Re: On classifying attacks

[Adam Shostack <adam () homeport org>]

On Mon, Jul 18, 2005 at 10:49:00AM -0500, James Longstreet wrote:
| > We disagree here.  The vulnerability is neither truly remote nor
| > local, in the normal senses as we have defined them here.  It is a
| > different kind of vulnerability altogether.  The vulnerability is one
| > to automatically triggering trojan horses....  Just as in the case of
| > the fabled Trojan Horse, there is no vulnerability at all until the
| > local users make a decision to trust something (data in this case,
| > rather than a hollowed out horse-shaped monument) from an outside
| > source.  In this case, the trust is given implicitly rather than
| > explicitly.  This is no different than if I handed you a disk, told
| > you to run the program on the disk, and you did so -- resulting in the
| > destruction of your hard drive.  Would you call this a remote
| > vulnerability?  Of course not.  But the mechanism is exactly the
| > same... except that some of the minor details are different.
| 
| It's completely different.  If you gave me a program on a disk, I wouldn't
| run it, because I know that programs that I run can do whatever they want
| on my system.  That's not because of a bug, it's because that's what a
| computer does -- run programs.

Just as an aside, no.

Operating systems run programs and control access to resources.  The
idea that any program can do anything to your system is a strange
one.  Systems like Goldberg and Wagner's Janus, or Cowan and co.'s
Subdomain, or heck, even the Java security manager, impose limits on
what a program that you run can do.

That most commercial operating systems lack these sorts of controls is
unfortunate.  I would really like to be able to limit what files and
directories my mail client or web browser can touch.

| If you gave me a program on disk and I ran it, I am giving you permission
| to run arbitrary code on my system.  Therefore, there is no bug.  The
| blame lies solely on me, not on my operating system, computer, or the
| program itself.

Again, the blame lies on your operating system for not letting you do
what you want in a common situation.

That's neither here nor there with regards to the local/remote or
credentialed/anonymous discussion.  But I think that on a security
list, we should not udnerestimate the value of OS features.

Adam