Mikhail Shcherbakov, a senior software developer at Positive Technologies, discusses the security model in the .NET Framework. He outlines how the .NET Framework uses application domains, code access security, and a transparency model to provide sandboxing of code through verification, permissions, and security attributes. The security architecture has evolved over time from .NET Framework 4 to address issues like partial trust applications and trusted chain attacks.

2. Security Model in .NET Framework
Mikhail Shcherbakov
senior software developer
Positive Technologies
.NEXT conference

3. About me
― Senior software developer at Positive Technologies
― Working on Application Inspector - source code analysis product
― Former team lead at Acronis and Luxoft

4. Knowledge in Practice
― Sandboxing is the base of security
 ASP.NET / IIS  Silverlight
 SQL CLR  XBAP
 ClickOnce  Sharepoint
― Development of extensible and security-sensitive applications
― Troubleshooting and knowledge about the internals

5. Knowledge in Practice
― Are there some security features in Paint.NET that restrict what a plugin can do
and what it can access?
― There are no security features. And no, there is no guarantee of safety…
― If there are no security features, then ... whenever Paint.NET was running, it
could look for interesting files and send them off to Russia.
“
“Plugins & Security?” topic, Paint.NET Forum
http://bit.ly/1ABI3sH
#send2Russia

6. Terms
C# 5.0 Language Specification http://bit.ly/1tXdOI2
Common Language Infrastructure (CLI) Standard ECMA-335 http://bit.ly/1IesnAK

7. .NET Framework 4 Security Architecture

8. .NET Framework 4 Security Architecture

9. .NET Framework 4 Security Architecture

10. .NET Framework 4 Security Architecture

11. Application Domains

12. The verification process

13. Just-in-time verification

14. Code Access Security

15. Policy

16. Policy
deprecated
in .NET
Framework 4

17. Permissions

18. Permissions

19. Enforcement

20. Fully Trusted code in Partially Trusted AppDomain

21. Transparency Model

22. Level 2 Security Transparency
Transparent
Only verifiable code Cannot p/invoke Cannot elevate/assert
Safe Critical
Full Trust code Provides access to Critical code
Critical
Full Trust code that can do anything

23. Security Transparency Attributes
Assembly
Level
Type Level Member
Level
SecurityTransparent   
SecuritySafeCritical   
SecurityCritical   
AllowPartiallyTrustedCallers   
SecAnnotate.exe – .NET Security Annotator Tool http://bit.ly/1A3vMw3

24. Stack walking

25. Sandbox implementation

26. ASP.NET Partial Trust applications
Use Medium trust
in shared hosting
environments
bit.ly/1yABGqf
August 2005
For Web servers that
are Internet-facing,
Medium trust is
recommended
bit.ly/1z83LVV
July 2008
ASP.NET Partial Trust
does not guarantee
application isolation
bit.ly/1CRv3Ux
June 2012
ASP.NET Security and the
Importance of KB2698981 in
Cloud Environments
bit.ly/1vXJ50J April 2013
2005 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014
October 2013
June 2013 ASP.NET MVC 5 no longer
“The official position of the ASP.NET team is that
Medium Trust is obsolete”
-Levi Broderick, security developer at Microsoft
bit.ly/1If14Gv
supports partial trust
bit.ly/1w0xxuX

27. Trusted Chain attack
― DynamicMethod class
― MS13-015 vulnerability
Could Allow Elevation of Privilege (KB2800277)

28. Trusted Chain attack
― DynamicMethod class
― MS13-015 vulnerability
Could Allow Elevation of Privilege (KB2800277)

29. Summary
http://goo.gl/A5QrZm

30. Summary
.NET Security:
― OWASP Top 10 for .NET developers bit.ly/1mpvG9R
― OWASP .NET Project bit.ly/1vCfknm
― Troy Hunt blog www.troyhunt.com
― The WASC Threat Classification v2.0 bit.ly/1G5d8rM
Sandboxing:
― Exploring the .NET Framework 4 Security Model bit.ly/1zBHDl7
― New Security Model: Moving to a Better Sandbox bit.ly/1qdLTYf
― How to Test for Luring Vulnerabilities bit.ly/1G5asdG
― Using SecAnnotate to Analyze Your Assemblies for Transparency Violations
bit.ly/12AtGZF

31. Thank you for your attention!
Mikhail Shcherbakov
Positive Technologies
linkedin.com/in/mikhailshcherbakov
yuske.dev@gmail.com
github.com/yuske
@yu5k3