Sidebar
3-8: There's More Than One Way to Crack a System
In the 1970s the primary security
assurance strategy was "penetration" or "tiger team"
testing. A team of computer security experts would be hired to test the
security of a system prior to its being pronounced ready to use. Often these
teams worked for months to plan their tests.
The U.S. Department of Defense was
testing the Multics system, which had been designed and built under extremely
high security quality standards. Multics was being studied as a base operating
system for the WWMCCS command and control system. The developers from M.I.T.
were justifiably proud of the strength of the security of their system, and the
sponsoring agency invoked the penetration team with a note of haughtiness. But
the developers underestimated the security testing team.
Led by Roger Schell and Paul Karger, the
team analyzed the code and performed their tests without finding major flaws.
Then one team member thought like an attacker. He wrote a slight modification
to the code to embed a trapdoor by which he could perform privileged operations
as an unprivileged user. He then made a tape of this modified system, wrote a
cover letter saying that a new release of the system was enclosed, and mailed
the tape and letter to the site where the system was installed.
When it
came time to demonstrate their work, the penetration team congratulated the
Multics developers on generally solid security, but said they had found this
one apparent failure, which the team member went on to show. The developers
were aghast because they knew they had scrutinized the affected code carefully.
Even when told the nature of the trapdoor that had been added, the developers
could not find it [KAR74, KAR02].
Related Topics
Privacy Policy, Terms and Conditions, DMCA Policy and Compliant
Copyright © 2018-2023 BrainKart.com; All Rights Reserved. Developed by Therithal info, Chennai.