December 2010 VOLUME 35 NUMBER 6 OPINION Musings 2 RikR FaR ow SECURITY Introducing Capsicum: Practical Capabilities for UNIX 7 Robe Rt N.M. watsoN, JoNathaN THE USENIX MAGAZINE aNdeRsoN, beN LauRie, aNd kRis keNNaway The Nocebo Effect on the Web: An Analysis of Fake Anti-Virus Distribution 18 Moheeb abu Ra Jab, Lucas baLLaRd, PaNayiotis MavRoMMatis, NieLs PRovos, aNd XiN Zhao Vulnerable Compliance 26 d aN GeeR Overcoming an Untrusted Computing Base: Detecting and Removing Malicious Hardware Automatically 31 Matthew hicks, MuRPh FiNNicuM, saMueL t. kiNG, MiLo M.k. MaRtiN, aNd JoNathaN M. sMith C OLUMNS Practical Perl Tools: Family Man 42 d avid N. bLaNk-edeLMaN Pete’s All Things Sun: Comparing Solaris to RedHat Enterprise and AIX 48 Petee R ba R GaLviN iVoyeur: Ganglia on the Brain 54 d ave JosePhseN /dev/random 58 Robe Rt G. Fe RReLL BOEO K reVI WS Book Reviews 60 El iZabeth Zwicky et a L. useni X NOTES Thankso t Our Volunteers 64 Ell u ie yo ng CN O FERENCES 19th USENIX Security Symposium Reports 67 Report on the 5th USENIX Workshop on Hot Topics in Security 97 Report on the 1st USENIX Workshop on Health Security and Privacy 103 Report on the 4th USENIX Workshop on Offensive Technologies 112 Report on the New Security Paradigms Workshop 117 The Advanced Computing Systems Association dec10covers.indd 1 11.17.10 1:28 PM Upcoming Events 9th USENIX CoNfErence oN fIlE aNd StoragE 2011 USENIX fEdEratEd CoNfErences Week techNologies (FASt ’11) j une 12–17, 2011, portland, OR, uSa Sponsored by USENIX in cooperation with ACM SIGOPS EventS inclUdE: February 15–18, 2011, San joSe, Ca, uSa http://www.usenix.org/fast11 3rd WorkShop oN hot topics in StoragE aNd fIlE SyStems (hotStoragE ’11) WorkShop oN hot topics in MaNagement of june 14, 2011 INtErnet, CloUd, aNd ENtErprise NEtWorkS aNd http://www.usenix.org/hotstorage11 SErvices (hot-ICE ’11) Submissions due: March 9, 2011 Co-located with NSDI ’11 3rd USENIX WorkShop oN hot topics in Mar Ch 29, 2011, boSton, Ma, uSa CloUd CoMpUting (hotCloUd ’11) http://www.usenix.org/hotice11 june 14–15, 2011 http://www.usenix.org/hotcloud11 4th USENIX WorkShop oN largE-SCalE EXploItS aNd Emergent thrEatS (lEEt ’11) 2011 USENIX annual technical CoNfErence Co-located with NSDI ’11 (USENIXt a C ’11) Mar Ch 29, 2011, boSton, Ma, uSa june 15–17, 2011 http://www.usenix.org/leet11 http://www.usenix.org/atc11 Submissions due: January 12, 2011 8th USENIX SyMposium oN NEtWorkEd SyStems 2Nd USENIX CoNfErence oN WEb applicatIoN desigN aNd IMplementatIoN (NSdI ’11) dEvElopment (WEbappS ’11) Sponsored by USENIX in cooperation with ACM SIGCOMM and june 15–16, 2011 ACM SIGOPS http://www.usenix.org/webapps11 Mar Ch 30–april 1, 2011, boSton, Ma, uSa Submissions due: January 21, 2011 http://www.usenix.org/nsdi11 20th USENIX SecurIty SyMposium EUropEaN CoNfErence oN CoMpUtEr SyStems (USENIX SecurIty ’11) (EUroSyS 2011) Sponsored by ACM SIGOPS in cooperation with USENIX a uguSt 10–12, 2011, San FranCiSCo, Ca, uSa http://www.usenix.org/sec11 a pril 10–13, 2011, Salzburg, auStria Submissions due: February 10, 2011 http://eurosys2011.cs.uni-salzburg.at WorkShopS Co-loCatEd with 13th WorkShop oN hot topics in opErating USENIX SecurIty ’11 (aS of 11/10): SyStems (hotoS XIII) Sponsored by USENIX in cooperation with the IEEE Technical 2011 Electronic voting techNology Committee on Operating Systems (TCOS) WorkShop/WorkShop oN trustWorthy May 8–10, 2011, napa, Ca, uSa ElectIons (EVT/WOTE ’11) http://www.usenix.org/hotos11 a uguSt 8–9, 2011 Submissions due: January 15, 2011 http://www.usenix.org/evtwote11 Submissions due: April 20, 2011 3rd USENIX WorkShop oN hot topics in parallElism (hotpar ’11) 23rd aCM SyMposium oN opErating SyStems May 26–27, 2011, berkeley, Ca, uSa principles (SoSp 2011) http://www.usenix.org/hotpar11 Sponsored by ACM SIGOPS in cooperation with USENIX Submissions due: January 16, 2011 oC tober 23–26, 2011, CaSCaiS, portugal http://sosp2011.gsd.inesc-id.pt Submissions due: March 11, 2011 For a complete list of all USENIX & USENIX co-sponsored events, see http://www.usenix.org/events. dec10covers.indd 2 11.17.10 1:28 PM OPINION Musings 2 Ri r k FAr Ow SECURITY Introducing Capsicum: Practical Capabilities for UNIX 7 Ro berT N. m. wATsON, JONAThAN ANDersON, beN LAurIe, AND krIs keNNAwAy The Nocebo Effect on the Web: An Analysis of Fake Anti-Virus Distribution 18 Mo heeb Abu rAJAb, LucAs bALLArD, contents PANAyIOTIs mAvrOmmATIs, NIeLs PrOvOs, AND XIN ZhAO Vulnerable Compliance 26 DN A Geer Overcoming an Untrusted Computing Base: Detecting and Removing Malicious Hardware Automatically 31 Matt hew hIcks, murPh FINNIcum, sAmueL T. kING, mILO m.k. mArTIN, AND JONAThAN m. smITh C OLUMNS Practical Perl Tools: Family Man 42 D AvI N. bLANk-eDeLmAN Pete’s All Things Sun: Comparing Solaris to RedHat Enterprise and AIX 48 VOL. 35, #6, December 2010 Pe A Ter b er Galvin ;login: is the official Editor iVoyeur: Ganglia on the Brain 54 Rik Farrow magazine of the [email protected] USENIX Association. D Ave JOsePhseN Managing Editor ;login: (ISSN 1044-6397) is /dev/random 58 Jane-Ellen Long published bi-monthly by the Ro berT G. FerreLL [email protected] USENIX Association, 2560 Ninth Street, Suite 215, Copy Editor Berkeley, CA 94710. Steve Gilmartin BOEO K reVI WS Book Reviews 60 [email protected] $90 of each member’s annual ElizabeTh ZwIcky eT AL. dues is for an annual sub- produCtion scription to ;login:. Subscrip- Casey Henderson tions for nonmembers are useni X NOTES Thanks to Our Volunteers 64 Jane-Ellen Long $125 per year. ElliO e y ung Jennifer Peterson Periodicals postage paid at typEsEttEr Berkeley, CA, and additional CN O FERENCES Star Type offices. 19th USENIX Security Symposium Reports 67 [email protected] POSTMASTER: Send address Report on the 5th USENIX Workshop on usEniX assoCiation changes to ;login:, Hot Topics in Security 97 2560 Ninth Street, USENIX Association, Suite 215, Berkeley, 2560 Ninth Street, Report on the 1st USENIX Workshop on California 94710 Suite 215, Berkeley, Health Security and Privacy 103 Phone: (510) 528-8649 CA 94710. FAX: (510) 548-5738 Report on the 4th USENIX Workshop on ©2010 USENIX Association Offensive Technologies 112 http://www.usenix.org http://www.sage.org USENIX is a registered trade- Report on the New Security Paradigms mark of the USENIX Associa- tion. Many of the designations Workshop 117 used by manufacturers and sellers to distinguish their products are claimed as trade- marks. USENIX acknowledges all trademarks herein. Where those designations appear in this publication and USENIX is aware of a trademark claim, the designations have been printed in caps or initial caps. ;LOGIN: December 2010 ArTIcLe TITLe 1 DECEMBERarticles.indd 1 11.17.10 12:56 PM I’ve been accused, r Ightly, of be Ing pessimistic about computer security, and Rik Fa RRow recent events have only increased that pessimism. But rather than tire you with my grumblings, I thought I would take a dispassionate look at computer security as it exists today and make positive suggestions about what you might do, musings whether in your professional or personal Rik is the Editor of ;login:. lives. [email protected] I’ll start out with something you might find surprising, considering the source: if you, or people you know or work with, use Windows XP, convince them to upgrade. The same goes for people using anything earlier than Server 2008. Microsoft began its Trustworthy Computing Initiative in 2002 and has paid much more attention to security in recent years. Some of the fruits include more reactive security measures, such as DEP ( data execution prevention) and ASLR (address space layout randomization), although these are not used in all applications. Internet Explorer 7 prior to SP1 is one of those applications that is not protected with either DEP or ASLR for application compatibility, but later versions are, as is IE8. Both IE7 and IE8 also rely on Integrity Levels [1], an ACL mechanism where less trusted processes, such as Web browsers, get run with a low integrity level. Processes with low integrity levels have limited or no access to files, processes, or other objects (e.g., registry keys and named pipes) at higher integrity levels—which means, most of the system. These are good things. I kept hearing from my friends in security that Windows had gotten a lot more secure—but they wouldn’t or couldn’t provide strong evidence that these mechanisms actually help. Then I learned from Niels Provos, whose Google team searches the Web for malicious sites, that it was much more difficult for most exploits to work with IE7 or IE8. While his team’s goal is to find pages that lead to exploits on any version of Windows, I found this interesting news, as they actually test hundreds of millions of pages in their Windows equipped sandboxes (see “The Nocebo Effect,” p. 18). Crispin Cowan, the inventor of stack canaries, also known for Immunix and AppArmor, began working for Microsoft in 2008. Cowan spoke at the 2010 USENIX Security Symposium, allegedly 2 ;LOGIN: vOL. 35, NO. 6 DECEMBERarticles.indd 2 11.17.10 12:56 PM about the security features of Windows 7 but actually about how Microsoft had sometimes been the first vendor to include new security features. I have it on good authority [2] that such talk is security theater, but you can watch the video of his presentation and decide for yourself [3]. You can also read the summaries of his talk and that of Roger Johnston, the person who describes Cowan’s talk as security theater, in this issue.