full-disclosure - 4 Questions: Latest IE vulnerability, Firefox vs IE security, User vs Admin risk profile, and browsers coded in 100% Managed Verifiable code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060328234359.23636.qmail@paddy.troja.mff.cuni.cz>
Date: Wed Mar 29 01:43:39 2006
From: peak at argo.troja.mff.cuni.cz (Pavel Kankovsky)
Subject: 4 Questions: Latest IE vulnerability, Firefox
	vs IE security, User vs Admin risk profile, and browsers coded in 100%
	Managed Verifiable code

On Mon, 27 Mar 2006, Brian Eaton wrote:

> > Properly implemented and configured MAC can prevent the leakage of
> > confidential (i.e. sensitive personal) information to (unauthorized) web
> > sites.
> 
> You lost me here.  How would you design a MAC policy that lets firefox
> remember my password for a web site, but doesn't let arbitrary code
> running via a buffer overflow get at that same password?

Let's call the object where the password is stored P, the subject
representing the site where P is used X, and the subject representing an
arbitrary evil site Y.

The (partial) mandatory policy is as follows:
1. X has "need to know" for P and is allowed to read it.
2. Y (or any other site) is not allowed to read P.

As soon as the browser process reads P, its (potential) ability to send
any data to Y is lost forever because information flow from P to Y is
prohibited by the mandatory policy. This is a dynamic variant of the 
*-property of the Bell-LaPadula security model.

The design of a usable browser on the top of such a security mechanism
would be somewhat tricky because we would need a dedicated process (or
several processes) for every site and it would be almost impossible to
follow external links leading out of password protected sites because a
subverted process might use such a link to leak confidential data.

The solution of the latter problem might be to scrap the process sending
data containing the password to the server as soon as it sends the request
and replace it with a fresh "untainted" process handling (interpreting and
displaying) the server's response (of course, we'd have to trust the
server to never send the password back to the client, e.g to be 100% free
of XSS bugs...).

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."