Question

Authorization

1. Advantages
   1. [5pts] What are 2 advantages of capabilities over ACL
   2. [5pts] What are 2 advantages of ACL over capabilities
2. Delegation
   1. [10pts] Describe what the confused deputy problem is
3. [40pts] MLS compartments
   • Alice has the following clearances TopSecret, Secret{A}, Classified{B}
   • Bob has the following clearances TopSecret{A}, Secret{B}

Draw the full tree and indicate which files Alice and Bob each can read (don’t forget Unclassified)

Software insecurity

4. [20pts] Provide a detailed discussion of one real-world virus or worm that was not covered in the text. Specifically describe in detail the vulnerability it exploited and what it did once it was successful.

5. [20pts] Canaries - How is a canary used to prevent a stack smashing attack?

Answer 1

Answer a). The 2 advantages of capabilities over ACL are

1. Capabilities are easy to use because it is better than ACL.

2. Access control list is better than ACL

Answer b). advantages of ACL over capabilities are

1. Its network performance is better than capabilities.

2 In ACL admin can configure the access list as per demand and admin if wants then can reject the packets which admin doesn't want whereas in capabilities these facilities are not available.

Answer c). Confused Deputy Problem:

The confused deputy problem is a well-known problem that arises due to poor configuration of ACL. The confused deputy is a program that is fooled by some other party into misusing its own authority. In essence, it is a well-known example of privilege escalation.

Note: Here I am answering only 3 part because if I start solving all question then it will take lots of time.