Verify what? Navigating the Attack Surface Mark S. Miller, Google - PowerPoint PPT Presentation

Verify what? Navigating the Attack Surface Mark S. Miller, Google Formal Methods meets JavaScript Imperial College, March 2018

Risk as Attack Surface a

Expected Risk: ∫ likelihood * damage Potential damage Likelihood of exploitable vulnerability a

Expected Risk: ∫ likelihood * damage Resources to damage Fallible agents a

Access Matrix Permission or Authority? Resources to damage Fallible agents a

Hollow Out the Attack Surface! /etc/passwd Alan’s stu ff Barb’s stu ff Doug’s stu ff Kernel + root OS’s TCB ~alan ~barb ~doug a

Decouple accounts /etc/passwd Alan’s stu ff Barb’s stu ff Doug’s stu ff Kernel + root OS’s TCB ~alan ~barb ~doug a

a

Decouple applications contact info pgp keyring calc.xls Net access Shell, Desktop Browser Spreadsheet Email client a

Decouple apps contact info pgp keyring calc.xls Net access MobileOS Doug’s TCB Browser app Spreadsheet doc Mail a app

Decouple apps contact info pgp keyring calc.xls Net access MobileOS Doug’s TCB Browser app Spreadsheet doc Mail a app

Substrate Historical System System CMNM, Plessey 250, C.mmp, CM*, Hardware Crash-SAFE, CHERI, Risc-V CAP, Flex, IBM System/38, Intel 432 DVH, Hydra, StarOS, RATS, Capsicum, CloudABI, Genode, 
 OS Cal-TSS, PSOS, NLTSS, Spring Barrelfish, Fuchsia Gnosis, KeyKOS, GuardOS, KeyKOS family OS seL4 EROS, CapROS, Coyotos Distributed OS Ameoba, Mach, Midori Gedanken, W7, J-Kernel, Joe-E, Emily, Monte, Frozen Realms, Language CaPerl, Caja, Tamed Pict, Plash shill, Wyvern, wasm-gc Act-1, Eden, Emerald, 
 Distributed Language Pony, Kappa, Dr.SES Vulcan, Joule, E, Oz-E, M# Distributed Storage Scoopfs Tahoe-LAFS DCCS, CapTP, Foolscap, Crypto Protocol COAST, Cap’n Proto Client Utility, Waterken Offline Certs SPKI/SDSI, E-Speak, CapCert Macaroons, ld-ocap Gravity, Dfinity, RChain, Cosmos, Blockchain Veres One, Sovrin, Agoric Systems User Interface CapDesk, Scoopfs, Belay Sandstorm

Substrate Historical System System CMNM, Plessey 250, C.mmp, CM*, Hardware Crash-SAFE, CHERI, Risc-V CAP, Flex, IBM System/38, Intel 432 DVH, Hydra, StarOS, RATS, Capsicum, CloudABI, Genode, 
 OS Cal-TSS, PSOS, NLTSS, Spring Barrelfish, Fuchsia Gnosis, KeyKOS, GuardOS, KeyKOS family OS seL4 EROS, CapROS, Coyotos Distributed OS Ameoba, Mach, Midori Gedanken, W7, J-Kernel, Joe-E, Emily, Monte, Frozen Realms , Language CaPerl, Caja , Tamed Pict, Plash shill, Wyvern, wasm-gc Act-1, Eden, Emerald, 
 Distributed Language Pony, Kappa, Dr.SES Vulcan, Joule, E, Oz-E, M# Distributed Storage Scoopfs Tahoe-LAFS DCCS, CapTP, Foolscap, Crypto Protocol COAST, Cap’n Proto Client Utility, Waterken Offline Certs SPKI/SDSI, E-Speak, CapCert Macaroons, ld-ocap Gravity, Dfinity, RChain , Cosmos , Blockchain Veres One , Sovrin , Agoric Systems User Interface CapDesk, Scoopfs, Belay Sandstorm

Substrate Historical System System CMNM, Plessey 250, C.mmp, CM*, Hardware Crash-SAFE, CHERI, Risc-V CAP, Flex, IBM System/38, Intel 432 DVH, Hydra, StarOS, RATS, Capsicum, CloudABI, Genode, 
 OS Cal-TSS, PSOS, NLTSS, Spring Barrelfish, Fuchsia Gnosis, KeyKOS, GuardOS, KeyKOS family OS seL4 EROS, CapROS, Coyotos Distributed OS Ameoba, Mach, Midori Gedanken, W7, J-Kernel, Joe-E, Emily, Monte, Frozen Realms, Language CaPerl, Caja, Tamed Pict, Plash shill, Wyvern, wasm-gc Act-1, Eden, Emerald, 
 Distributed Language Pony, Kappa, Dr.SES Vulcan, Joule, E , Oz-E, M# Distributed Storage Scoopfs Tahoe-LAFS DCCS, CapTP , Foolscap, Crypto Protocol COAST, Cap’n Proto Client Utility, Waterken Offline Certs SPKI/SDSI, E-Speak, CapCert Macaroons, ld-ocap Gravity, Dfinity, RChain, Cosmos, Blockchain Veres One, Sovrin, Agoric Systems User Interface CapDesk , Scoopfs, Belay Sandstorm

Decouple caplets contact info pgp keyring calc.xls Net access E, CapDesk Doug’s TCB DarpaBrowser caplet Excel in Polaris CapMail a caplet

a

Decouple modules contact info pgp keyring calc.xls Net access main() CapMail’s TCB address book gpg plugin SMTP , POP a stacks

Decouple modules contact info pgp keyring calc.xls Net access main() CapMail’s TCB address book gpg plugin SMTP , POP a stacks

s platform ess book

Decouple objects exports (TCB)

Decouple objects exports (TCB)

Defensive Programming

Defense in Depth

Reduce area Mix of strategies /etc/passwd Alan’s stu ff Barb’s stu ff Doug’s stu ff Kernel + root OS’s TCB ~alan ~barb ~doug a

Reduce horizontal space POLA — Principle of Least Authority /etc/passwd Alan’s stu ff Barb’s stu ff Doug’s stu ff Kernel + root OS’s TCB ~alan ~barb ~doug a

Reduce density Apply POLA recursively /etc/passwd Alan’s stu ff Barb’s stu ff Doug’s stu ff Kernel + root OS’s TCB ~alan ~barb ~doug a

Reduce height Minimize+verify each TCB /etc/passwd Alan’s stu ff Barb’s stu ff Doug’s stu ff Verified 𝞶 kernel No root ~alan ~barb lang, desktop ~doug main() a

Reduce width Partition virtualized legacy /etc/passwd Alan’s stu ff Barb’s stu ff Doug’s stu ff ~alan VMM ~barb ~doug Polaris CHERI ffi a

Multiplicative risk reduction Reduce horizontal space POLA Reduce density Composition across scales Reduce height Minimize TCBs: 𝞶 kernel, lang, … Reduce width Compositional virtualization

Choose Verification Battles Reduce horizontal space POLA Patterns limit authority? Reduce density Composition across scales Embedding preserves security? Reduce height Minimize TCBs: 𝞶 kernel, lang, … Formal verification Reduce width Compositional virtualization Impenetrable confinement?

Substrate Historical System System CMNM, Plessey 250, C.mmp, CM*, Hardware Crash-SAFE, CHERI , Risc-V CAP, Flex, IBM System/38, Intel 432 DVH, Hydra, StarOS, RATS, Capsicum , CloudABI, Genode, 
 OS Cal-TSS, PSOS, NLTSS, Spring Barrelfish, Fuchsia Gnosis, KeyKOS, GuardOS, KeyKOS family OS seL4 EROS, CapROS, Coyotos Distributed OS Ameoba, Mach, Midori Gedanken, W7, J-Kernel, Joe-E, Emily, Monte , Frozen Realms , Language CaPerl, Caja , Tamed Pict, Plash shill, Wyvern, wasm-gc Act-1, Eden, Emerald, 
 Distributed Language Pony , Kappa, Dr.SES Vulcan, Joule, E, Oz-E, M# Distributed Storage Scoopfs Tahoe-LAFS DCCS, CapTP, Foolscap, Crypto Protocol COAST, Cap’n Proto Client Utility, Waterken Offline Certs SPKI/SDSI, E-Speak, CapCert Macaroons, ld-ocap Gravity, Dfinity, RChain, Cosmos , Blockchain Veres One, Sovrin , Agoric Systems User Interface CapDesk, Scoopfs, Belay Sandstorm

Questions?

Networks of request making Human to Human (econ) Object to Human (ui) Human to Object (ui) Object to Object (software eng)

The Principal-Agent Loop Allow Explain actions request Inspect internals Agent Ince reacts Reward Select Monitor cooperation agent effects

The Principal-Agent Loop Allow Explain actions request Inspect internals Agent Ince reacts Reward Select Monitor cooperation agent effects

The Principal-Agent Loop Allow Explain actions request Inspect internals Agent Ince reacts Reward Select Monitor cooperation agent effects

The Principal-Agent Loop Allow Explain actions request Inspect internals Agent Ince reacts Reward Select Monitor cooperation agent effects

The Elements of Decision Alignment Human to Human to/from Object to Human Object Object Select Trademark App stores Trusted developer agent Chain of custody White and black lists Same origin Inspect Trusted path Types, Verification Accounting controls internals URL bar Open source eyeballs Allow App permissions Security Law, Contracts actions Powerbox Protection patterns Explain Language User interface Abstraction request Reward Economics Machine learning Objective functions cooperation Incentive Alignment Agorics Monitor Reviews, Complaints Contracts, Testing Bug reports effects Word of mouth Backprop

The Elements of Decision Alignment Human to Human to/from Object to Human Object Object Select Trademark App stores Trusted developer agent Chain of custody White and black lists Same origin Types, Verification Inspect Trusted path Accounting controls Open source eyeballs internals URL bar Allow App permissions Security Law, Contracts actions Powerbox Protection patterns Explain Language User interface Abstraction request Reward Economics Machine learning Objective functions cooperation Incentive Alignment Agorics Monitor Reviews, Complaints Contracts, Testing Bug reports effects Word of mouth Backprop

The Elements of Decision Alignment Human to Human to/from Object to Human Object Object Select Trademark App stores Trusted developer agent Chain of custody White and black lists Same origin Inspect Trusted path Types, Verification Accounting controls internals URL bar Open source eyeballs Allow App permissions Security Law, Contracts actions Powerbox Protection patterns Explain Language User interface Abstraction request Reward Economics Machine learning Objective functions cooperation Incentive Alignment Agorics Contracts, Testing Monitor Reviews, Complaints Bug reports Backprop effects Word of mouth