We present a method to secure the complete path between a server and the local human user at a network node. This is useful for scenarios like internet banking, electronic signatures, or online voting. Protection of input authenticity and output integrity and authenticity is accomplished by a combination of traditional and novel technologies, e.g., SSL, ActiveX, and DirectX. Our approach does not require administrative privileges to deploy and is hence suitable for consumer applications. Results are based on the implementation of a proof-of-concept application for the Windows platform.
In the Microsoft Windows operating system, applications typically receive information about user actions by messages. Since these can be sent by malicious programs as well, they are a convenient attack vector. It is a vulnerability by design -- Windows treats all processes equally that run on the same desktop. If one needs an undisturbed interface, a separate attached to the interactive should be assigned. That approach is pursued by @cite_5 . However, managing separate desktops can be cumbersome for software developers. So most of today's software that interacts with a local user runs in a single desktop shared by benign and malign programs.
@cite_5
2107252100 2606561165 2095519872 2144219822
Malware such as Trojan horses and spyware remain to be persistent security threats that exploit the overly complex graphical user interfaces of today's commodity operating systems. In this paper, we present the design and implementation of Nitpicker - an extremely minimized secure graphical user interface that addresses these problems while retaining compatibility to legacy operating systems. We describe our approach of kernelizing the window server and present the deployed security mechanisms and protocols. Our implementation comprises only 1,500 lines of code while supporting commodity software such as X11 applications alongside protected graphical security applications. We discuss key techniques such as client-side window handling, a new floating-labels mechanism, drag-and-drop, and denial-of-service-preventing resource management. Furthermore, we present an application scenario to evaluate the feasibility, performance, and usability of our approach A user’s interaction with a computer operating system is most commonly reflected in the use of “desktop” application programs. In this paper we investigate the prospect of building plans that link together the services provided by such applications using an inter-process communication language called DCOP (Desktop COmmunication Protocol). Such services can be used to manipulate or query desktop applications, often in a manner similar to the standard user interfaces of those applications, while offering the possibility of a practical interface that a planning agent can utilize in a real software setting. Using the knowledge-level conditional planner PKS, we show how we can construct plans for controlling a set of existing desktop applications in the open source K Desktop Environment (KDE), and illustrate our approach with a series of fully executable examples that include application control and information gathering, under conditions of incomplete information and sensing. The ability to introspect into the behavior of software at runtime is crucial for many security-related tasks, such as virtual machine-based intrusion detection and low-artifact malware analysis. Although some progress has been made in this task by automatically creating programs that can passively retrieve kernel-level information, two key challenges remain. First, it is currently difficult to extract useful information from user-level applications, such as web browsers. Second, discovering points within the OS and applications to hook for active monitoring is still an entirely manual process. In this paper we propose a set of techniques to mine the memory accesses made by an operating system and its applications to locate useful places to deploy active monitoring, which we call tap points. We demonstrate the efficacy of our techniques by finding tap points for useful introspection tasks such as finding SSL keys and monitoring web browser activity on five different operating systems (Windows 7, Linux, FreeBSD, Minix and Haiku) and two processor architectures (ARM and x86). We describe a new side-channel attack. By tracking changes in the application's memory footprint, a concurrent process belonging to a different user can learn its secrets. Using Web browsers as the target, we show how an unprivileged, local attack process - for example, a malicious Android app - can infer which page the user is browsing, as well as finer-grained information: whether she is a paid customer, her interests, etc. This attack is an instance of a broader problem. Many isolation mechanisms in modern systems reveal accounting information about program execution, such as memory usage and CPU scheduling statistics. If temporal changes in this public information are correlated with the program's secrets, they can lead to a privacy breach. To illustrate the pervasiveness of this problem, we show how to exploit scheduling statistics for keystroke sniffing in Linux and Android, and how to combine scheduling statistics with the dynamics of memory usage for more accurate adversarial inference of browsing behavior.