Re: [friam] SOSP History Day

On Sun, Oct 11, 2015 at 11:49 AM, Dan Connolly <[email protected]> wrote:

> On Sun, Oct 11, 2015 at 1:22 PM, Mark S. Miller <[email protected]>
> wrote:
> > On Sun, Oct 11, 2015 at 11:14 AM, Dan Connolly <[email protected]> wrote:
> >>
> >> Perhaps you could help me understand a little better?
> >>
> >> I'm having trouble seeing how "any vulnerability in any software
> >> someone like myself may invoke, for example the sqrt function, is a
> >> threat to delete all my files or contribute to a DDOS or spear
> >> phishing attack" is any more or less true than "insecurity anywhere is
> >> a threat to security everywhere."
> >>
> > If the sqrt function you're running is vulnerable, you are at risk. But
> if
> > only the sqrt function I am running is vulnerable, that does not put you
> at
> > risk.
>
> If there's an arbitrary code execution vulnerability in the sqrt
> function you are running, then the attacker can forge network messages
> from you or your machine. If that sqrt function is on enough machines,
> the attacker can can reach out and put me at risk.
>

Only if you are already vulnerable. The vulnerability in my sqrt function
does not itself make you vulnerable, even if it does exploit a
vulnerability you already have.



>
> > Note that the vulnerability-thru-excess-authority I am focused on here is
> > quite distinct from DDOS, which is a resource exhaustion attack on
> > availability; or spear phishing, which is a social engineering attack
> > involving further human actions.
>
> I don't see the distinction in practice. DDOS attacks and spear
> phishing are, in practice, deployed by exploiting
> vulnerability-thru-excess-authority as a consequence of conventional
> security choices.
>

DDOS is an attack only on availability. Deleting files, which is indeed my
example, can be viewed at an attack on either availability or integrity,
depending on how we split hairs. However, my sqrt function can also modify
and thereby corrupt my files, which is clearly an attack on integrity.

Spear phishing depends on triggering new human actions. Humans must
participate for the attack to proceed. The vulnerability is my sqrt
function for not by itself make you vulnerable to spear phishing, even if
it does exploit a vulnerability you already have.


>
> It would seem to me that capability approaches don't have the same
> explosive* consequences to faults and hence the economics of
> propagation would be entirely different.
>
> The other alternative I see is identity-based systems that are
> sufficiently locked down to have similar economics. I don't think
> botnets of iPads are very likely.
>
> * in the sense of https://en.wikipedia.org/wiki/Principle_of_explosion


I had not heard that term before. I like it.

In any case, I agree that caps substantially limit these explosions, and
that is much of the point I was trying to make. But the acl approach is
still *much* less explosive than classic logic, where one flaw destroys the
universe.


>
> --
> Dan Connolly
> http://www.madmode.com/
>



-- 
    Cheers,
    --MarkM

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk