Publications

Refine Results

(Filters Applied) Clear All

Exploiting temporal vulnerabilities for unauthorized access in intent-based networking

October 14, 2024
  |
Conference Paper
Author:
Benjamin Loren Weintraub
…
Published in:
ACM Conf. on Computer and Communications Security, CCS '24, 14-18 October 2024.
Topic:
cyber security
R&D area:
R&D group:

Summary

Intent-based networking (IBN) enables network administrators to express high-level goals and network policies without needing to specify low-level forwarding configurations, topologies, or protocols. Administrators can define intents that capture the overall behavior they want from the network, and an IBN controller compiles such intents into low-level configurations that get installed in the network and implement the desired behavior. We discovered that current IBN specifications and implementations do not specify that flow rule installation orderings should be enforced, which leads to temporal vulnerabilities where, for a limited time, attackers can exploit indeterminate connectivity behavior to gain unauthorized network access. In this paper, we analyze the causes of such temporal vulnerabilities and their security impacts with a representative case study via the ONOS IBN implementation.We devise the Phantom Link attack and demonstrate a working exploit to highlight the security impacts. To defend against such attacks, we propose Spotlight, a detection method that can alert a system administrator of risky intent updates prone to exploitable temporal vulnerabilities. Spotlight is effective in identifying risky updates using realistic network topologies and policies. We show that Spotlight can detect risky updates in a mean time of 0.65 seconds for topologies of over 1,300 nodes.
READ LESS

Summary

Intent-based networking (IBN) enables network administrators to express high-level goals and network policies without needing to specify low-level forwarding configurations, topologies, or protocols. Administrators can define intents that capture the overall behavior they want from the network, and an IBN controller compiles such intents into low-level configurations that get installed...

READ MORE
Exploiting temporal vulnerabilities for unauthorized access in intent-based networking

Security challenges of intent-based networking

July 1, 2024
  |
Journal Article
Author:
Jiwon Kim
…
Published in:
Communications of the ACM, Vol. 67, No. 7, July 2024, pp. 56-65.
Topic:
networking
R&D area:
R&D group:

Summary

Intent-based networking (IBN) offers advantages and opportunities compared with SDN, but IBN also poses new and unique security challenges that must be overcome.
READ LESS

Summary

Intent-based networking (IBN) offers advantages and opportunities compared with SDN, but IBN also poses new and unique security challenges that must be overcome.

READ MORE
Security challenges of intent-based networking

Holding the high ground: Defending satellites from cyber attack

March 31, 2023
  |
Journal Article
Author:
Richard W. Skowyra
…
Published in:
The Cyber Edge by Signal, 31 March 2023.
Topic:
cyber security
R&D area:
R&D group:

Summary

MIT Lincoln Laboratory and the Space Cyber-Resiliency group at Air Force Research Laboratory-Space Vehicles Directorate have prototyped a practical, operationally capable and secure-by-design spaceflight software platform called Cyber-Hardened Satellite Software (CHSS) for building space mission applications with security, recoverability and performance as first-class system design priorities. Following a successful evaluation of CHSS against an existing U.S. Space Force (USSF) mission, the CHSS platform is currently being extended to support hybrid space vehicle architectures that incorporate both CHSS-aware and legacy subsystems. CHSS has the potential to revolutionize the cyber-resiliency of space systems and substantially ease the burden of defensive cyber operations (DCO).
READ LESS

Summary

MIT Lincoln Laboratory and the Space Cyber-Resiliency group at Air Force Research Laboratory-Space Vehicles Directorate have prototyped a practical, operationally capable and secure-by-design spaceflight software platform called Cyber-Hardened Satellite Software (CHSS) for building space mission applications with security, recoverability and performance as first-class system design priorities. Following a successful evaluation...

READ MORE
Holding the high ground: Defending satellites from cyber attack

Automated exposure notification for COVID-19

February 14, 2023
  |
Technical Report
Author:
Ronald L. Rivest
…
Published in:
MIT Lincoln Laboratory Report TR-1288
Topic:
health
R&D area:
R&D group:

Summary

Private Automated Contact Tracing (PACT) was a collaborative team and effort formed during the beginning of the Coronavirus Disease 2019 (COVID-19) pandemic. PACT's mission was to enhance contact tracing in pandemic response by designing exposure-detection functions in personal digital communication devices that have maximal public health utility while preserving privacy. This report explains and discusses the use of automated exposure notification during the COVID-19 pandemic and to provide some recommendations for those who may try to design and deploy similar technologies in future pandemics.
READ LESS

Summary

Private Automated Contact Tracing (PACT) was a collaborative team and effort formed during the beginning of the Coronavirus Disease 2019 (COVID-19) pandemic. PACT's mission was to enhance contact tracing in pandemic response by designing exposure-detection functions in personal digital communication devices that have maximal public health utility while preserving privacy...

READ MORE
Automated exposure notification for COVID-19

Mission resilience experimentation and evaluation testbed

November 28, 2022
  |
Conference Paper
Author:
Bich T. Vu
…
Published in:
IEEE Military Communications Conf., MILCOM, 28 November - 2 December 2022.
Topic:
resilient systems
R&D area:
R&D group:

Summary

As the complexity of DoD systems increases exponentially, the DoD continues to struggle with understanding and improving the resilience of its mission software. The Applied Resilience for Mission Systems (ARMS) Testbed is an environment that enables resilience improvement by experimentation and assessment of different mission system architectures and approaches. This Testbed consists of components for deploying mission system software for testing, capturing system performance, generating traffic, introducing disruptions into the mission system, orchestrating controlled experiments, and assessing and comparing the performance of mission systems. This paper covers the implementation of this Testbed, analysis for mission resilience comparisons, and their application to an operational terrestrial network architecture. Additionally, we introduce the Distance to Failure metric for comparing the resilience of arbitrary mission systems variations.
READ LESS

Summary

As the complexity of DoD systems increases exponentially, the DoD continues to struggle with understanding and improving the resilience of its mission software. The Applied Resilience for Mission Systems (ARMS) Testbed is an environment that enables resilience improvement by experimentation and assessment of different mission system architectures and approaches. This...

READ MORE
Mission resilience experimentation and evaluation testbed

On randomization in MTD systems

November 7, 2022
  |
Conference Paper
Author:
null
…
Published in:
Proc. of the 9th ACM Workshop on Moving Target Defense, MTD ’22, 7 November 2022.
Topic:
quantum systems and science
R&D area:
R&D group:

Summary

Randomization is one of the main strategies in providing security in moving-target-defense (MTD) systems. However, randomization has an associated cost and estimating this cost and its impact on the overall system is crucial to ensure adoption of the MTD strategy. In this paper we discuss our experience in attempting to estimate the cost of path randomization in a message transmission system that used randomization of paths in the network. Our conclusions are (i) the cost crucially depends on the underlying network control technology, (ii) one can reduce this cost by better implementation, and (iii) reducing one type of cost may result in increased costs of a different type, for example a higher device cost. These suggest that estimating the cost of randomization is a multivariable optimization problem that requires a full understanding of the system components.
READ LESS

Summary

Randomization is one of the main strategies in providing security in moving-target-defense (MTD) systems. However, randomization has an associated cost and estimating this cost and its impact on the overall system is crucial to ensure adoption of the MTD strategy. In this paper we discuss our experience in attempting to...

READ MORE
On randomization in MTD systems

The tale of discovering a side channel in secure message transmission systems

August 13, 2022
  |
Conference Paper
Author:
null
…
Published in:
The Conf. for Failed Approaches and Insightful Losses in Cryptology, CFAIL, 13 August 2022.
Topic:
cryptography
R&D area:
R&D group:

Summary

Secure message transmission (SMT) systems provide information theoretic security for point-to-point message transmission in networks that are partially controlled by an adversary. This is the story of a research project that aimed to implement a flavour of SMT protocols that uses "path hopping" with the goal of quantifying the real-life efficiency of the system, and while failing to achieve this initial goal, let to the discovery a side-channel that affects the security of a wide range of SMT implementations.
READ LESS

Summary

Secure message transmission (SMT) systems provide information theoretic security for point-to-point message transmission in networks that are partially controlled by an adversary. This is the story of a research project that aimed to implement a flavour of SMT protocols that uses "path hopping" with the goal of quantifying the real-life...

READ MORE
The tale of discovering a side channel in secure message transmission systems

The thundering herd: Amplifying kernel interference to attack response times

May 4, 2022
  |
Conference Paper
Author:
Samuel A. Mergendahl
…
Published in:
2022 IEEE 28th Real-Time and Embedded Technology and Applications Symp., RTAS, 4-6 May 2022.
Topic:
embedded computing
R&D area:
R&D group:

Summary

Embedded and real-time systems are increasingly attached to networks. This enables broader coordination beyond the physical system, but also opens the system to attacks. The increasingly complex workloads of these systems include software of varying assurance levels, including that which might be susceptible to compromise by remote attackers. To limit the impact of compromise, u-kernels focus on maintaining strong memory protection domains between different bodies of software, including system services. They enable limited coordination between processes through Inter-Process Communication (IPC). Real-time systems also require strong temporal guarantees for tasks, and thus need temporal isolation to limit the impact of malicious software. This is challenging as multiple client threads that use IPC to request service from a shared server will impact each other's response times. To constrain the temporal interference between threads, modern u-kernels often build priority and budget awareness into the system. Unfortunately, this paper demonstrates that this is more challenging than previously thought. Adding priority awareness to IPC processing can lead to significant interference due to the kernel's prioritization logic. Adding budget awareness similarly creates opportunities for interference due to the budget tracking and management operations. In both situations, a Thundering Herd of malicious threads can significantly delay the activation of mission-critical tasks. The Thundering Herd effects are evaluated on seL4 and results demonstrate that high-priority threads can be delayed by over 100,000 cycles per malicious thread. This paper reveals a challenging dilemma: the temporal protections u-kernels add can, themselves, provide means of threatening temporal isolation. Finally, to defend the system, we identify and empirically evaluate possible mitigations, and propose an admission-control test based upon an interference-aware analysis.
READ LESS

Summary

Embedded and real-time systems are increasingly attached to networks. This enables broader coordination beyond the physical system, but also opens the system to attacks. The increasingly complex workloads of these systems include software of varying assurance levels, including that which might be susceptible to compromise by remote attackers. To limit...

READ MORE
The thundering herd: Amplifying kernel interference to attack response times

Cross-language attacks

April 22, 2022
  |
Conference Paper
Author:
Samuel A. Mergendahl
…
Published in:
Network and Distributed System Security (NDSS) Symposium 2022.
Topic:
cyber security
R&D area:
R&D group:

Summary

Memory corruption attacks against unsafe programming languages like C/C++ have been a major threat to computer systems for multiple decades. Various sanitizers and runtime exploit mitigation techniques have been shown to only provide partial protection at best. Recently developed ‘safe’ programming languages such as Rust and Go hold the promise to change this paradigm by preventing memory corruption bugs using a strong type system and proper compile-time and runtime checks. Gradual deployment of these languages has been touted as a way of improving the security of existing applications before entire applications can be developed in safe languages. This is notable in popular applications such as Firefox and Tor. In this paper, we systematically analyze the security of multi-language applications. We show that because language safety checks in safe languages and exploit mitigation techniques applied to unsafe languages (e.g., Control-Flow Integrity) break different stages of an exploit to prevent control hijacking attacks, an attacker can carefully maneuver between the languages to mount a successful attack. In essence, we illustrate that the incompatible set of assumptions made in various languages enables attacks that are not possible in each language alone. We study different variants of these attacks and analyze Firefox to illustrate the feasibility and extent of this problem. Our findings show that gradual deployment of safe programming languages, if not done with extreme care, can indeed be detrimental to security.
READ LESS

Summary

Memory corruption attacks against unsafe programming languages like C/C++ have been a major threat to computer systems for multiple decades. Various sanitizers and runtime exploit mitigation techniques have been shown to only provide partial protection at best. Recently developed ‘safe’ programming languages such as Rust and Go hold the promise...

READ MORE
Cross-language attacks

Preventing Kernel Hacks with HAKCs

April 22, 2022
  |
Conference Paper
Author:
Derrick McKee
…
Published in:
Network and Distributed System Security (NDSS) Symposium 2022.
Topic:
cyber security
R&D area:
R&D group:

Summary

Commodity operating system kernels remain monolithic for practical and historical reasons. All kernel code shares a single address space, executes with elevated processor privileges, and has largely unhindered access to all data, including data irrelevant to the completion of a specific task. Applying the principle of least privilege, which limits available resources only to those needed to perform a particular task, to compartmentalize the kernel would realize major security gains, similar to microkernels yet without the major redesign effort. Here, we introduce a compartmentalization design, called a Hardware-Assisted Kernel Compartmentalization (HAKC), that approximates least privilege separation, while minimizing both developer effort and performance overhead. HAKC divides code and data into separate partitions, and specifies an access policy for each partition. Data is owned by a single partition, and a partition’s access-control policy is enforced at runtime, preventing unauthorized data access. When a partition needs to transfer control flow to outside itself, data ownership is transferred to the target, and transferred back upon return. The HAKC design allows for isolating code and data from the rest of the kernel, without utilizing any additional Trusted Computing Base while compartmentalized code is executing. Instead, HAKC relies on hardware for enforcement. Loadable kernel modules (LKMs), which dynamically load kernel code and data providing specialized functionality, are the single largest part of the Linux source base. Unfortunately, their collective size and complexity makes LKMs the cause of the majority of CVEs issued for the Linux kernel. The combination of a large attack surface in kernel modules, and the monolithic design of the Linux kernel, make LKMs ideal candidates for compartmentalization. To demonstrate the effectiveness of our approach, we implement HAKC in Linux v5.10 using extensions to the Arm v8.5-A ISA, and compartmentalize the ipv6.ko LKM, which consists of over 55k LOC. The average overhead measured in Apachebench tests was just 1.6%–24%. Additionally, we compartmentalize the nf_tables.ko packet filtering LKM, and measure the combined impact of using both LKMs. We find a reasonable linear growth in overhead when both compartmentalized LKMs are used. Finally, we measure no significant difference in performance when using the compartmentalized ipv6.ko LKM over the unmodified LKM during real-world web browsing experiments on the Alexa Top 50 websites.
READ LESS

Summary

Commodity operating system kernels remain monolithic for practical and historical reasons. All kernel code shares a single address space, executes with elevated processor privileges, and has largely unhindered access to all data, including data irrelevant to the completion of a specific task. Applying the principle of least privilege, which limits...

READ MORE
Preventing Kernel Hacks with HAKCs
1-10 of 132