DECEMBER 2009 VOLUME 34 NUMBER 6 OPINION Musings 2 Rik Farrow SECURITY The Conflicts Facing Those Responding to Cyberconflict 7 DaviD DittRich THE USENIX MAGAZINE Top 10 Web Hacking Techniques: “What’s Possible, Not Probable” 16 JeRemiah GRossman Hardening the Web with NoScript 21 Giorgio maone Correct OS Kernel?­ Proof? Done! 28 GeRwin klein Improving TCP Security with Robust Cookies 35 Perry metzGeR, willia m allen simPson, anD Paul vixie COLUMns Practical Perl Tools: Essential Techniques 44 DaviD n. Blank-Edelman Pete’s All Things Sun: Swaddling Applications in a Security Blanket 51 PeteR BaeR Galvin iVoyeur: 7 Habits of Highly Effective Nagios Implementations 57 Dave JosePhsen /dev/random: A Realist’s Glossary of Terms Widely Employed in the Information Security Arena 62 RoBeRt G. Ferrell BooK reVieWS Book Reviews 65 elizaBeth zwicky et al. useniX NOTES 2010 Election for the USENIX Board of Directors 70 ellie younG USACO Teams Shine 71 RoB kolstaD ConFerences Reports from the 18th USENIX Security Symposium 73 Reports from the 2nd Workshop on Cyber Security Experimentation and Test (CSET ’09) 101 Reports from the 4th USENIX Workshop on Hot Topics in Security (HotSec ’09) 108 The Advanced Computing Systems Association dec09covers.indd 1 10.29.09 10:09:48 AM Upcoming Events Fi r s t Wo r k s h o p o n su s t a i n a b l e in F o r m a t i o n 2n d USENIX Wo r k s h o p o n ho t to p i c s in te c h n o l o g y (su s t a i n IT ’10) pa r a l l e l i s m (ho t pa r ’10) Co-located with FAST ’10 Sponsored by USENIX in cooperation with ACM SIGMETRICS, february 22, 2010, San JoSe, ca, uSa ACM SIGSOFT, ACM SIGOPS, and ACM SIGARCH http://www.usenix.org/sustainit10 June 14–15, 2010, berkeley, CA, uSa http://www.usenix.org/hotpar10 Submissions due: January 24, 2010 2n d USENIX Wo r k s h o p o n t h e th e o r y a n d pr a c t i c e o F pr o v e n a n c e (taPP ’10) 8t h an n u a l international co n F e r e n c e o n Co-located with FAST ’10 mo b i l e sy s t e m s , applications a n d se r v i c e s february 22, 2010, San JoSe, ca, uSa (mo b i sy s 2010) http://www.usenix.org/tapp10 Submissions due: December 14, 2009 Jointly sponsored by ACM SIGMOBILE and the USENIX Association 8t h USENIX co n F e r e n c e o n Fi l e a n d st o r a g e June 14–18, 2010, San franciSco, CA, uSa http://www.sigmobile.org/mobisys/2010/ echnologies t (FAST ’10) Abstracts due: December 4, 2009 Sponsored by USENIX in cooperation with ACM SIGOPS february 23–26, 2010, San JoSe, ca, uSa USENIX te c h n i c a l co n F e r e n c e s We e k http://www.usenix.org/fast10 2010 USENIX an n u a l te c h n i c a l co n F e r e n c e 3r d USENIX Wo r k s h o p o n la r g e -sc a l e (USENIX ATC ’10) eX p l o i t s a n d em e r g e n t th r e a t s (LEET ’10) June 23–25, 2010, boSton, Ma, uSa Co-located with NSDI ’10 http://www.usenix.org/atc10 Submissions due: January 11, 2010 april 27, 2010, San JoSe, ca, uSa http://www.usenix.org/leet10 USENIX co n F e r e n c e o n We b ap p l i c a t i o n Submissions due: February 25, 2010 de v e l o p m e n t (We b ap p s ’10) June 23–25, 2010, boSton, Ma, uSa 2010 in t e r n e t ne t W o r k ma n a g e m e n t http://www.usenix.org/webapps10 Wo r k s h o p /Wo r k s h o p o n re s e a r c h o n Paper titles and abstracts due: January 4, 2010 en t e r p r i s e ne t W o r k i n g (INM/WREN ’10) Co-located with NSDI ’10 3r d Wo r k s h o p o n on l i n e so c i a l ne t W o r k s april 27, 2010, San JoSe, ca, uSa (WOSN 2010) http://www.usenix.org/inmwren10 June 22, 2010, boSton, mA, uSa Paper registration due: February 5, 2010 http://www.usenix.org/wosn10 Paper submissions due: February 18, 2010 9t h international Wo r k s h o p o n pe e r -t o -pe e r 2n d USENIX Wo r k s h o p o n ho t to p i c s in sy s t e m s (IPTPS ’10) cl o u d co m p u t i n g (ho t cl o u d ’10) Co-located with NSDI ’10 april 27, 2010, San JoSe, ca, uSa 2n d Wo r k s h o p o n ho t to p i c s in st o r a g e a n d http://www.usenix.org/iptps10 Fi l e sy s t e m s (ho t st o r a g e ’10) Submissions due: December 18, 2009 19t h USENIX se c u r i t y sy m p o s i u m 7t h USENIX sy m p o s i u m o n ne t W o r k e d sy s t e m s (USENIX se c u r i t y ’10) de s i g n a n d implementation (NSDI ’10) auguSt 11–13, 2010, waShington, Dc, uSa Sponsored by USENIX in cooperation with ACM SIGCOMM and http://www.usenix.org/sec10 ACM SIGOPS Submissions due: February 5, 2010 april 28–30, 2010, San JoSe, ca, uSa http://www.usenix.org/nsdi10 For a complete list of all USENIX & USENIX co-sponsored events, see http://www.usenix.org/events. dec09covers.indd 2 10.29.09 10:09:49 AM OPINION Musings 2 Rik FArrOw SECURITY The Conflicts Facing Those Responding to Cyberconflict 7 DAvid DittrIch Top 10 Web Hacking Techniques: “What’s Possible, Not Probable” 16 JeremIAh GrOssman Hardening the Web with NoScript 21 contents GIOrgio Maone Correct OS Kernel? Proof? Done! 28 GerwIN KleIN Improving TCP Security with Robust Cookies 35 Perry meTzGer, Willia m AlleN SimPson, and PAuL VixIe COLUMns Practical Perl Tools: Essential Techniques 44 DAvid N. Blank-EdeLman Pete’s All Things Sun: Swaddling Applications in a Security Blanket 51 PeTer Baer Galvin iVoyeur: 7 Habits of Highly Effective Nagios Implementations 57 VOL. 34, #6, December 2009 DAve JOsePhseN Editor ;login: is the official /dev/random: A Realist’s Glossary of Terms magazine of the Rik Farrow Widely Employed in the Information Security [email protected] USENIX Association. Arena 62 Managing Editor ;login: (ISSN 1044-6397) is RoberT G. FerreLL Jane-Ellen Long published bi-monthly by the [email protected] USENIX Association, 2560 Ninth Street, Suite 215, Copy Editor Berkeley, CA 94710. BooK reVieWS Book Reviews 65 Steve Gilmartin ElizAbeTh zwIcky eT al. [email protected] $90 of each member’s annual dues is for an annual sub- produCtion scription to ;login:. Subscrip- useniX NOTES 2010 Election for the USENIX Board of Casey Henderson tions for nonmembers are Jane-Ellen Long $125 per year. Directors 70 Jennifer Peterson Ellie Young Periodicals postage paid at typEsEttEr Berkeley, CA, and additional USACO Teams Shine 71 Star Type offices. Rob Kolstad [email protected] POSTMASTER: Send address USEniX assoCiation changes to ;login:, 2560 Ninth Street, USENIX Association, ConFerences Reports from the 18th USENIX Security Suite 215, Berkeley, 2560 Ninth Street, Symposium 73 California 94710 Suite 215, Berkeley, Phone: (510) 528-8649 CA 94710. Reports from the 2nd Workshop on FAX: (510) 548-5738 Cyber Security Experimentation and Test ©2009 USENIX Association http://www.usenix.org (CSET ’09) 101 http://www.sage.org USENIX is a registered trade- mark of the USENIX Associa- Reports from the 4th USENIX Workshop on tion. Many of the designations Hot Topics in Security (HotSec ’09) 108 used by manufacturers and sellers to distinguish their products are claimed as trade- marks. USENIX acknowledges all trademarks herein. Where those designations appear in this publication and USENIX is aware of a trademark claim, the designations have been printed in caps or initial caps. ;LOGIN: December 2009 ArTIcLe TITLe 1 Login_articlesDECEMBER_09_final.indd 1 10.29.09 9:27:12 AM ImagIne watchIng the begInnIng of a stock car race. As the drivers climb Rik Farrow into their cars, they ignore the webbing for covering the drivers’ windows and do not attach their five-point restraints or the head-and-neck supports. Although this goes against safety recommendations (and NAS- CAR rules), the drivers have decided that musings these safety measures are “inconvenient” Rik is the Editor of ;login:.