Man-in-the-Machine: Exploiting Ill-Secured Communication Inside the Computer

Loading...
Thumbnail Image
Journal Title
Journal ISSN
Volume Title
Conference article in proceedings
Date
2018
Major/Subject
Mcode
Degree programme
Language
en
Pages
15
1511-1525
Series
Proceedings of the 27th USENIX Security Symposium, August 15–17, 2018, Baltimore, MD, USA
Abstract
Operating systems provide various inter-process communication (IPC) mechanisms. Software applications typically use IPC for communication between front-end and back-end components, which run in different processes on the same computer. This paper studies the security of how the IPC mechanisms are used in PC, Mac and Linux software. We describe attacks where a nonprivileged process impersonates the IPC communication endpoints. The attacks are closely related to impersonation and man-in-the-middle attacks on computer networks but take place inside one computer. The vulnerable IPC methods are ones where a server process binds to a name or address and waits for client communication. Our results show that application developers are often unaware of the risks and secure practices in using IPC. We find attacks against several security-critical applications including password managers and hardware tokens, in which another user's process is able to steal and misuse sensitive data such as the victim's credentials. The vulnerabilities can be exploited in enterprise environments with centralized access control that gives multiple users remote or local login access to the same host. Computers with guest accounts and shared computers at home are similarly vulnerable.
Description
Keywords
Other note
Citation
Bui , T , Rao , S P , Antikainen , M , Bojan , V M & Aura , T 2018 , Man-in-the-Machine: Exploiting Ill-Secured Communication Inside the Computer . in Proceedings of the 27th USENIX Security Symposium, August 15–17, 2018, Baltimore, MD, USA . USENIX -The Advanced Computing Systems Association , Baltimore, MD , pp. 1511-1525 , USENIX Security Symposium , Baltimore , Maryland , United States , 15/08/2018 . < https://www.usenix.org/conference/usenixsecurity18/presentation/bui >