Re: The Tangled Web on confused deputies and ambient authority

On Tue, 28 Oct 2014, David Barbour wrote:

> On Tue, Oct 28, 2014 at 9:50 PM, Tony Arcieri <[email protected]> wrote:
>
>> Transcribed: *Confused deputy problem* is a generic concept in
>> information security used to refer to a broad class of design or
>> implementation flaws. The term describes any vector that allows the
>> attacker to trick a program into misusing some "authority" (access
>> privileges) to manipulate a resource in an unintended manner
>>
>
> I feel this description of confused deputy problem is too broad. There are
> many attacks based, for example, on unexpected inputs where one might cause
> an agent to misuse authority. Yet, in those cases, there might only be one
> authority to misuse. Confused deputy refers to a more specific class of
> problems where there is some clear partitioning of authority (e.g.
> compiling vs. billing, in the common example) but the deputy fails to shift
> into different roles with different authorities.

http://www.youtube.com/watch?v=PChzIsepmdk

?

:-)


John