University of Kent 2013 - CO899 System security Presentation of the article: Salah K, et al, Computers & Security (2012), http://dx.doi.org/10.1016/j.cose.2012.12.001

1. Original Article by Salah K, et al, Computers & Security (2012), http://dx.doi.org/10.1016/j.cose.2012.12.001
Analyzing the security of
Windows 7 and Linux for cloud computing
Vincent Giersch - vg66

2. Contents
•Authors
•Main points of the article
•Introduction to the cloud computing
•Infrastructure as a Service (IaaS)
•Authentication
•Authorization
•Network security
•Accounting
•Privacy and encryption
•Conclusion
•Criticism and improvements

3. Authors background
•Khaled Salah
Electrical and Computer Engineering Department,
Khalifa University of Science Technology and Research (United Arab
Emirates)
•Jose M. Alcaraz Calero
Department of Computer Science, Engineering Technical School,
University of Valencia (Spain)
•Jorge Bernal Bernabé and Juan M. Marín Perez
Cloud and Security Lab, HewlettePackard Laboratories, Stroke Gifford,
Bristol (UK)
•Sherali Zeadally
Department of Computer Science and Information Technology,
University of the District of Columbia, Washington (USA)

4. Introduction to
CLOUD COMPUTING

5. Virtual IT infrastructures
Pay as you go

7. IaaS

8. IaaS solutions

9. IaaS solutions HypervisorS

10. Physical resources for guest operating systems
Hypervisors
CPU RAM Disk Network

11. OS images configured by the cloud provider or the user
Cloud providers

12. OS images configured by the cloud provider or the user
Cloud providers

13. Customer perspective
•Usage a third-part infrastructure
•Full control by the cloud provider
•Customer want to keep his security and privacy

14. This article analyseS
Fedora Core 15
with a 2.6.38 kernel
Windows 7 Ultimate Edition

15. Authentication

16. Verify that a user is really who he claims to be.

17. Windows Authentication Architecture
Windows Authentication
(Local Security Authority)
Win Logon
MSV1_0
Kerberos
CredSSP
NTLM
DigestSSP
Interactive authentication
Main component which use AP and SSP
• Authentication Packages (AP) :
• DLL which encapsulate authentication logic
• Perform the logon in the OS
• Security Support Providers (SSP) :
• DLL which implement the SSPI
• SSPI also provides non-interactive authentication

18. Linux Authentication Architecture
Linux Authentication
Login
pam_unix
pam_guest
pam_kbr5
pam_radius
Login processus (/bin/login) interacts with the libpam
(Pluggable Authentication Modules).
All the modules implements the PAM abstraction layer
and are build and load as dynamic libraries.

19. cloud providers OS Images
• Usually cloud providers modify OS image to configure the
authentication (e.g. add SSH keys)
• High security threat: the provider has access to the content of the VM
• No possibility of encryption: adding keys would be impossible

20. Usage of an IDM
• Windows and Linux provide authentication abstraction mechanisms
• Utilisation of an Identity Management System (IdM)
• Separation of the authentication from the image file system
• Should be managed by the tenant organization
• Example: Kerberos, OpenID, SAML
• Problem: a fake IdM could be use if an attacker has access to file
system or RAM

21. Authorization

22. Authorization: access control
• Manages privileges granted for an authenticated user
• Checks ands enforce these privileges when user perform actions over
securable objects.

23. access control on Windows 7
Different access control subsystems executed simultaneously at runtime
First access control:
• Controls all resources managed in the OS
e.g. a file, directory, process, registry key, windows service, printer, etc.
• Each securable object has a security descriptor
• This descriptor manage 2 ACL:
• Discretionary Access Control List (DACL)
• System Access Control List (SACL)

24. access control on Windows 7
Second access control, Mandatory Integrity Control (MAC):
• Controls the access to securable objects
• Addition to the discretionary access control (DAC)
• Each user / securable object has a security level
low, medium, high, system
• To access to an object: user need a higher security level than required
• Otherwise access is denied even it is authorized by another AC system

25. access control on Windows 7
Third access control, AppLocker:
• Controls the execution of the processes
• A Windows Service (Application Identity service) intercepts the execution
• This service checks if the user has required right to execute the application
• AppLocker policy uses application attributes
Signed certificate, vendor name, application name and version
• Advantage: The policy persists after application updates
• Can be manually configured or using the Group Policy Management

26. access control on LINUX
Linux provides different access control mechanisms
First access control:
• Secure every object in the file system
Regular file, directory, device and process
• Associated with an access right mask and a user and a group
• User and group that execute a process are used to check rights while
accessing to secured
• When a user execute a process, it stores this user and group, there are
used when the process access to secure objects
• 3 permissions: read, write, execute with 3 levels: user, group, other.

27. access control on LINUX
In modern distributions, this authorization model is extended with an ACL:

28. access control on LINUX
Recent Linux distributions have additional access control mechanism,
Mandatory Access Control (MAC).
There are multiple implementation of this MAC:
• AppArmor
• TOMOYO
• SELinux
• GRSecurity
After comparing these implementation, the authors chose SELinux.

29. Authorization
• Windows and Linux authorization mechanisms store AC information
inside the securable file objects
• The system need at least one admin user, it usually true in case of IaaS
• Problem: file that belongs to users who are not registered in the OS, for
example an external IdM
• This is an approach followed by AppLocker, which protects agains
external intruders and cloud provider from executing undesired code in
the guest OS.

30. Network security

31. Network security
• All network can potentially be monitored
Man-in-the-middle, or by the cloud provider (hypervisors, routing equipments, etc.)
• Usually the possibility of network configuration are limited
Hard to reproduce a particular networking topology or configuration
• IPs addresses provided by the cloud provider
Already used before ? How ? Blocked by some firewalls ?
• MAC addresses uses in firewalls: virtualized adapters
MAC addresses are managed by the cloud provider and change when using IaaS features
• Create policies based on hostnames instead of IP addresses
Windows: Still not possible with Windows firewall (possible using Zone-Alarm)
Linux: Possible with Netfilter and IPTables
• New issue: DNS poisoning and spoofing
DNSSec can be used to validate and trust DNS responses

32. Accounting

33. Accounting
• Logs are usually stored unencrypted in local file system
• Can be accessed by the attacker and potentially modified
• Could be destroyed when using snapshots, images, etc.
• Logs must be stored in a separated logging system
• These logs should be ciphered by the source OS if this logging system is
provided by the cloud provider
• So we have similar problems than the provisioning of user credentials:
the initial configuration and provisioning of the VM

34. Privacy and encryption

35. Privacy of ram memory
Could be protected by different methods:
• Address Space Layout Randomization (ASLR)
• Used in Linux 2.6.38 and Windows 7
• Loads critical application execution code into random memory location every time the system boot
• Randomizes locations of the stack, heap, Process Environment Block and Thread Environment Block
• Hard to extract sensible information from a dump of the memory
• Disabling FireWire port
This kind of port enables direct access without security restrictions to the memory
Potential vulnerability highlighted:
“Recently, all tools using AES-based encryption are being rapidly cracked by mean of the extraction of the
AES keys when memory dumps are available.”
→ Use memory encryption at run-time
For example on Linux, METAL (Memory Encryption and Transparent Aegis Library)

36. Disk encryptiON
• Windows: BitLocker
Supports only the Cipher Block Chaining (CBC) using IV derived from the sector number
• Linux 2.6.38: dm-crypt / LUKS
dm-crypt supports IEEE P1619 standards, for example XTS-AES
• Encrypt the complete disk, all partitions and hibernate files
• Place a bootable software in the MBR which request the decryption key
• Two-factor authentication by USB or TPM (Trusted Platform Module)
• Based on AES symmetric encryption
Still vulnerable on runtime:
The file system decryption key is located at some point of the memory.

37. Network encryptiON
Windows 7
• DirectAccess, an easy and secure way of establishing VPNs
Automatic bi-directional connection using IPv6 and IPsec
Able to encapsulate IPv6 traffic into IPv4 with 6to4 or Teredo
Able to use IP over HTTPs in case of firewall or proxy
Linux
• Openswan, a popular IPsec implementation
• OpenVPN, the most used VPN over SSL solution
All DirectAccess features are available in Linux but the configuration
and the management of DirectAccess is more easy and intuitive

38. conclusion

39. As a IaaS customer, only trust yourself

40. conclusion
• Use your own OS images
• Externalise your IdM
• Externalise your logs encrypted
• Encrypt all your communications
• Encrypt your volumes
• Use memory encryption at run-time

41. Criticisms & improvements

42. Criticisms
• “IaaS cloud provider use different solutions such as Openstack, Cloudstack,
Amazon EC2 [...]”
Amazon EC2 is a IaaS cloud provider itself, not a solution for IaaS provider.
• “[...] it requires the cloud provider to allow customers to manage DNS servers
to resolve the hostnames inside the virtual infrastructure.”
Anyone can create and manage their own DNS servers and DNS zones,
customer just needs the possibility to customize DNS reverses.
• Some advises have a limited application (e.g. FireWire, USB, TPM)
• No explanations of the choice of SELinux

43. Areas for Improvement
• Differences between public and private cloud infrastructure
• Isolation in public cloud
• Generalisation to other UNIX systems

44. Questions ?