UKC - Feb 2013 - Analyzing the security of Windows 7 and Linux for cloud computing


Published on

University of Kent 2013 - CO899 System security
Presentation of the article:
Salah K, et al, Computers & Security (2012),

Published in: Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

UKC - Feb 2013 - Analyzing the security of Windows 7 and Linux for cloud computing

  1. 1. Original Article by Salah K, et al, Computers & Security (2012), Analyzing the security of Windows 7 and Linux for cloud computing Vincent Giersch - vg66
  2. 2. Contents •Authors •Main points of the article •Introduction to the cloud computing •Infrastructure as a Service (IaaS) •Authentication •Authorization •Network security •Accounting •Privacy and encryption •Conclusion •Criticism and improvements
  3. 3. Authors background •Khaled Salah Electrical and Computer Engineering Department, Khalifa University of Science Technology and Research (United Arab Emirates) •Jose M. Alcaraz Calero Department of Computer Science, Engineering Technical School, University of Valencia (Spain) •Jorge Bernal Bernabé and Juan M. Marín Perez Cloud and Security Lab, HewlettePackard Laboratories, Stroke Gifford, Bristol (UK) •Sherali Zeadally Department of Computer Science and Information Technology, University of the District of Columbia, Washington (USA)
  4. 4. Introduction to CLOUD COMPUTING
  5. 5. Virtual IT infrastructures Pay as you go
  6. 6. IaaS
  7. 7. IaaS solutions
  8. 8. IaaS solutions HypervisorS
  9. 9. Physical resources for guest operating systems Hypervisors CPU RAM Disk Network
  10. 10. OS images configured by the cloud provider or the user Cloud providers
  11. 11. OS images configured by the cloud provider or the user Cloud providers
  12. 12. Customer perspective •Usage a third-part infrastructure •Full control by the cloud provider •Customer want to keep his security and privacy
  13. 13. This article analyseS Fedora Core 15 with a 2.6.38 kernel Windows 7 Ultimate Edition
  14. 14. Authentication
  15. 15. Verify that a user is really who he claims to be.
  16. 16. Windows Authentication Architecture Windows Authentication (Local Security Authority) Win Logon MSV1_0 Kerberos CredSSP NTLM DigestSSP Interactive authentication Main component which use AP and SSP • Authentication Packages (AP) : • DLL which encapsulate authentication logic • Perform the logon in the OS • Security Support Providers (SSP) : • DLL which implement the SSPI • SSPI also provides non-interactive authentication
  17. 17. Linux Authentication Architecture Linux Authentication Login pam_unix pam_guest pam_kbr5 pam_radius Login processus (/bin/login) interacts with the libpam (Pluggable Authentication Modules). All the modules implements the PAM abstraction layer and are build and load as dynamic libraries.
  18. 18. cloud providers OS Images • Usually cloud providers modify OS image to configure the authentication (e.g. add SSH keys) • High security threat: the provider has access to the content of the VM • No possibility of encryption: adding keys would be impossible
  19. 19. Usage of an IDM • Windows and Linux provide authentication abstraction mechanisms • Utilisation of an Identity Management System (IdM) • Separation of the authentication from the image file system • Should be managed by the tenant organization • Example: Kerberos, OpenID, SAML • Problem: a fake IdM could be use if an attacker has access to file system or RAM
  20. 20. Authorization
  21. 21. Authorization: access control • Manages privileges granted for an authenticated user • Checks ands enforce these privileges when user perform actions over securable objects.
  22. 22. access control on Windows 7 Different access control subsystems executed simultaneously at runtime First access control: • Controls all resources managed in the OS e.g. a file, directory, process, registry key, windows service, printer, etc. • Each securable object has a security descriptor • This descriptor manage 2 ACL: • Discretionary Access Control List (DACL) • System Access Control List (SACL)
  23. 23. access control on Windows 7 Second access control, Mandatory Integrity Control (MAC): • Controls the access to securable objects • Addition to the discretionary access control (DAC) • Each user / securable object has a security level low, medium, high, system • To access to an object: user need a higher security level than required • Otherwise access is denied even it is authorized by another AC system
  24. 24. access control on Windows 7 Third access control, AppLocker: • Controls the execution of the processes • A Windows Service (Application Identity service) intercepts the execution • This service checks if the user has required right to execute the application • AppLocker policy uses application attributes Signed certificate, vendor name, application name and version • Advantage: The policy persists after application updates • Can be manually configured or using the Group Policy Management
  25. 25. access control on LINUX Linux provides different access control mechanisms First access control: • Secure every object in the file system Regular file, directory, device and process • Associated with an access right mask and a user and a group • User and group that execute a process are used to check rights while accessing to secured • When a user execute a process, it stores this user and group, there are used when the process access to secure objects • 3 permissions: read, write, execute with 3 levels: user, group, other.
  26. 26. access control on LINUX In modern distributions, this authorization model is extended with an ACL:
  27. 27. access control on LINUX Recent Linux distributions have additional access control mechanism, Mandatory Access Control (MAC). There are multiple implementation of this MAC: • AppArmor • TOMOYO • SELinux • GRSecurity After comparing these implementation, the authors chose SELinux.
  28. 28. Authorization • Windows and Linux authorization mechanisms store AC information inside the securable file objects • The system need at least one admin user, it usually true in case of IaaS • Problem: file that belongs to users who are not registered in the OS, for example an external IdM • This is an approach followed by AppLocker, which protects agains external intruders and cloud provider from executing undesired code in the guest OS.
  29. 29. Network security
  30. 30. Network security • All network can potentially be monitored Man-in-the-middle, or by the cloud provider (hypervisors, routing equipments, etc.) • Usually the possibility of network configuration are limited Hard to reproduce a particular networking topology or configuration • IPs addresses provided by the cloud provider Already used before ? How ? Blocked by some firewalls ? • MAC addresses uses in firewalls: virtualized adapters MAC addresses are managed by the cloud provider and change when using IaaS features • Create policies based on hostnames instead of IP addresses Windows: Still not possible with Windows firewall (possible using Zone-Alarm) Linux: Possible with Netfilter and IPTables • New issue: DNS poisoning and spoofing DNSSec can be used to validate and trust DNS responses
  31. 31. Accounting
  32. 32. Accounting • Logs are usually stored unencrypted in local file system • Can be accessed by the attacker and potentially modified • Could be destroyed when using snapshots, images, etc. • Logs must be stored in a separated logging system • These logs should be ciphered by the source OS if this logging system is provided by the cloud provider • So we have similar problems than the provisioning of user credentials: the initial configuration and provisioning of the VM
  33. 33. Privacy and encryption
  34. 34. Privacy of ram memory Could be protected by different methods: • Address Space Layout Randomization (ASLR) • Used in Linux 2.6.38 and Windows 7 • Loads critical application execution code into random memory location every time the system boot • Randomizes locations of the stack, heap, Process Environment Block and Thread Environment Block • Hard to extract sensible information from a dump of the memory • Disabling FireWire port This kind of port enables direct access without security restrictions to the memory Potential vulnerability highlighted: “Recently, all tools using AES-based encryption are being rapidly cracked by mean of the extraction of the AES keys when memory dumps are available.” → Use memory encryption at run-time For example on Linux, METAL (Memory Encryption and Transparent Aegis Library)
  35. 35. Disk encryptiON • Windows: BitLocker Supports only the Cipher Block Chaining (CBC) using IV derived from the sector number • Linux 2.6.38: dm-crypt / LUKS dm-crypt supports IEEE P1619 standards, for example XTS-AES • Encrypt the complete disk, all partitions and hibernate files • Place a bootable software in the MBR which request the decryption key • Two-factor authentication by USB or TPM (Trusted Platform Module) • Based on AES symmetric encryption Still vulnerable on runtime: The file system decryption key is located at some point of the memory.
  36. 36. Network encryptiON Windows 7 • DirectAccess, an easy and secure way of establishing VPNs Automatic bi-directional connection using IPv6 and IPsec Able to encapsulate IPv6 traffic into IPv4 with 6to4 or Teredo Able to use IP over HTTPs in case of firewall or proxy Linux • Openswan, a popular IPsec implementation • OpenVPN, the most used VPN over SSL solution All DirectAccess features are available in Linux but the configuration and the management of DirectAccess is more easy and intuitive
  37. 37. conclusion
  38. 38. As a IaaS customer, only trust yourself
  39. 39. conclusion • Use your own OS images • Externalise your IdM • Externalise your logs encrypted • Encrypt all your communications • Encrypt your volumes • Use memory encryption at run-time
  40. 40. Criticisms & improvements
  41. 41. Criticisms • “IaaS cloud provider use different solutions such as Openstack, Cloudstack, Amazon EC2 [...]” Amazon EC2 is a IaaS cloud provider itself, not a solution for IaaS provider. • “[...] it requires the cloud provider to allow customers to manage DNS servers to resolve the hostnames inside the virtual infrastructure.” Anyone can create and manage their own DNS servers and DNS zones, customer just needs the possibility to customize DNS reverses. • Some advises have a limited application (e.g. FireWire, USB, TPM) • No explanations of the choice of SELinux
  42. 42. Areas for Improvement • Differences between public and private cloud infrastructure • Isolation in public cloud • Generalisation to other UNIX systems
  43. 43. Questions ?