SystemsSec 2018W Lecture 13

Audio

Notes

Malware

Software judged to be "malicious", ultimately a value judgment rather than technical/function judgment
Depends on your perspective
Can be almost anything so, it is often hard to judge whether a particular software contains malicious code
Mostly a problem for client machines because it is typically installed by users.

Vulnerability: A hole in defense that is exploitable

Exploit: Code that gets around vulnerability

Malware can use exploits to take advantage of vulnerabilities in the system but it is important to note that a vulnerability in software does not necessarily imply that it is malware.

Developers are often reluctant to take vulnerabilities seriously.

Exploits often used to increase access, i.e. privilege escalation.

Anti-Malware

Software that detects and removes malware. Often uses same mechanisms used in "spyware" or "adware". It "watches" users.

It is a political process. Platform owners e.g. Microsoft, Apple, Google ultimately decide what gets to run on their platforms.

The problem of anti-malware is really an undecidable problem. Anti-malware stops the wide spreading of malware which only matters on a platform that you can install arbitrary code.

So how is it solved in practice? There are a couple of basic strategies.

Whitelist - a list of things that are allowed e.g. an invite list for a party
Blacklist - a list of anybody but the people on the whitelist e.g. casinos keep a list of people who are not allowed inside the casino

Typical anti-malware for Windows use blacklists(i.e. "malicious" code patterns). The problem with blacklists is that you have to give a list of all the badness in the world. It is a hopeless proposition. They can't use whitelists because they are not in a position to dictate what is allowed.

Whitelist is much simpler because you just need to list what you think is good.

Security solutions based on whitelists:

Signed code
App stores

Modern app stores e.g. Google Play, Apple App Store use whitelists, i.e. code that is allowed on your system. This has limits too. How do you have a whitelist and have the number the number of applications scale? For each app submitted to the store, they have to go through a reviewing process that essentially does what anti-malware would do.

Why is Linux less subject to malware issues than Windows? Fewer targets. Also, people that use Linux typically install software from the distribution vendor which has been vetted.

If you are running Windows, what anti-malware should you run? Windows Defender, the anti-malware from Microsoft enabled by default is decent. You have to trust Microsoft anyways and they have incentives to make sure their anti-malware solution does not compromise the performance of their platform and that the big threats are taken care of.

iOS

Apple takes aggressive steps to lock down system, they don't allow arbitrary code to be installed
Provides system level virtualization
Applications runs in containers each with their own copy of the file system.

You can get around the whitelist on iOS but you have to be a developer and decide which devices you want to run your code on.

This is very different from Android, where you instead get a very elaborate permissions model (i.e. capabilities).

Jailbreak

Remove software restrictions imposed by manufacturer (e.g. Apple)
Eliminates system level virtualization (i.e. containers) so that processes can "see" each other
Compromises the security of an iPhone
Technical term that refers to BSD jails