Preventing race condition attacks on file-systems

Abstract

Race condition attacks occur when a process performs a sequence of operations on a file, under the assu.m,ption that the operations are being executed "ato~mically". This can be exploited by a malicious process which changes the characteristics of that file between two successive operations on i t by a victi,m process, thus, inducing the victi,m process to operate on a ,modified or diflerent file. I n this paper we present a practical approach t o detect and prevent such race condition attacks. We ,monitor file operations and enforce policies which prevent the exploitation of the temporal window between any consecutive file operations by a process. Our approach does not rely on knowledge of previously known attacks. I n addition, our experiments on Linux de,monstrated that attacks can be detected with false alarms of less than 3% with performance overheads less than 8% of the processes execution tisme.

Intrusion Detection and Prevention in High Speed Network

“…Tan and Weinsberg attempt to improve string-matching algorithms for intrusion detection and prevention on large-scale high-speed network traffic; Drinic (Drinic & Kirovski, 2004) and Weaver (Weaver et al, 2007) present the hardware implementation of IPS based on field programmable gate arrays; Green uses a generic and reliable model to anticipate future attack scenarios; Uppuluri provides a practical approach to detect and prevent race condition attacks (Uppuluri et al, 2005). What's more, there are many commercial IPS products available such as TippingPoint IPS, ISS IPS, Cisco IPS and NetKeeper IPS, and these representative products are online, network-based solution, designed to accurately identify, classify, and stop malicious traffic, including worms, spyware/adware, network viruses, and application abuse.…”

Exploiting Unix File-System Races via Algorithmic Complexity Attacks

“…Researchers have proposed several kernel-base dynamic race detection schemes [28], [17], [8], [29], [15], [20], but all the proposals are based on a similar idea. Each proposal modifies the kernel to maintain a table, T , of the form (pid, dirID, f name, status), which indicates that the last system call made by process pid that referenced entry f name inside the directory identified by dirID yielded a file with the given status.…”

“…Dynamic race condition detectors come in two basic varieties: preventers [8], [28], [29] and detectors [1], [14], [16], [17], [32]. As argued in Section 3, run-time prevention of race-condition attacks must always face a state management problem.…”

“…Time-Of-Check-To-Time-Of-Use (TOCTTOU) filesystem race-conditions have been a recurring problem in Unix operating systems since the 80s, and researchers have proposed numerous solutions, including static detectors [3], [30], [5], [7], dynamic detectors [28], [17], [8], [29], [15], [20], extensions to the Unix file-system interface [10], [33], and probabilistic user-space defenses [10], [26]. This paper presents attacks on two proposed filesystem race-condition defense mechanisms.…”

Software Security – The Dangers of Abstraction

“…For more information on race conditions, on methods for scanning code for such vulnerabilities, and on possible countermeasures, see e.g. [4,14,3,16]. Finally, note that in Java it is the programmer's task to deal with race conditions by suitable synchronization of concurrent accesses.…”