OSNews

jack_perry,
"Fair enough. How does any OS defend against such an attack?"

Neolander,
"By only letting applications access their own folder and files explicitly pointed out by the user."

A user should not have to trust an app in order to run it. Untrusted apps should be allowed to run, but remain individually sandboxed. This way a user could in fact download and run untrusted software without compromising anything else on the system. I don't know of any OS which does this effectively. Java Web Start gets very close, it's a shame Sun never got much traction with it.

Obviously it's extremely difficult to implement sandboxing mid-game. Once we have a huge base of legitimate software which sets the precedent of requiring full access in order to run at all, the user is trained to routinely give app's escalated privileges. This means the security provided by the sandboxing becomes ineffective - ms vista is a good example of this.

Android runs each application inside its own chroot environment. Although whether that has made Android any more secure or not is very debatable. Recent reports from security research firms have suggested that Android is the second biggest vector of mobile malware now. Second only to Symbian. And that it is rapidly catching up to become the biggest vector of mobile malware. So it doesn't look like Android's security model actually works.

Do people actually read and understand the capability list of applications on Android ? If so, the security model is indeed to blame. If not, it's more of a user interface problem.

Edited 2011-06-25 20:05 UTC

I don't see how this is a solution. A trojan that can convince a user to install it, can also convince a user to grant it access to all files in a Documents directory. Never mind the hassle to the user who's trying to run serious programs.

Neolander,
"By only letting applications access their own folder and files explicitly pointed out by the user."

jack_perry,
"I don't see how this is a solution. A trojan that can convince a user to install it, can also convince a user to grant it access to all files in a Documents directory. Never mind the hassle to the user who's trying to run serious programs."

Imagine a new OS which doesn't have to inherit legacy software. A user can download, install, and run any application in a sandbox by default. The sandbox could access files opened explicitly through drag and drop or an open dialog box, as well as files created itself.

By far an large, legitimate applications (games/editors) will be able to run in the sandbox without any privilege escalation.

If an app turns out to be malicious, it's damage would be very limited in scope because of the sandbox.

If a game is downloaded from P2P network and requests higher privileges (let's say to access email), one could be fairly confident that it is malware.

I think you'd be surprised by how much desktop applications would be fine with no more access to your home or document folder than its own files and the files which you explicitly direct it to (through a system open file dialog, drag and drop or a CLI parameter). Most software is not dangerous by its very nature.

About six months ago, while I was using Windows as my primary OS, I've done the following exercise : opening the "Add and remove software" dialog of my Windows install, and finding out what security permissions each entry would need, given a redesign for a sandboxed OS. As it turns out, few entries actually needed disk access to more than their private folder and user-picked files at a conceptual level. These were...
-Adobe Flash Player, because it copies itself in web browsers' private folders (and as such alters your web browsing experience).
-AVG 2011, because current antivirus want to take over your entire system in the same way as malware.
-System updates.
-Driver software for my phone.

Would you agree that all of these are sufficiently dangerous to reasonably require a security warning and a double check that they come from a reliable source ?

Now imagine that the huge majority of applications which do not require a warning get installed very quickly, without hassle. Only when you install a truly dangerous piece of software do you get a warning. This way, you get a much improved user experience for everyday use and a much stronger user awareness and cooperation when some installation actually involves dangerous software. Add up a security warning dialog that is actually informative (unlike Windows UAC and its OSX equivalent), as permitted by the sandboxed model, and you get much stronger security than what we have now.

Edited 2011-06-26 05:55 UTC