;login AUGUST 2013 VOL. 38, NO. 4 : Security & Uncovering Zero-Days Leyla Bilge and Tudor Dumitras & Software Liability, a Lawyer’s Perspective Michael B. Scher & Setting Up Enterprise Logging David Lang & Rethinking Passwords Abe Singer and Warren Anderson & Causal Consistency Wyatt Lloyd, Michael Kaminsky, David G. Andersen, and Michael Freedman Columns Practical Perl Tools: Working with Git David N. Blank-Edelman Python: Shrinking Dictionary Size David Beazley iVoyeur: Watch Files with inotify Dave Josephsen For Good Measure: Security Debt Dan Geer and Chris Wysopal /dev/random: Loadable Cranium Modules Robert Ferrell Conference Reports NSDI ’13: 10th USENIX Symposium on Networked Systems Design and Implementation UPCOMING EVENTS FOR A COMPLETE LIST OF USENIX AND USENIX CO-SPONSORED EVENTS, SEE WWW.USENIX.ORG/CONFERENCES USENIX Security ’13: 22nd USENIX Security FAST ’14: 12th USENIX Conference on File and Symposium Storage Technologies August 14–16, 2013, Washington, D.C., USA February 17–20, 2014, Santa Clara, CA, USA www.usenix.org/conference/usenixsecurity13 www.usenix.org/conference/fast14 Submissions due: September 26, 2013 Workshops Co-located with USENIX Security ’13 2014 USENIX Research in Linux File and Storage EVT/WOTE ’13: 2013 Electronic Voting Technology Technologies Summit Workshop/Workshop on Trustworthy Elections CO-LOCATED WITH FAST ’14 August 12–13, 2013 February 17, 2014, Santa Clara, CA, USA www.usenix.org/conference/evtwote13 USENIX Journal of Election Technology NSDI ’14: 11th USENIX Symposium on Network and Systems (JETS) Systems Design and Implementation Published in conjunction with EVT/WOTE April 2–4, 2014, Seattle, WA, USA www.usenix.org/jets www.usenix.org/conference/nsdi14 CSET ’13: 6th Workshop on Cyber Security Abstracts due: September 20, 2013 Experimentation and Test August 12, 2013 2014 USENIX Federated Conferences Week www.usenix.org/conference/cset13 June 17–20, 2014, Philadelphia, PA, USA HealthTech ’13: 2013 USENIX Workshop on Health USENIX ATC ’14: 2014 USENIX Annual Technical Information Technologies Conference Safety, Security, Privacy, and Interoperability of HotCloud ’14: 6th USENIX Workshop on Health Information Technologies Hot Topics in Cloud Computing August 12, 2013 www.usenix.org/conference/healthtech13 WiAC ’14: 2014 USENIX Women in Advanced Computing Summit LEET ’13: 6th USENIX Workshop on Large-Scale Exploits and Emergent Threats HotStorage ’14: 6th USENIX Workshop August 12, 2013 on Hot Topics in Storage and File Systems www.usenix.org/conference/leet13 UCMS ’14: 2014 USENIX Configuration FOCI ’13: 3rd USENIX Workshop on Free and Open Management Summit Communications on the Internet August 13, 2013 USENIX Security ’14: 23rd USENIX Security www.usenix.org/conference/foci13 Symposium August 20–22, 2014, San Diego, CA, USA HotSec ’13: 2013 USENIX Summit on Hot Topics in Security OSDI ’14: 11th USENIX Symposium on Operating August 13, 2013 Systems Design and Implementation www.usenix.org/conference/hotsec13 October 6–8, 2014, Broomfield, CO, USA WOOT ’13: 7th USENIX Workshop on Diversity ’14: 2014 Workshop on Diversity in Offensive Technologies Systems Research August 13, 2013 CO-LOCATED WITH OSDI ’14 www.usenix.org/conference/woot13 October 4, 2014, Broomfield, CO, USA LISA ’13: 27th Large Installation System LISA ’14: 28th Large Installation System Administration Conference Administration Conference November 3–8, 2013, Washington, D.C., USA November 9–14, 2014, Seattle, WA, USA www.usenix.org/conference/lisa13 SESA ’13: 2013 USENIX Summit for Educators in System Administration CO-LOCATED WITH LISA ’13 November 5, 2013, Washington, D.C., USA www.usenix.org/conference/sesa13 twitter.com/usenix www.usenix.org/youtube www.usenix.org/gplus Stay Connected... www.usenix.org/facebook www.usenix.org/linkedin www.usenix.org/blog AUGUST 2013 VOL. 38, NO. 4 EDITOR Rik Farrow [email protected] EDITORIAL MANAGING EDITOR Rikki Endsley 2 Musings Rik Farrow [email protected] COPY EDITOR SECURITY Steve Gilmartin 6 Investigating Zero-Day Attacks [email protected] Leyla Bilge and Tudor Dumitras PRODUCTION Arnold Gatilao 14 Rethinking Password Policies Casey Henderson Abe Singer and Warren Anderson Michele Nelson TYPESETTER 20 Bill Cheswick on Firewalls: An Interview Star Type Rik Farrow [email protected] 26 Setting the Stage for a Software Liability Discussion USENIX ASSOCIATION Michael B. Scher 2560 Ninth Street, Suite 215, Berkeley, California 94710 Phone: (510) 528-8649 SYSADMIN FAX: (510) 548-5738 30 Enterprise Logging www.usenix.org David Lang ;login: is the official magazine of the USENIX Association. ;login: (ISSN 1044-6397) is published bi-monthly by the USENIX PROGRAMMING Association, 2560 Ninth Street, Suite 215, 36 Cuckoo Filter: Better Than Bloom Berkeley, CA 94710. Bin Fan, David G. Andersen, and Michael Kaminsky $90 of each member’s annual dues is for a subscription to ;login:. Subscriptions for non- members are $90 per year. Periodicals postage SYSTEMS paid at Berkeley, CA, and additional offices. 41 A Short Primer on Causal Consistency POSTMASTER: Send address changes to Wyatt Lloyd, Michael J. Freedman, Michael Kaminsky, ;login:, USENIX Association, 2560 Ninth Street, and David G. Andersen Suite 215, Berkeley, CA 94710. 44 Arrakis: The Operating System as Control Plane ©2013 USENIX Association Simon Peter and Thomas Anderson USENIX is a registered trademark of the USENIX Association. Many of the designations used by manufacturers and sellers to COLUMNS distinguish their products are claimed as trademarks. USENIX acknowledges all 48 Practical Perl Tools David N. Blank-Edelman trademarks herein. Where those designations appear in this publication and USENIX is aware 52 Building a Better Dictionary David Beazley of a trademark claim, the designations have 58 iVoyeur Dave Josephsen been printed in caps or initial caps. 62 For Good Measure Dan Geer and Chris Wysopal 65 /dev/random Robert G. Ferrell BOOKS 67 Book Reviews Elizabeth Zwicky, Mark Lamourine, and Rik Farrow CONFERENCE REPORTS 71 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’13) Musings RIK FARROWEDITORIAL Rik is the editor of ;login:. here are dark clouds on the horizon, and an ominous deep rumble [email protected] shaking the windows. What we have carefully ignored for so many Tyears may soon be destroying all we hold dear. Of course, I am not writing about the weather… On May 27, a US Department of Defense committee reported [1]: …that the cyber threat is serious and that the United States cannot be confident that our critical Information Technology (IT) systems will work under attack from a sophisticated and well-resourced opponent utilizing cyber capabilities in combination with all of their military and intelligence capabilities (a “full spectrum” adversary). Most news reports focused on the loss of technology to the Chinese [2], but this was not the top finding of this committee. Their point was that US defense capabilities rely on networks of systems, and these systems are not, and cannot easily be, made secure. Security Debt In this issue, Dan Geer and Chris Wysopal write about security debt. Their concept is that all software has flaws when released, and as software is patched and upgraded over time, the number of flaws tends to grow. These flaws can be thought of as a debt that needs to be repaid over time, as the software matures. Security debt refers specifically to those flaws that will be exploited maliciously. If you look at the graphs in Figure 2 on page 63, you can see that five of the most popular applica- tions have security debt that is building over time, with the sum of these debts appearing to approach exponential growth. Bilge and Dumitras, using a database of binary signatures collected from millions of Windows systems, show that beyond the visible debt of disclosed vulnerabilities, there is also the undisclosed threat of zero-days. Zero-days are vulnerabilities that are actively being exploited but have not been announced, and the average amount of time that zero- days were exploited as reported in this research is astounding. And keep in mind that the technique they used to detect binary exploits is prone to false negatives, so the numbers are likely much worse. Some of my friends in the security business, as well as the US Congress, had been talking about legal measures that might be used to improve the state of security. Mike Scher, a friend, security geek, and a lawyer, agreed to write an article accessible to non-lawyers about the current state of software liability (page 26). My take based on Scher’s cogent analysis is that we had better work on other approaches. Radical approaches. Arrakis Simon Peter and Tom Anderson write about Arrakis, an operating system designed to pro- vide application stacks with direct access to devices designed to be multiplexed among VMs. But Arrakis isn’t a hypervisor, and the application stacks are not the same as VMs. Instead, Arrakis sets up containers for application stacks as well as arranging access to devices, such as NICs that have multiple queues that can be allocated to specific applications. Peter 2 AUGUST 2013 VOL. 38 NO. 4 www.usenix.org EDITORIAL Musings expects that we will soon see block devices, first SSDs and later measuring the entropy of passwords that can be created when hard disks, that work similarly. limited by password policies. Abe and Warren (page 14) take a close look at how current password policies actually make You might wonder what Arrakis has to do with security, but security worse, and suggest ways to improve password security. Arrakis reduces the software stack between applications and Along the way, they examine the myths that have lead to the devices. Arrakis also makes use of features such as extended password polices most commonly used today. page tables so that different parts of an application can share the same address space, but also be better isolated: for example, I interviewed Bill Cheswick, focusing on his work in security.