Tightening the default CAS policy

24 Mar 2006 6:47 PM

Kurt

One thing I noticed in first release of .NET is that programs stored on My
Computer were granted fulltrust regardless its location effectivly equivelant
to an unmanaged application. My thought is that assemblies in temp
directories, my documents, etc, can in general be assumed to have come from a
some external location and should not initially have fulltrust without the
user having explicitly granted it by installing the application and/or
modifying the security policy. Saving an assembly to the local disk should
not in itself be sufficient IMHO to increase an assemblies trust permission.

For example, say the user is requested by a internet site to download an
application that unknown to the user scans all of their files for personal
information and transmits it to some internet site. The internet site knows
that the application will not have permissions to run in the internet zone so
they package instruct the user to save as (despite the warnings presented if
the user can do it he mostlikely will) and run from their computer (where it
will have fulltrust). Once saved the the users computer it effectivly has
the same permissions as any other unmanaged application thus nullifying CAS.
At present the advantages of a tighter security policy have somewhat limited
reach because the internet site could have requested the user download an
unmanaged application but a managed application is in genereal much easier to
develop. However my hope is that in the near future we will have the ability
to restrict execution of unapproved unmanaged applications. For example
administrator approves only unmanaged applications located in program files
and windows folders and the local network share, if we then repeat the above
scenario with a managed and an unmanaged application the unmanaged
application would not be able to run but the managed application would have
full trust and this would be a serious loophole. Of course the CAS policy
can be changed to have simalar restrictions which is exactly what I'm
proposing.

My suggestion is that the default security policy should only grant full
trust only to assemblies located in the Program Files and Windows\... folder
(systemX or whatever is needed but not windows\temp), all other locations
should default to Internet Zone permissions rather then FullTrust. I would
much rather have the permissions of an assembly reduced when the user copies
an assembly from a network share for example then increased when downloaded
from the internet.

Thanks,

24 Mar 2006 6:58 PM

Dominick Baier [DevelopMentor]

I am totally with you -

unfortunately this collides with MSFT's goal of making CAS as easy as possible...sad
but true

also look here: http://www.leastprivilege.com/BewareBeAwareOfClickOnceDefaultSettings.aspx

I think this was a opportunity missed in 1.0 times - now this is so much
a breaking change that it will most probably never happen -

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Show quoteHide quote

> One thing I noticed in first release of .NET is that programs stored
> on My Computer were granted fulltrust regardless its location
> effectivly equivelant to an unmanaged application. My thought is that
> assemblies in temp directories, my documents, etc, can in general be
> assumed to have come from a some external location and should not
> initially have fulltrust without the user having explicitly granted it
> by installing the application and/or modifying the security policy.
> Saving an assembly to the local disk should not in itself be
> sufficient IMHO to increase an assemblies trust permission.
>
> For example, say the user is requested by a internet site to download
> an application that unknown to the user scans all of their files for
> personal information and transmits it to some internet site. The
> internet site knows that the application will not have permissions to
> run in the internet zone so they package instruct the user to save as
> (despite the warnings presented if the user can do it he mostlikely
> will) and run from their computer (where it will have fulltrust).
> Once saved the the users computer it effectivly has the same
> permissions as any other unmanaged application thus nullifying CAS.
> At present the advantages of a tighter security policy have somewhat
> limited reach because the internet site could have requested the user
> download an unmanaged application but a managed application is in
> genereal much easier to develop. However my hope is that in the near
> future we will have the ability to restrict execution of unapproved
> unmanaged applications. For example administrator approves only
> unmanaged applications located in program files and windows folders
> and the local network share, if we then repeat the above scenario with
> a managed and an unmanaged application the unmanaged application would
> not be able to run but the managed application would have full trust
> and this would be a serious loophole. Of course the CAS policy can be
> changed to have simalar restrictions which is exactly what I'm
> proposing.
>
> My suggestion is that the default security policy should only grant
> full trust only to assemblies located in the Program Files and
> Windows\... folder (systemX or whatever is needed but not
> windows\temp), all other locations should default to Internet Zone
> permissions rather then FullTrust. I would much rather have the
> permissions of an assembly reduced when the user copies an assembly
> from a network share for example then increased when downloaded from
> the internet.
>
> Thanks,
>

27 Mar 2006 6:11 PM

Kurt

I'm a bit behind on ClickOnce technology so I could be off base here but I
believe ClickOnce I believe allows the user to automatically "install" the
applicaiton which should still work providing the user has the necessary
permissions to install the applications.

If the user is a power user or administrator with permissions to install
applications and thus write permissions to program files ClickOnce should
still work, however if the user is a limited user account and doesn't have
permissions to write to install applications and write to program files
folder then ClickOnce would fail with or without CAS just due to standard
ACLs.

Show quoteHide quote

"Dominick Baier [DevelopMentor]" wrote:

> I am totally with you -
>
> unfortunately this collides with MSFT's goal of making CAS as easy as possible...sad
> but true
>
> also look here: http://www.leastprivilege.com/BewareBeAwareOfClickOnceDefaultSettings.aspx
>
> I think this was a opportunity missed in 1.0 times - now this is so much
> a breaking change that it will most probably never happen -
>
> ---------------------------------------
> Dominick Baier - DevelopMentor
> http://www.leastprivilege.com
>
> > One thing I noticed in first release of .NET is that programs stored
> > on My Computer were granted fulltrust regardless its location
> > effectivly equivelant to an unmanaged application. My thought is that
> > assemblies in temp directories, my documents, etc, can in general be
> > assumed to have come from a some external location and should not
> > initially have fulltrust without the user having explicitly granted it
> > by installing the application and/or modifying the security policy.
> > Saving an assembly to the local disk should not in itself be
> > sufficient IMHO to increase an assemblies trust permission.
> >
> > For example, say the user is requested by a internet site to download
> > an application that unknown to the user scans all of their files for
> > personal information and transmits it to some internet site. The
> > internet site knows that the application will not have permissions to
> > run in the internet zone so they package instruct the user to save as
> > (despite the warnings presented if the user can do it he mostlikely
> > will) and run from their computer (where it will have fulltrust).
> > Once saved the the users computer it effectivly has the same
> > permissions as any other unmanaged application thus nullifying CAS.
> > At present the advantages of a tighter security policy have somewhat
> > limited reach because the internet site could have requested the user
> > download an unmanaged application but a managed application is in
> > genereal much easier to develop. However my hope is that in the near
> > future we will have the ability to restrict execution of unapproved
> > unmanaged applications. For example administrator approves only
> > unmanaged applications located in program files and windows folders
> > and the local network share, if we then repeat the above scenario with
> > a managed and an unmanaged application the unmanaged application would
> > not be able to run but the managed application would have full trust
> > and this would be a serious loophole. Of course the CAS policy can be
> > changed to have simalar restrictions which is exactly what I'm
> > proposing.
> >
> > My suggestion is that the default security policy should only grant
> > full trust only to assemblies located in the Program Files and
> > Windows\... folder (systemX or whatever is needed but not
> > windows\temp), all other locations should default to Internet Zone
> > permissions rather then FullTrust. I would much rather have the
> > permissions of an assembly reduced when the user copies an assembly
> > from a network share for example then increased when downloaded from
> > the internet.
> >
> > Thanks,
> >
>
>
>

27 Mar 2006 7:06 PM

Nicole Calinoiu

"Kurt" <K***@discussions.microsoft.com> wrote in message
news:7AA0C923-10EA-4B3E-84A7-40EAB046E8D0@microsoft.com...

<snip>

> however if the user is a limited user account and doesn't have
> permissions to write to install applications and write to program files
> folder then ClickOnce would fail with or without CAS just due to standard
> ACLs.

Sorry but, while that's a reasonable assumption, it's unfortunately
completely incorrect. ClickOnce applications are installed to
user-specific, user-writeable locations, not the Program Files folder.
ClickOnce is designed specifically to allow non-admins to install and
elevate the CAS privilege of network-deployed applications. If you want to
prevent non-admins from elevating the CAS permissions of ClickOnce
applications, you will need to adjust the relevant TrustManager settings
manually. See
http://msdn.microsoft.com/library/en-us/dv_vstechart/html/ClickOnceSec.asp
for an introduction and
http://www.leastprivilege.com/PermaLink.aspx?guid=dd4eda16-f930-44e0-9f4e-56cfa0cda3f4
for some additional RTM details.

27 Mar 2006 8:27 PM

Kurt

I suppose a custom membership condition (as URL Permission would be way to
difficult to maintain for each user) could be created to determine if its a
click once applicaiton probably fairly simple to implement and could perhaps
be simalar to url permission but relative to %USERPROFILE%.

All_Code
My_Computer_Zone - Internet
     ClickOnce Applications - FullTrust
      ....

This would also give the administrator a visual cue that the user can run
ClickOnce applications at full trust, and if the administrator wants to limit
the maximum permission of ClickOnce applications could do so by modifying the
permissionset accordingly, perhaps he doesn't want to allow clickonce
applications to skipverification he could change this to everything instead
of fulltrust.

Additionally perhaps CAS could provide more granularity regarding ClickOnce
Applications from the looks of it the administrator can chose to enable
disable or require authenticode depending on the zone the application is
being installed from but nothing that I can see that sets the Maximum trust
level that can be granted for the zone. So for example, perhaps the
administrator is okay with the user elevating permissions of a clickonce
application from the internet providing that program cannot access the local
interanet, he might endup with something like this:

My_Computer_Zone - InternetZone
   ClickOnce Applications - Nothing
         LocalComputer - Everything
         LocalIntarnet - Everything
         TrustedSites - Everything
         Internet - LocalMachineOnly/custom permissionset
            Approved Internet Applications (some membership condition to
identify an approved clickonce application?)- Everything
         UntrustedSites - Nothing
    ...

Anyways I think it can be made to work, some of the details perhaps need to
be flushed out but I think in the spirit of least privilege defaults
My_Computer_Zone shouldn't be fulltrust. I think ClickOnce needs a bit more
granularity but at least the administrator has some control over the
locations clickonce applications can be installed from even if he can't
currenlty set the max permission set (that I can see anyways).

- Kurt

Show quoteHide quote

"Nicole Calinoiu" wrote:

> "Kurt" <K***@discussions.microsoft.com> wrote in message
> news:7AA0C923-10EA-4B3E-84A7-40EAB046E8D0@microsoft.com...
> <snip>
> > however if the user is a limited user account and doesn't have
> > permissions to write to install applications and write to program files
> > folder then ClickOnce would fail with or without CAS just due to standard
> > ACLs.
>
> Sorry but, while that's a reasonable assumption, it's unfortunately
> completely incorrect. ClickOnce applications are installed to
> user-specific, user-writeable locations, not the Program Files folder.
> ClickOnce is designed specifically to allow non-admins to install and
> elevate the CAS privilege of network-deployed applications. If you want to
> prevent non-admins from elevating the CAS permissions of ClickOnce
> applications, you will need to adjust the relevant TrustManager settings
> manually. See
> http://msdn.microsoft.com/library/en-us/dv_vstechart/html/ClickOnceSec.asp
> for an introduction and
> http://www.leastprivilege.com/PermaLink.aspx?guid=dd4eda16-f930-44e0-9f4e-56cfa0cda3f4
> for some additional RTM details.
>
>

27 Mar 2006 10:01 AM

oldbear

Hi Kurt

For those of us working in security it's hard to contemplate the idea of
insecure defaults, and so I agree with what you say. However, there's also
the tradeoff regarding useability.

For ASP.Net applications, there are different levels of trust for
applications (FullTrust, High, Medium etc.). This gives me some food for
thought.

How about different defaults for different types of servers? For instance,
the current defaults would be the 'Low' setting, whereas the ones that you
suggest would be the 'Medium' setting, with a 'High' set of defaults for
application servers.

Just a thought, but I'd really appreciate your opinions here.

Many large-scale applications don't seem to use CAS at all. Perhaps offering
a choice of defaults would give an incentive to developers to incorporate it
without having to disrupt useability for ordinary desktop users?

Cheers

Chris Seary

http://blog.searyblog.com/

27 Mar 2006 10:16 AM

Dominick Baier [DevelopMentor]

We have that already - it is called LocalComputer, Intranet, Internet etc...

it is not the choice of defaults - it is a hard to understand concept (for
people who are used to user based security), the docs suck, the tooling sucks
-

it usually takes a lot more time for the 1st partially trusted project -
noone gets money for that extra time (because the results - as always in
security - are not visible enough - and again the guy that controls budget
can hardly understand windows kernel security - so CAS...WTF?? ...)

Why a distinction between client and server??

I think the default for local apps should have never been FullTrust.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Show quoteHide quote

> Hi Kurt
>
> For those of us working in security it's hard to contemplate the idea
> of insecure defaults, and so I agree with what you say. However,
> there's also the tradeoff regarding useability.
>
> For ASP.Net applications, there are different levels of trust for
> applications (FullTrust, High, Medium etc.). This gives me some food
> for thought.
>
> How about different defaults for different types of servers? For
> instance, the current defaults would be the 'Low' setting, whereas the
> ones that you suggest would be the 'Medium' setting, with a 'High' set
> of defaults for application servers.
>
> Just a thought, but I'd really appreciate your opinions here.
>
> Many large-scale applications don't seem to use CAS at all. Perhaps
> offering a choice of defaults would give an incentive to developers to
> incorporate it without having to disrupt useability for ordinary
> desktop users?
>
> Cheers
>
> Chris Seary
>
> http://blog.searyblog.com/
>

27 Mar 2006 12:20 PM

oldbear

Hi Dominick

Not quite the same thing - MyComputer, LocalIntranet etc. relate to where
the code was obtained from. I was suggesting different defaults for the
computer actually running the components. I think it's fair that different
types of server would need different defaults, the same as different web apps
have different levels of trust.

However, I agree that giving all code on the local computer FullTrust via
the Machine policy is not at all useful. This is where different defaults
might be useful - I can't see that one could provide a particular definition
for this particular code group that would cover all uses.

It may be that developers just don't get CAS, as you said. Everyone's
mindset is still tuned to users and groups. Changing this is more to do with
education and community initiatives.

Many developers really haven't invested time in CAS. A good example is the
slew of new books on ASP.Net 2.0. Not a mention of CAS in most of them, and
conveniently all mention of the <trust /> element has been left out of most
sections on Configuration.

I brought CAS up as an example at the Connect Event in Nice a couple of
weeks ago: http://blog.searyblog.com/blog/_archives/2006/3/24/1838950.html. I
specifically raised the issues regarding the current defaults for CAS (ie.
more or less turned off), and most people in the room agreed that this was
not a good thing. So hopefull this may bring about changes?

Another way to push this forward to this might be to develop more design
patterns. I've worked as a security architect on projects where competent use
of CAS has reduced the work necessary to develop an application, and made
deployment issues easier. This sort of stuff needs to be disseminated further
in the community.

Finally, I don't remember answering a single question on CAS to get my MCSD.
Putting this stuff into a compulsory part of the exam would be useful.

Cheers

Chris Seary

http://blog.searyblog.com/

27 Mar 2006 12:37 PM

Dominick Baier [DevelopMentor]

hi,

in essence Intranet and Medium trust are very similar concepts - just a name
that groups different permissions together....

CAS is just a engine that grants permissions based on evidence - MS chose
to use the zone approach as a default...

I think it would have made sense to deny some dangerous permission by default,
e.g. reflection against non-public members, unmanaged code for the local
machine - besides \program files - which requires admin privs to install
software into.

> Many developers really haven't invested time in CAS. A good example is
> the slew of new books on ASP.Net 2.0. Not a mention of CAS in most of
> them, and conveniently all mention of the <trust /> element has been
> left out of most sections on Configuration.

fortunately i wrote ~50 pages about it in my book... :)

yes you are right - CAS is not well documented - and it is very hard to use
in the first place (and if security is too hard nobody will use it)

this "demand for SecurityException failed" message is just not useful enough
for someone with not enough experience - why should he flip that magic trust
switch if it seems that everything breaks and he doesn't even know why??

I totally agree that the right usage of CAS makes it quite easy to secure
an application - it is just the learning curve that is so steep.

the problem is that even inside MS it is very hard to convince a lot of people
that partial trust makes sense - i won't go into detail - but there is a
long road ahead.

if you read my blog you will see that i am an absolute proponent of CAS (and
least privilege in general) - but i think it is a little early - people still
run as admin on their boxes - why should they go for CAS...(rant rant :))

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Show quoteHide quote

> Hi Dominick
>
> Not quite the same thing - MyComputer, LocalIntranet etc. relate to
> where the code was obtained from. I was suggesting different defaults
> for the computer actually running the components. I think it's fair
> that different types of server would need different defaults, the same
> as different web apps have different levels of trust.
>
> However, I agree that giving all code on the local computer FullTrust
> via the Machine policy is not at all useful. This is where different
> defaults might be useful - I can't see that one could provide a
> particular definition for this particular code group that would cover
> all uses.
>
> It may be that developers just don't get CAS, as you said. Everyone's
> mindset is still tuned to users and groups. Changing this is more to
> do with education and community initiatives.
>
> Many developers really haven't invested time in CAS. A good example is
> the slew of new books on ASP.Net 2.0. Not a mention of CAS in most of
> them, and conveniently all mention of the <trust /> element has been
> left out of most sections on Configuration.
>
> I brought CAS up as an example at the Connect Event in Nice a couple
> of weeks ago:
> http://blog.searyblog.com/blog/_archives/2006/3/24/1838950.html. I
> specifically raised the issues regarding the current defaults for CAS
> (ie. more or less turned off), and most people in the room agreed that
> this was not a good thing. So hopefull this may bring about changes?
>
> Another way to push this forward to this might be to develop more
> design patterns. I've worked as a security architect on projects where
> competent use of CAS has reduced the work necessary to develop an
> application, and made deployment issues easier. This sort of stuff
> needs to be disseminated further in the community.
>
> Finally, I don't remember answering a single question on CAS to get my
> MCSD. Putting this stuff into a compulsory part of the exam would be
> useful.
>
> Cheers
>
> Chris Seary
>
> http://blog.searyblog.com/
>

27 Mar 2006 7:29 PM

Kurt

aspnet applies the web application security at the appdomain level, the
appdomain level can furthur restrict the machine policy but not increase it
so I the wwwroot folder would require full trust when IIS is installed. (but
shouldn't be granted if the IIS is not installed. The user shouldn't be able
to create a folder called inetpub\wwwroot save the application there and run
it, but once installed the standard ACLs will prevent non-admin users from
saving files into wwwroot)

I like the High/Medium/Low idea for allowing the user to choose default
PermissionSet for the My_Computer_Zone without having to muck around in CAS
security policy to make changes, but effectively all it needs to do is change
the permissionset associated with the My_Computer_Zone

You should be able to do this with URL Permission as follows. (Might want
to try this on a user polciy rather then machine so you can login another
admin user to undo if you encounter problems :-)

All_Code
My_Computer_Zone = Internet_Zone (High)/LocalInternet(Medium)/Full
Trust(Low)
     Microsoft_Strong_Name = FullTrust
     ECMA_Strong_Name = FullTrust
     System Files (URL Permission - file://C:Windows/*) - Full Trust
     Program Files (URL Permission - file://C:/Program Files/*) - Full Trust

     Web Applications (URL Permission- file://C:/inetpub/wwwroot/*) - Full
Trust
     Visual Studio Projects (URL Permission - <VS projects folders>) - Full
Trust

This may however cause an issue with XMLSerializer and Shadow copy depending
on where the generated/copied files end up. I'm not sure what permissions
the temp assemblies generated by XMLSerializer require but they may not have
enough permissions if you don't include the temporary directory, shadow copy
might be okay providing the shadow copy location is a location with
equivalent permissions for aspnet I think there's a folder in the windows dir
for these so you should be okay, but other applications that use shadow copy
to somewhere like a temp directory might not work. Perhaps some sort of
evidence could be added to temp assemblies generated by the XMLSerializer and
shadow copy files that could be used by the runtime to grant the same
permissions as the application that created it? something to think about
anyways.

Show quoteHide quote

"oldbear" wrote:

> Hi Kurt
>
> For those of us working in security it's hard to contemplate the idea of
> insecure defaults, and so I agree with what you say. However, there's also
> the tradeoff regarding useability.
>
> For ASP.Net applications, there are different levels of trust for
> applications (FullTrust, High, Medium etc.). This gives me some food for
> thought.
>
> How about different defaults for different types of servers? For instance,
> the current defaults would be the 'Low' setting, whereas the ones that you
> suggest would be the 'Medium' setting, with a 'High' set of defaults for
> application servers.
>
> Just a thought, but I'd really appreciate your opinions here.
>
> Many large-scale applications don't seem to use CAS at all. Perhaps offering
> a choice of defaults would give an incentive to developers to incorporate it
> without having to disrupt useability for ordinary desktop users?
>
> Cheers
>
> Chris Seary
>
> http://blog.searyblog.com/
>
>

31 Mar 2006 10:39 PM

Dinis Cruz

Kurt, I am also totally with you and have been saying (for more that two
years now) that Full Trust is a very bad idea, and that we need to move
into a development environment where it makes business sense to develop
partially trusted applications.

The main problem is that nobody (apart from the odd ones like us) seem
to take this problem seriously. The Clients don't ask for it, the
developers don't want to spend the extra development cost to do it, and
Microsoft doesn't want to admit the problem:

The first thing that I ask Microsoft to do is to say very clearly that:

"Full Trust applications are insecure and potentially very dangerous for
the users running them (or for co-hosted websites), so we now need (as
an industry) to make the effort to develop, deploy and maintain
applications that can be executed in secure partially trusted
environments".

But so far Microsoft (and I have meet and emailed with several key
players in there) still refuses to deal with this issue and prefers to
put the head in the sand and ignore it.

I have to say that I was really disappointed when 2.0 was released
without a major push for Partially trusted development. For example I
was hoping that it would be possible to run by default .Net applications
executed from your local computer in a secure partially trusted
environment. But that didn't happened, and I have to say that apart from
a couple more articles (and good blogs) there isn't much difference
between 1.1 and 2.0 (yeah there are things like transparency and other
bits in there too :).

So, until you see guys from Microsoft in discussions like these, nothing
will begin to change.

But hey, keep making noise, I know that one day (eventually) we will get
there.

Dinis Cruz
Owasp .Net Project
www.owasp.net

Kurt wrote:
Show quoteHide quote

> One thing I noticed in first release of .NET is that programs stored on My
> Computer were granted fulltrust regardless its location effectivly equivelant
> to an unmanaged application. My thought is that assemblies in temp
> directories, my documents, etc, can in general be assumed to have come from a
> some external location and should not initially have fulltrust without the
> user having explicitly granted it by installing the application and/or
> modifying the security policy. Saving an assembly to the local disk should
> not in itself be sufficient IMHO to increase an assemblies trust permission.
>
> For example, say the user is requested by a internet site to download an
> application that unknown to the user scans all of their files for personal
> information and transmits it to some internet site. The internet site knows
> that the application will not have permissions to run in the internet zone so
> they package instruct the user to save as (despite the warnings presented if
> the user can do it he mostlikely will) and run from their computer (where it
> will have fulltrust). Once saved the the users computer it effectivly has
> the same permissions as any other unmanaged application thus nullifying CAS.
> At present the advantages of a tighter security policy have somewhat limited
> reach because the internet site could have requested the user download an
> unmanaged application but a managed application is in genereal much easier to
> develop. However my hope is that in the near future we will have the ability
> to restrict execution of unapproved unmanaged applications. For example
> administrator approves only unmanaged applications located in program files
> and windows folders and the local network share, if we then repeat the above
> scenario with a managed and an unmanaged application the unmanaged
> application would not be able to run but the managed application would have
> full trust and this would be a serious loophole. Of course the CAS policy
> can be changed to have simalar restrictions which is exactly what I'm
> proposing.
>
> My suggestion is that the default security policy should only grant full
> trust only to assemblies located in the Program Files and Windows\... folder
> (systemX or whatever is needed but not windows\temp), all other locations
> should default to Internet Zone permissions rather then FullTrust. I would
> much rather have the permissions of an assembly reduced when the user copies
> an assembly from a network share for example then increased when downloaded
> from the internet.
>
> Thanks,
>
>

31 Mar 2006 10:42 PM

Dinis Cruz

Kurt, I am also totally with you and have been saying (for more that two
years now) that Full Trust is a very bad idea, and that we need to move
into a development environment where it makes business sense to develop
partially trusted applications.

The main problem is that nobody (apart from the odd ones like us) seem
to take this problem seriously. The Clients don't ask for it, the
developers don't want to spend the extra development cost to do it, and
Microsoft doesn't want to admit the problem:

The first thing that I ask Microsoft to do is to say very clearly that:

"Full Trust applications are insecure and potentially very dangerous for
the users running them (or for co-hosted websites), so we now need (as
an industry) to make the effort to develop, deploy and maintain
applications that can be executed in secure partially trusted
environments".

But so far Microsoft (and I have meet and emailed with several key
players in there) still refuses to deal with this issue and prefers to
put the head in the sand and ignore it.

I have to say that I was really disappointed when 2.0 was released
without a major push for Partially trusted development. For example I
was hoping that it would be possible to run by default .Net applications
executed from your local computer in a secure partially trusted
environment. But that didn't happened, and I have to say that apart from
a couple more articles (and good blogs) there isn't much difference
between 1.1 and 2.0 (yeah there are things like transparency and other
bits in there too :).

So, until you see guys from Microsoft in discussions like these, nothing
will begin to change.

But hey, keep making noise, I know that one day (eventually) we will get
there.

Dinis Cruz
Owasp .Net Project
www.owasp.net

Kurt wrote:
Show quoteHide quote

> One thing I noticed in first release of .NET is that programs stored on My
> Computer were granted fulltrust regardless its location effectivly equivelant
> to an unmanaged application. My thought is that assemblies in temp
> directories, my documents, etc, can in general be assumed to have come from a
> some external location and should not initially have fulltrust without the
> user having explicitly granted it by installing the application and/or
> modifying the security policy. Saving an assembly to the local disk should
> not in itself be sufficient IMHO to increase an assemblies trust permission.
>
> For example, say the user is requested by a internet site to download an
> application that unknown to the user scans all of their files for personal
> information and transmits it to some internet site. The internet site knows
> that the application will not have permissions to run in the internet zone so
> they package instruct the user to save as (despite the warnings presented if
> the user can do it he mostlikely will) and run from their computer (where it
> will have fulltrust). Once saved the the users computer it effectivly has
> the same permissions as any other unmanaged application thus nullifying CAS.
> At present the advantages of a tighter security policy have somewhat limited
> reach because the internet site could have requested the user download an
> unmanaged application but a managed application is in genereal much easier to
> develop. However my hope is that in the near future we will have the ability
> to restrict execution of unapproved unmanaged applications. For example
> administrator approves only unmanaged applications located in program files
> and windows folders and the local network share, if we then repeat the above
> scenario with a managed and an unmanaged application the unmanaged
> application would not be able to run but the managed application would have
> full trust and this would be a serious loophole. Of course the CAS policy
> can be changed to have simalar restrictions which is exactly what I'm
> proposing.
>
> My suggestion is that the default security policy should only grant full
> trust only to assemblies located in the Program Files and Windows\... folder
> (systemX or whatever is needed but not windows\temp), all other locations
> should default to Internet Zone permissions rather then FullTrust. I would
> much rather have the permissions of an assembly reduced when the user copies
> an assembly from a network share for example then increased when downloaded
> from the internet.
>
> Thanks,
>
>

31 Mar 2006 10:44 PM

Dinis Cruz

Kurt, I am also totally with you and have been saying (for more that two
years now) that Full Trust is a very bad idea, and that we need to move
into a development environment where it makes business sense to develop
partially trusted applications.

The main problem is that nobody (apart from the odd ones like us) seem
to take this problem seriously. The Clients don't ask for it, the
developers don't want to spend the extra development cost to do it, and
Microsoft doesn't want to admit the problem:

The first thing that I ask Microsoft to do is to say very clearly that:

"Full Trust applications are insecure and potentially very dangerous for
the users running them (or for co-hosted websites), so we now need (as
an industry) to make the effort to develop, deploy and maintain
applications that can be executed in secure partially trusted
environments".

But so far Microsoft (and I have meet and emailed with several key
players in there) still refuses to deal with this issue and prefers to
put the head in the sand and ignore it.

I have to say that I was really disappointed when 2.0 was released
without a major push for Partially trusted development. For example I
was hoping that it would be possible to run by default .Net applications
executed from your local computer in a secure partially trusted
environment. But that didn't happened, and I have to say that apart from
a couple more articles (and good blogs) there isn't much difference
between 1.1 and 2.0 (yeah there are things like transparency and other
bits in there too :).

So, until you see guys from Microsoft in discussions like these, nothing
will begin to change.

But hey, keep making noise, I know that one day (eventually) we will get
there.

Dinis Cruz
Owasp .Net Project
www.owasp.net

Kurt wrote:
Show quoteHide quote

> One thing I noticed in first release of .NET is that programs stored on My
> Computer were granted fulltrust regardless its location effectivly equivelant
> to an unmanaged application. My thought is that assemblies in temp
> directories, my documents, etc, can in general be assumed to have come from a
> some external location and should not initially have fulltrust without the
> user having explicitly granted it by installing the application and/or
> modifying the security policy. Saving an assembly to the local disk should
> not in itself be sufficient IMHO to increase an assemblies trust permission.
>
> For example, say the user is requested by a internet site to download an
> application that unknown to the user scans all of their files for personal
> information and transmits it to some internet site. The internet site knows
> that the application will not have permissions to run in the internet zone so
> they package instruct the user to save as (despite the warnings presented if
> the user can do it he mostlikely will) and run from their computer (where it
> will have fulltrust). Once saved the the users computer it effectivly has
> the same permissions as any other unmanaged application thus nullifying CAS.
> At present the advantages of a tighter security policy have somewhat limited
> reach because the internet site could have requested the user download an
> unmanaged application but a managed application is in genereal much easier to
> develop. However my hope is that in the near future we will have the ability
> to restrict execution of unapproved unmanaged applications. For example
> administrator approves only unmanaged applications located in program files
> and windows folders and the local network share, if we then repeat the above
> scenario with a managed and an unmanaged application the unmanaged
> application would not be able to run but the managed application would have
> full trust and this would be a serious loophole. Of course the CAS policy
> can be changed to have simalar restrictions which is exactly what I'm
> proposing.
>
> My suggestion is that the default security policy should only grant full
> trust only to assemblies located in the Program Files and Windows\... folder
> (systemX or whatever is needed but not windows\temp), all other locations
> should default to Internet Zone permissions rather then FullTrust. I would
> much rather have the permissions of an assembly reduced when the user copies
> an assembly from a network share for example then increased when downloaded
> from the internet.
>
> Thanks,
>
>

4 Apr 2006 5:04 PM

Kurt

I guess it could be worse. They could fulltrust applications to bypass ACLs
and allow malware to modify program files, and change administrator defined
group policy settings, etc...
Whats that? File and Registry Virtualization.
Doh! what a supid idea.
Only affects the current user you say?
Doh! what a supid idea.

- Kurt

Show quoteHide quote

"Dinis Cruz" wrote:

> Kurt, I am also totally with you and have been saying (for more that two
> years now) that Full Trust is a very bad idea, and that we need to move
> into a development environment where it makes business sense to develop
> partially trusted applications.
>
> The main problem is that nobody (apart from the odd ones like us) seem
> to take this problem seriously. The Clients don't ask for it, the
> developers don't want to spend the extra development cost to do it, and
> Microsoft doesn't want to admit the problem:
>
> The first thing that I ask Microsoft to do is to say very clearly that:
>
> "Full Trust applications are insecure and potentially very dangerous for
> the users running them (or for co-hosted websites), so we now need (as
> an industry) to make the effort to develop, deploy and maintain
> applications that can be executed in secure partially trusted
> environments".
>
> But so far Microsoft (and I have meet and emailed with several key
> players in there) still refuses to deal with this issue and prefers to
> put the head in the sand and ignore it.
>
> I have to say that I was really disappointed when 2.0 was released
> without a major push for Partially trusted development. For example I
> was hoping that it would be possible to run by default .Net applications
> executed from your local computer in a secure partially trusted
> environment. But that didn't happened, and I have to say that apart from
> a couple more articles (and good blogs) there isn't much difference
> between 1.1 and 2.0 (yeah there are things like transparency and other
> bits in there too :).
>
> So, until you see guys from Microsoft in discussions like these, nothing
> will begin to change.
>
> But hey, keep making noise, I know that one day (eventually) we will get
> there.
>
> Dinis Cruz
> Owasp .Net Project
> www.owasp.net
>
>
>
>
>
> Kurt wrote:
> > One thing I noticed in first release of .NET is that programs stored on My
> > Computer were granted fulltrust regardless its location effectivly equivelant
> > to an unmanaged application. My thought is that assemblies in temp
> > directories, my documents, etc, can in general be assumed to have come from a
> > some external location and should not initially have fulltrust without the
> > user having explicitly granted it by installing the application and/or
> > modifying the security policy. Saving an assembly to the local disk should
> > not in itself be sufficient IMHO to increase an assemblies trust permission.
> >
> > For example, say the user is requested by a internet site to download an
> > application that unknown to the user scans all of their files for personal
> > information and transmits it to some internet site. The internet site knows
> > that the application will not have permissions to run in the internet zone so
> > they package instruct the user to save as (despite the warnings presented if
> > the user can do it he mostlikely will) and run from their computer (where it
> > will have fulltrust). Once saved the the users computer it effectivly has
> > the same permissions as any other unmanaged application thus nullifying CAS.
> > At present the advantages of a tighter security policy have somewhat limited
> > reach because the internet site could have requested the user download an
> > unmanaged application but a managed application is in genereal much easier to
> > develop. However my hope is that in the near future we will have the ability
> > to restrict execution of unapproved unmanaged applications. For example
> > administrator approves only unmanaged applications located in program files
> > and windows folders and the local network share, if we then repeat the above
> > scenario with a managed and an unmanaged application the unmanaged
> > application would not be able to run but the managed application would have
> > full trust and this would be a serious loophole. Of course the CAS policy
> > can be changed to have simalar restrictions which is exactly what I'm
> > proposing.
> >
> > My suggestion is that the default security policy should only grant full
> > trust only to assemblies located in the Program Files and Windows\... folder
> > (systemX or whatever is needed but not windows\temp), all other locations
> > should default to Internet Zone permissions rather then FullTrust. I would
> > much rather have the permissions of an assembly reduced when the user copies
> > an assembly from a network share for example then increased when downloaded
> > from the internet.
> >
> > Thanks,
> >
> >
>

Thread options