Know Your Security Model
Download as PPTX, PDF0 likes697 views
This document discusses .NET Framework 4 security architecture, including application domains, code verification processes, code access security (CAS), role-based security concepts like authentication and authorization, and cryptography. It also covers security transparency attributes, demonstrates a MS13-015 vulnerability exploit, and provides contact information for the author.
Know Your Security Model
- 1. Know Your Security Model Mikhail Shcherbakov 9-Ρ ΠΊΠΎΠ½ΡΠ΅ΡΠ΅Π½ΡΠΈΡ .NET ΡΠ°Π·ΡΠ°Π±ΠΎΡΡΠΈΠΊΠΎΠ² 12 ΠΎΠΊΡΡΠ±ΡΡ 2014 dotnetconf.ru
- 2. 2 About me β’ Senior software developer at Positive Technologies β’ Working on Application Inspector - source code analyzer β’ Previous team lead at Acronis and Luxoft
- 3. 3 Terms C# 5.0 Language Specification Common Language Infrastructure (CLI) Standard ECMA-335
- 4. 4 .NET Framework 4 Security Architecture β’ Application Domains β’ The verification process β’ Code Access Security (CAS) o Policy o Permissions o Enforcement β’ Role-based security o Authentication o Authorization o Principal and Identity β’ Cryptography
- 5. 5 .NET Framework 4 Security Architecture β’ Application Domains β’ The verification process β’ Code Access Security (CAS) o Policy o Permissions o Enforcement β’ Role-based security o Authentication o Authorization o Principal and Identity β’ Cryptography
- 6. 6 Knowledge in Practice β’ CAS is the base of security β’ Development of extensible and security- sensitive applications β’ Troubleshooting and knowledge about the internals o ASP.NET / IIS o Silverlight o SQL CLR o XBAP o ClickOnce o Sharepoint
- 7. 7 Application Domains β’ Fully Trusted and Partially Trusted β’ Heterogeneous and Homogeneous β’ Sandboxing by AppDomain
- 8. 8 Type Safety β’ C# compilation β’ Just-in-time (JIT) compilation β’ Native Image Generator (Ngen.exe) β’ PEVerify tool
- 9. 9 Code Access Security β’ Policy (deprecated in .NET Framework 4) β’ Permissions β’ Enforcement o Fully Trusted assemblies in Partially Trusted AppDomain o Security Transparency Code o Assert permissions o SecurityPermission o RegistryPermission o ReflectionPermission o SocketPermission o FileIOPermission o WebPermission
- 10. 10 Level 2 Security Transparency Critical Full Trust code that can do anything Safe Critical Full Trust code Provides access to Critical code Transparent Only verifiable code Cannot p/invoke Cannot elevate/assert
- 11. 11 Security Transparency Attributes Assembly Level Type Level Member Level SecurityTransparent οΌ ο» ο» SecuritySafeCritical ο» οΌ οΌ SecurityCritical οΌ οΌ οΌ AllowPartiallyTrustedCallers οΌ ο» ο» SecAnnotate.exe - .NET Security Annotator Tool
- 12. 12 Demo MS13-015 vulnerability Could Allow Elevation of Privilege (KB2800277) Exploited by Trusted Chain attack
- 13. 13 Thank you for your attention! Mikhail Shcherbakov Positive Technologies linkedin.com/in/mikhailshcherbakov yuske.dev@gmail.com github.com/yuske