Computer Systems Security: Winter 2018 Assignment 4

This assignment is not yet finalized.

This assignment has 20 points in 7 questions.

Due: April 9, 2018, 10 AM

1. [1] When code runs in a "sandboxed environment" does this refer to a specific security technology? Explain briefly.
2. [1] Why is it harder to implement protection boundaries within a process, as compared to having an operating system implement protection boundaries? Explain briefly.
3. [1] Which is a better interface for implementing security restrictions, function/method calls or system calls? Why?
4. [1] How do language runtimes (interpreted and just-in-time compiled) provide opportunities for enforcing security properties? Why can't binaries compiled to machine code provide the same security guarantees?
5. [4] Firefox Pinterest save button extension:
   1. [1] What does this extension do?
   2. [1] What permissions does it need?
   3. [1] Why does it need these permissions?
   4. [1] Is it possible for the extension to perform actions unrelated to its purpose with these permissions? Explain briefly.

   Hint: Refer to Firefox's description of permissions.

6. [4] How is iOS runtime security (see Apple's Security Whitepaper, p. 23-24) like OS virtualization, as implemented, for example, by Linux-VServer? How is it different? Explain each and compare/contrast.
7. [8] Define whitelists, blacklists, anomaly detection, and virtualization. For each, give an example of a security mechanism base on that strategy, briefly explaining how the strategy relates to the mechanism.