Verify what? Navigating the Attack Surface Mark S. Miller, Google - - PowerPoint PPT Presentation

▶
verify what
SMART_READER_LITE
LIVE PREVIEW

Verify what? Navigating the Attack Surface Mark S. Miller, Google - - PowerPoint PPT Presentation

Jan 14, 2024 98 likes •599 views

Verify what? Navigating the Attack Surface Mark S. Miller, Google Formal Methods meets JavaScript Imperial College, March 2018 Risk as Attack Surface a Expected Risk: likelihood * damage Potential damage Likelihood of exploitable

slide-1
SLIDE 1

Verify what?

Navigating the Attack Surface

Mark S. Miller, Google Formal Methods meets JavaScript Imperial College, March 2018

slide-2
SLIDE 2

a

Risk as Attack Surface

slide-3
SLIDE 3

a

Expected Risk: ∫likelihood * damage

Likelihood

  • f exploitable

vulnerability Potential damage

slide-4
SLIDE 4

a

Expected Risk: ∫likelihood * damage

Fallible agents Resources to damage

slide-5
SLIDE 5

a

Access Matrix Permission or Authority?

Fallible agents Resources to damage

slide-6
SLIDE 6

/etc/passwd Alan’s stuff Barb’s stuff Doug’s stuff Kernel + root OS’s TCB ~alan ~barb ~doug a

Hollow Out the Attack Surface!

slide-7
SLIDE 7

/etc/passwd Alan’s stuff Barb’s stuff Doug’s stuff Kernel + root OS’s TCB ~alan ~barb ~doug a

Decouple accounts

slide-8
SLIDE 8

a

slide-9
SLIDE 9

contact info pgp keyring calc.xls Net access Shell, Desktop Browser Spreadsheet Email client a

Decouple applications

slide-10
SLIDE 10

contact info pgp keyring calc.xls Net access MobileOS Doug’s TCB Browser app Spreadsheet doc Mail app a

Decouple apps

slide-11
SLIDE 11

contact info pgp keyring calc.xls Net access MobileOS Doug’s TCB Browser app Spreadsheet doc Mail app a

Decouple apps

slide-12
SLIDE 12

Substrate Historical System System

Hardware

CMNM, Plessey 250, C.mmp, CM*, CAP, Flex, IBM System/38, Intel 432 Crash-SAFE, CHERI, Risc-V

OS

DVH, Hydra, StarOS, RATS, Cal-TSS, PSOS, NLTSS, Spring Capsicum, CloudABI, Genode, 
 Barrelfish, Fuchsia

KeyKOS family OS

Gnosis, KeyKOS, GuardOS, EROS, CapROS, Coyotos seL4

Distributed OS

Ameoba, Mach, Midori

Language

Gedanken, W7, J-Kernel, Joe-E, Emily, CaPerl, Caja, Tamed Pict, Plash Monte, Frozen Realms, shill, Wyvern, wasm-gc

Distributed Language

Act-1, Eden, Emerald, 
 Vulcan, Joule, E, Oz-E, M# Pony, Kappa, Dr.SES

Distributed Storage

Scoopfs Tahoe-LAFS

Crypto Protocol

DCCS, CapTP, Foolscap, Client Utility, Waterken COAST, Cap’n Proto

Offline Certs

SPKI/SDSI, E-Speak, CapCert Macaroons, ld-ocap

Blockchain

Gravity, Dfinity, RChain, Cosmos, Veres One, Sovrin, Agoric Systems

User Interface

CapDesk, Scoopfs, Belay Sandstorm

slide-13
SLIDE 13

Substrate Historical System System

Hardware

CMNM, Plessey 250, C.mmp, CM*, CAP, Flex, IBM System/38, Intel 432 Crash-SAFE, CHERI, Risc-V

OS

DVH, Hydra, StarOS, RATS, Cal-TSS, PSOS, NLTSS, Spring Capsicum, CloudABI, Genode, 
 Barrelfish, Fuchsia

KeyKOS family OS

Gnosis, KeyKOS, GuardOS, EROS, CapROS, Coyotos seL4

Distributed OS

Ameoba, Mach, Midori

Language

Gedanken, W7, J-Kernel, Joe-E, Emily, CaPerl, Caja, Tamed Pict, Plash Monte, Frozen Realms, shill, Wyvern, wasm-gc

Distributed Language

Act-1, Eden, Emerald, 
 Vulcan, Joule, E, Oz-E, M# Pony, Kappa, Dr.SES

Distributed Storage

Scoopfs Tahoe-LAFS

Crypto Protocol

DCCS, CapTP, Foolscap, Client Utility, Waterken COAST, Cap’n Proto

Offline Certs

SPKI/SDSI, E-Speak, CapCert Macaroons, ld-ocap

Blockchain

Gravity, Dfinity, RChain, Cosmos, Veres One, Sovrin, Agoric Systems

User Interface

CapDesk, Scoopfs, Belay Sandstorm

slide-14
SLIDE 14

Substrate Historical System System

Hardware

CMNM, Plessey 250, C.mmp, CM*, CAP, Flex, IBM System/38, Intel 432 Crash-SAFE, CHERI, Risc-V

OS

DVH, Hydra, StarOS, RATS, Cal-TSS, PSOS, NLTSS, Spring Capsicum, CloudABI, Genode, 
 Barrelfish, Fuchsia

KeyKOS family OS

Gnosis, KeyKOS, GuardOS, EROS, CapROS, Coyotos seL4

Distributed OS

Ameoba, Mach, Midori

Language

Gedanken, W7, J-Kernel, Joe-E, Emily, CaPerl, Caja, Tamed Pict, Plash Monte, Frozen Realms, shill, Wyvern, wasm-gc

Distributed Language

Act-1, Eden, Emerald, 
 Vulcan, Joule, E, Oz-E, M# Pony, Kappa, Dr.SES

Distributed Storage

Scoopfs Tahoe-LAFS

Crypto Protocol

DCCS, CapTP, Foolscap, Client Utility, Waterken COAST, Cap’n Proto

Offline Certs

SPKI/SDSI, E-Speak, CapCert Macaroons, ld-ocap

Blockchain

Gravity, Dfinity, RChain, Cosmos, Veres One, Sovrin, Agoric Systems

User Interface

CapDesk, Scoopfs, Belay Sandstorm

slide-15
SLIDE 15

contact info pgp keyring calc.xls Net access E, CapDesk Doug’s TCB DarpaBrowser caplet Excel in Polaris CapMail caplet a

Decouple caplets

slide-16
SLIDE 16

a

slide-17
SLIDE 17

contact info pgp keyring calc.xls Net access main() CapMail’s TCB address book gpg plugin SMTP , POP stacks a

Decouple modules

slide-18
SLIDE 18

contact info pgp keyring calc.xls Net access main() CapMail’s TCB address book gpg plugin SMTP , POP stacks a

Decouple modules

slide-19
SLIDE 19

s platform ess book

slide-20
SLIDE 20

Decouple objects

exports (TCB)

slide-21
SLIDE 21

exports (TCB)

Decouple objects

slide-22
SLIDE 22

Defensive Programming

slide-23
SLIDE 23

Defense in Depth

slide-24
SLIDE 24

/etc/passwd Alan’s stuff Barb’s stuff Doug’s stuff Kernel + root OS’s TCB ~alan ~barb ~doug a

Reduce area Mix of strategies

slide-25
SLIDE 25

/etc/passwd Alan’s stuff Barb’s stuff Doug’s stuff Kernel + root OS’s TCB ~alan ~barb ~doug a

Reduce horizontal space POLA — Principle of Least Authority

slide-26
SLIDE 26

/etc/passwd Alan’s stuff Barb’s stuff Doug’s stuff Kernel + root OS’s TCB ~alan ~barb ~doug

Reduce density Apply POLA recursively

a

slide-27
SLIDE 27

lang, desktop /etc/passwd Alan’s stuff Barb’s stuff Doug’s stuff ~alan ~barb ~doug

Reduce height Minimize+verify each TCB

a Verified 𝞶kernel No root main()

slide-28
SLIDE 28

/etc/passwd Alan’s stuff Barb’s stuff Doug’s stuff ~alan ~barb ~doug

Reduce width Partition virtualized legacy

a VMM Polaris CHERI ffi

slide-29
SLIDE 29

Reduce horizontal space

POLA

Reduce density

Composition across scales

Reduce height

Minimize TCBs: 𝞶kernel, lang, …

Reduce width

Compositional virtualization

Multiplicative risk reduction

slide-30
SLIDE 30

Reduce horizontal space

POLA Patterns limit authority?

Reduce density

Composition across scales Embedding preserves security?

Reduce height

Minimize TCBs: 𝞶kernel, lang, … Formal verification

Reduce width

Compositional virtualization Impenetrable confinement?

Choose Verification Battles

slide-31
SLIDE 31

Substrate Historical System System

Hardware

CMNM, Plessey 250, C.mmp, CM*, CAP, Flex, IBM System/38, Intel 432 Crash-SAFE, CHERI, Risc-V

OS

DVH, Hydra, StarOS, RATS, Cal-TSS, PSOS, NLTSS, Spring Capsicum, CloudABI, Genode, 
 Barrelfish, Fuchsia

KeyKOS family OS

Gnosis, KeyKOS, GuardOS, EROS, CapROS, Coyotos seL4

Distributed OS

Ameoba, Mach, Midori

Language

Gedanken, W7, J-Kernel, Joe-E, Emily, CaPerl, Caja, Tamed Pict, Plash Monte, Frozen Realms, shill, Wyvern, wasm-gc

Distributed Language

Act-1, Eden, Emerald, 
 Vulcan, Joule, E, Oz-E, M# Pony, Kappa, Dr.SES

Distributed Storage

Scoopfs Tahoe-LAFS

Crypto Protocol

DCCS, CapTP, Foolscap, Client Utility, Waterken COAST, Cap’n Proto

Offline Certs

SPKI/SDSI, E-Speak, CapCert Macaroons, ld-ocap

Blockchain

Gravity, Dfinity, RChain, Cosmos, Veres One, Sovrin, Agoric Systems

User Interface

CapDesk, Scoopfs, Belay Sandstorm

slide-32
SLIDE 32

Questions?

slide-33
SLIDE 33
slide-34
SLIDE 34

Networks of request making

Object to Object (software eng) Human to Object (ui) Object to Human (ui) Human to Human (econ)

slide-35
SLIDE 35

Ince

Inspect internals Allow actions Select agent Explain request Agent reacts Monitor effects Reward cooperation

The Principal-Agent Loop

slide-36
SLIDE 36

Ince

Inspect internals Allow actions Select agent Explain request Agent reacts Monitor effects Reward cooperation

The Principal-Agent Loop

slide-37
SLIDE 37

Ince

Inspect internals Allow actions Select agent Explain request Agent reacts Monitor effects Reward cooperation

The Principal-Agent Loop

slide-38
SLIDE 38

Ince

Inspect internals Allow actions Select agent Explain request Agent reacts Monitor effects Reward cooperation

The Principal-Agent Loop

slide-39
SLIDE 39

The Elements of Decision Alignment

Human to Human Human to/from Object Object to Object Select agent Trademark Chain of custody App stores White and black lists Trusted developer Same origin Inspect internals Accounting controls Trusted path URL bar Types, Verification Open source eyeballs Allow actions Law, Contracts App permissions Powerbox Security Protection patterns Explain request Language User interface Abstraction Reward cooperation Economics Incentive Alignment Objective functions Machine learning Agorics Monitor effects Reviews, Complaints Word of mouth Bug reports Contracts, Testing Backprop

slide-40
SLIDE 40

The Elements of Decision Alignment

Human to Human Human to/from Object Object to Object Select agent Trademark Chain of custody App stores White and black lists Trusted developer Same origin Inspect internals Accounting controls Trusted path URL bar Types, Verification Open source eyeballs Allow actions Law, Contracts App permissions Powerbox Security Protection patterns Explain request Language User interface Abstraction Reward cooperation Economics Incentive Alignment Objective functions Machine learning Agorics Monitor effects Reviews, Complaints Word of mouth Bug reports Contracts, Testing Backprop

slide-41
SLIDE 41

The Elements of Decision Alignment

Human to Human Human to/from Object Object to Object Select agent Trademark Chain of custody App stores White and black lists Trusted developer Same origin Inspect internals Accounting controls Trusted path URL bar Types, Verification Open source eyeballs Allow actions Law, Contracts App permissions Powerbox Security Protection patterns Explain request Language User interface Abstraction Reward cooperation Economics Incentive Alignment Objective functions Machine learning Agorics Monitor effects Reviews, Complaints Word of mouth Bug reports Contracts, Testing Backprop

slide-42
SLIDE 42

The Elements of Decision Alignment

Human to Human Human to/from Object Object to Object Select agent Trademark Chain of custody App stores White and black lists Trusted developer Same origin Inspect internals Accounting controls Trusted path URL bar Types, Verification Open source eyeballs Allow actions Law, Contracts App permissions Powerbox Security Protection patterns Explain request Language User interface Abstraction Reward cooperation Economics Incentive Alignment Objective functions Machine learning Agorics Monitor effects Reviews, Complaints Word of mouth Bug reports Contracts, Testing Backprop

slide-43
SLIDE 43

The Elements of Decision Alignment

Human to Human Human to/from Object Object to Object Select agent Trademark Chain of custody App stores White and black lists Trusted developer Same origin Inspect internals Accounting controls Trusted path URL bar Types, Verification Open source eyeballs Allow actions Law, Contracts App permissions Powerbox Security Protection patterns Explain request Language User interface Abstraction Reward cooperation Economics Incentive Alignment Objective functions Machine learning Agorics Monitor effects Reviews, Complaints Word of mouth Bug reports Contracts, Testing Backprop

slide-44
SLIDE 44

The Elements of Decision Alignment

Human to Human Human to/from Object Object to Object Select agent Trademark Chain of custody App stores White and black lists Trusted developer Same origin Inspect internals Accounting controls Trusted path URL bar Types, Verification Open source eyeballs Allow actions Law, Contracts App permissions Powerbox Security Protection patterns Explain request Language User interface Abstraction Reward cooperation Economics Incentive Alignment Objective functions Machine learning Agorics Monitor effects Reviews, Complaints Word of mouth Bug reports Contracts, Testing Backprop

slide-45
SLIDE 45

Escrow Exchange Contract

function escrowExchange(a, b) { // a from Alice, b from Bob let decide; const decisionP = new Promise(resolve => { decide = resolve; }); function transfer(srcPurseP, dstPurseP, amount) { const makeEscrowPurseP = Q.join(srcPurseP ! makePurse, dstPurseP ! makePurse); const escrowPurseP = makeEscrowPurseP ! (); Q(decisionP).then( // setup phase 2 _ => dstPurseP ! deposit(amount, escrowPurseP); }, _ => srcPurseP ! deposit(amount, escrowPurseP); }); return escrowPurseP ! deposit(amount, srcPurseP); // phase 1 } async function failOnly(cancellationP) { throw await cancellationP; } decide(Promise.race([Promise.all([ transfer(a.moneySrcP, b.moneyDstP, b.moneyNeeded), transfer(b.stockSrcP, a.stockDstP, a.stockNeeded) ]), failOnly(a.cancellationP), failOnly(b.cancellationP)])); return decisionP; }

slide-46
SLIDE 46

€ Issuer $ Issuer Contract Host Alice Bob

slide-47
SLIDE 47

Substrate Independent Cap Logic

Hardware

CAP, C.mmp, IBM Sys38, Intel 432, CHERI

OS

DVH, Hydra, KeyKOS, Capsicum, Midori, seL4

Language

Gedanken, W7, E, Joe-E, Emily, M#, Dr.SES

Crypto Protocol

DCCS, CapTP, Foolscap, Waterken, Cap’n Proto

Offline Certs

SPKI/SDSI, CapCert, Macaroons, ld-ocap

Blockchain

Gravity, Dfinity, RChain, Cosmos, Agoric Systems

User Interface

CapDesk, Belay, Sandstorm

slide-48
SLIDE 48

Substrate Independent Cap Logic

Hardware

CAP, C.mmp, IBM Sys38, Intel 432, CHERI

OS

DVH, Hydra, KeyKOS, Capsicum, Midori, seL4

Language

Gedanken, W7, E, Joe-E, Emily, M#, Dr.SES

Crypto Protocol

DCCS, CapTP, Foolscap, Waterken, Cap’n Proto

Offline Certs

SPKI/SDSI, CapCert, Macaroons, ld-ocap

Blockchain

Gravity, Dfinity, RChain, Cosmos, Agoric Systems

User Interface

CapDesk, Belay, Sandstorm