Man-in-the-Machine: Exploiting Ill-Secured Communication Inside the Computer

Research output: Chapter in Book/Report/Conference proceedingConference contributionScientificpeer-review

Researchers

Research units

  • University of Helsinki

Abstract

Operating systems provide various inter-process communication (IPC) mechanisms. Software applications typically use IPC for communication between front-end and back-end components, which run in different processes on the same computer. This paper studies the security of how the IPC mechanisms are used in PC, Mac and Linux software. We describe attacks where a nonprivileged process impersonates the IPC communication endpoints. The attacks are closely related to impersonation and man-in-the-middle attacks on computer networks but take place inside one computer. The vulnerable IPC methods are ones where a server process binds to a name or address and waits for client communication. Our results show that application developers are often unaware of the risks and secure practices in using IPC. We find attacks against several security-critical applications including password managers and hardware tokens, in which another user's process is able to steal and misuse sensitive data such as the victim's credentials. The vulnerabilities can be exploited in enterprise environments with centralized access control that gives multiple users remote or local login access to the same host. Computers with guest accounts and shared computers at home are similarly vulnerable.

Details

Original languageEnglish
Title of host publicationProceedings of the 27th USENIX Security Symposium, August 15–17, 2018, Baltimore, MD, USA
Publication statusPublished - 2018
MoE publication typeA4 Article in a conference publication
EventUSENIX Security Symposium - Baltimore, United States
Duration: 15 Aug 201817 Aug 2018
Conference number: 27

Conference

ConferenceUSENIX Security Symposium
CountryUnited States
CityBaltimore
Period15/08/201817/08/2018

Download statistics

No data available

ID: 30475857