Re: On classifying attacks
On Mon, Jul 18, 2005 at 10:49:00AM -0500, James Longstreet wrote:
| > We disagree here. The vulnerability is neither truly remote nor
| > local, in the normal senses as we have defined them here. It is a
| > different kind of vulnerability altogether. The vulnerability is one
| > to automatically triggering trojan horses.... Just as in the case of
| > the fabled Trojan Horse, there is no vulnerability at all until the
| > local users make a decision to trust something (data in this case,
| > rather than a hollowed out horse-shaped monument) from an outside
| > source. In this case, the trust is given implicitly rather than
| > explicitly. This is no different than if I handed you a disk, told
| > you to run the program on the disk, and you did so -- resulting in the
| > destruction of your hard drive. Would you call this a remote
| > vulnerability? Of course not. But the mechanism is exactly the
| > same... except that some of the minor details are different.
|
| It's completely different. If you gave me a program on a disk, I wouldn't
| run it, because I know that programs that I run can do whatever they want
| on my system. That's not because of a bug, it's because that's what a
| computer does -- run programs.
Just as an aside, no.
Operating systems run programs and control access to resources. The
idea that any program can do anything to your system is a strange
one. Systems like Goldberg and Wagner's Janus, or Cowan and co.'s
Subdomain, or heck, even the Java security manager, impose limits on
what a program that you run can do.
That most commercial operating systems lack these sorts of controls is
unfortunate. I would really like to be able to limit what files and
directories my mail client or web browser can touch.
| If you gave me a program on disk and I ran it, I am giving you permission
| to run arbitrary code on my system. Therefore, there is no bug. The
| blame lies solely on me, not on my operating system, computer, or the
| program itself.
Again, the blame lies on your operating system for not letting you do
what you want in a common situation.
That's neither here nor there with regards to the local/remote or
credentialed/anonymous discussion. But I think that on a security
list, we should not udnerestimate the value of OS features.
Adam