 13

Vox Clamantis in Deserto

Standard Browser Signals

security page

slide-14
SLIDE 14

Vox Clamantis in Deserto

Standard Browser Signals

server certificate

slide-15
SLIDE 15

Vox Clamantis in Deserto

Web Spoofing Revisited

Attacks: For IE/Windows and Netscape/Linux (circa 2001

  • 2002), we built a malicious server that spoofed:
  • Location bar
  • SSL icon
  • SSL warning windows
  • SSL certificate info
  • (and password prompts)

Defenses: Prototyped and validated "secure GUI" countermeasures in Mozilla (Usenix 02)

  • Didn't get adoped
  • Users have strange beliefs about online trust
  • The problem has only grown worse
slide-16
SLIDE 16

Vox Clamantis in Deserto

Client-Side SSL

SERVER CERT SERVER PRIVATE KEY CLIENT CERT CLIENT PRIVATE KEY

Does "client-side authenticated request" ⇒ "user authorized the request" ?

slide-17
SLIDE 17

Vox Clamantis in Deserto

The "Browser" Keystore

Microsoft CSP, "high" or "medium" security keypair

slide-18
SLIDE 18

Vox Clamantis in Deserto

Keyjacking #1

CLIENT PRIVATE KEY INTERNET EXPLORER ATTACK.DLL CRYPT32.DLL

Suppose the adversary adds one user-level executable... Result: adversary gets key, even with medium/high security Countermeasure: make key non-exportable

slide-19
SLIDE 19

Vox Clamantis in Deserto

Keyjacking #2

  • 3. Stealth request
  • 1. Request

Claire Martha.com Victor.com

  • 2. Martha’s Malicious Frameset

Result: often, adversary fools victim server Countermeasure: careful server content, browser configs Suppose the adversary writes devious server content...

slide-20
SLIDE 20

Vox Clamantis in Deserto

Mystery

If Claire approves using her key for victor.com once, IE appears happy to keep using it for SSL handshakes to that server. Let's follow all the rules: Result: IE will still use Claire's key without telling her

  • WinXP Pro, current SP, current updates
  • "High security" key
  • Followed DoD DMS key hygiene guidelines
slide-21
SLIDE 21

Vox Clamantis in Deserto

Keyjacking #3

Add one user-level executable, with two parts... Countermeasures?

  • Magic button? ("kill SSL state" or kill browser)
  • Make key non-exportable?
  • Aladdin eToken USB?
  • Spyrus Rosetta USB
  • Careful server content?
slide-22
SLIDE 22

Vox Clamantis in Deserto

Keyjacking #3

Add one user-level executable, with two parts... Countermeasures?

  • Magic button? ("kill SSL state" or kill browser)
  • Make key non-exportable?
  • Aladdin eToken USB?
  • Spyrus Rosetta USB
  • Careful server content?

All your keypairs are belong to us

slide-23
SLIDE 23

Vox Clamantis in Deserto

Keyjacking #3

Add one user-level executable, with two parts... Countermeasures?

  • Magic button? ("kill SSL state" or kill browser)
  • Make key non-exportable?
  • Aladdin eToken USB?
  • Spyrus Rosetta USB
  • Careful server content?

All your keypairs are belong to us SHEMP: Proxy certs, TPMs, XACML

slide-24
SLIDE 24

Vox Clamantis in Deserto

Passwords

Assumption: knowledge of password ⇒ identity of user Reality: CS38 hw

slide-25
SLIDE 25

Vox Clamantis in Deserto

Passwords

Assumption: knowledge of password ⇒ identity of user Reality: CS38 hw

  • Plastic Dinosaurs and Squirt Guns
slide-26
SLIDE 26

Vox Clamantis in Deserto

Passwords

Assumption: knowledge of password ⇒ identity of user Reality: CS38 hw

  • Plastic Dinosaurs and Squirt Guns

80% success rate. "Alice" got 100%.

slide-27
SLIDE 27

Vox Clamantis in Deserto

Passwords

Assumption: knowledge of password ⇒ identity of user Reality: CS38 hw

  • Plastic Dinosaurs and Squirt Guns

80% success rate. "Alice" got 100%.

  • Email link to spoofed site, using IE URL flaw
slide-28
SLIDE 28

Vox Clamantis in Deserto

Passwords

Assumption: knowledge of password ⇒ identity of user Reality: CS38 hw

  • Plastic Dinosaurs and Squirt Guns

80% success rate. "Alice" got 100%.

  • Email link to spoofed site, using IE URL flaw

83% success rate. 36% had vulnerability. 3% of the rest noticed.

slide-29
SLIDE 29

Vox Clamantis in Deserto

Passwords

Assumption: knowledge of password ⇒ identity of user Reality: CS38 hw

  • Plastic Dinosaurs and Squirt Guns

80% success rate. "Alice" got 100%.

  • Email link to spoofed site, using IE URL flaw

83% success rate. 36% had vulnerability. 3% of the rest noticed.

  • Self-signed SSL site
slide-30
SLIDE 30

Vox Clamantis in Deserto

Passwords

Assumption: knowledge of password ⇒ identity of user Reality: CS38 hw

  • Plastic Dinosaurs and Squirt Guns

80% success rate. "Alice" got 100%.

  • Email link to spoofed site, using IE URL flaw

83% success rate. 36% had vulnerability. 3% of the rest noticed.

  • Self-signed SSL site

93% success

slide-31
SLIDE 31

Vox Clamantis in Deserto

Passwords

Assumption: knowledge of password ⇒ identity of user Reality: CS38 hw

  • Plastic Dinosaurs and Squirt Guns

80% success rate. "Alice" got 100%.

  • Email link to spoofed site, using IE URL flaw

83% success rate. 36% had vulnerability. 3% of the rest noticed.

  • Self-signed SSL site

93% success including two faculty (from social science)

slide-32
SLIDE 32

Vox Clamantis in Deserto

Problem: Expressiveness

Does standard PKI express what's important in human scenarios?

  • name ≠ person
  • name ≠ property
  • property ≠ property
  • formal delegation
  • ad hoc delegation
slide-33
SLIDE 33

Vox Clamantis in Deserto

Name ≠ Person

Did that mail really come from the "John Wilson" I'm thinking of?

  • John.Wilson@dartmouth.edu
  • jwilson@ists.dartmouth.edu

One person, many names One name, many persons One person, many accounts One account, many capitalizations

  • John.Wilson@foo.com
  • john.wilson@foo.com
slide-34
SLIDE 34

Vox Clamantis in Deserto

Name ≠ Property

Did that mail really come from the person with property P ?

  • TCPA/TCG attestation about a remote machine
  • Is "Martin Wyburne" the Dean?
  • Who should sign the mail firing the CEO?

What about the name-P binding? Multiple people speak for P

  • "Effie Cummings" sent the mail from "Dean Wyburne"
slide-35
SLIDE 35

Vox Clamantis in Deserto

Property ≠ Property

What does property P over there really mean?

  • Who is the "Office of the Registrar" at UVM?

Name of predicate Similarly named predicates may mean opposite things

  • "Dean's List" at MSU
  • "Dean's List" at Princeton
  • Dave Nicol and the soccer coach at UIUC

Natural implications of predicate

slide-36
SLIDE 36

Vox Clamantis in Deserto

Delegation

How do we express formal and ad hoc delegation relationships?

  • "Modus Media" vs. https://www.palmstore.com
  • john@linklings.com is the

"Dartmouth Ph.D. Admissions committee Subcontracting Ad hoc relationships

  • Giving a visitor "inside" access in EAP-TLS WLAN
  • Sharing passwords at NYU
  • Dean of First-Years... and her admin assistant
  • Stopping forgery of mail from the college president

Less formal authorization

slide-37
SLIDE 37

Vox Clamantis in Deserto

Research Angles

  • name equivalence
  • non-identity attributes
  • delegation
  • ontology mapping

Expressiveness: PKI Tools: Other areas:

  • X.509 SubjectAltName
  • X.509 attribute certs/PERMIS
  • X.509 proxy certs
  • SDSI/SPKI, XACML, hybrids
  • HEBCA
  • Trust Management
  • HCISEC
slide-38
SLIDE 38

Vox Clamantis in Deserto

And in Conclusion

"It hurts to straddle the fence." Mismatch: http://www.cs.dartmouth.edu/~sws/abstracts/sm04.shtml Web spoofing: http://www.cs.dartmouth.edu/~sws/abstracts/ys02.shtml Signature hacking: http://www.cs.dartmouth.edu/~sws/abstracts/ksa.shtml Plastic dinosaurs: http://www.cs.dartmouth.edu/~sws/papers/eq.pdf Keyjacking: http://www.cs.dartmouth.edu/~sws/abstracts/msz04.shtml http://www.cs.dartmouth.edu/~sws/abstracts/shemp.shtml Thanks: NSF Career, DoJ/DHS, Mellon, Internet2/AT&T, Cisco, Sun, Intel