Man-in-the-Machine: Exploiting Ill-Secured Communication Inside the Computer

Research output: Chapter in Book/Report/Conference proceedingConference contributionScientificpeer-review

46 Downloads (Pure)


Operating systems provide various inter-process communication (IPC) mechanisms. Software applications typically use IPC for communication between front-end and back-end components, which run in different processes on the same computer. This paper studies the security of how the IPC mechanisms are used in PC, Mac and Linux software. We describe attacks where a nonprivileged process impersonates the IPC communication endpoints. The attacks are closely related to impersonation and man-in-the-middle attacks on computer networks but take place inside one computer. The vulnerable IPC methods are ones where a server process binds to a name or address and waits for client communication. Our results show that application developers are often unaware of the risks and secure practices in using IPC. We find attacks against several security-critical applications including password managers and hardware tokens, in which another user's process is able to steal and misuse sensitive data such as the victim's credentials. The vulnerabilities can be exploited in enterprise environments with centralized access control that gives multiple users remote or local login access to the same host. Computers with guest accounts and shared computers at home are similarly vulnerable.
Original languageEnglish
Title of host publicationProceedings of the 27th USENIX Security Symposium, August 15–17, 2018, Baltimore, MD, USA
Place of PublicationBaltimore, MD
Number of pages15
ISBN (Print)978-1-931971-46-1
Publication statusPublished - 2018
MoE publication typeA4 Article in a conference publication
EventUSENIX Security Symposium - Baltimore, United States
Duration: 15 Aug 201817 Aug 2018
Conference number: 27


ConferenceUSENIX Security Symposium
CountryUnited States

Fingerprint Dive into the research topics of 'Man-in-the-Machine: Exploiting Ill-Secured Communication Inside the Computer'. Together they form a unique fingerprint.

Cite this