119:
189:
address this by prompting the user in cases where one program starts another which then accesses the network. However, the user frequently does not have sufficient information to determine whether such an access is legitimate—false positives are common, and there is a substantial risk that even sophisticated users will become habituated to clicking "OK" to these prompts.
99:
user, but does not know whether the user had permission to write the file. When the program opens the file, the system uses the program's permission, not the user's. When the file name was passed from the user to the program, the permission did not go along with it; the permission was increased by the system silently and automatically.
211:
It requires the client to trust the server to not abuse the borrowed permissions. Note that intersecting the server and client's permissions does not solve the problem either, because the server may then have to be given very wide permissions (all of the time, rather than those needed for a given
98:
Whenever a program tries to access a file, the operating system needs to know two things: which file the program is asking for, and whether the program has permission to access the file. In the example, the file is designated by its name, “(SYSX)BILL”. The program receives the file name from the
188:
software. It can restrict
Internet access for specific applications. Some applications circumvent this by starting a browser with instructions to access a specific URL. The browser has authority to open a network connection, even though the application does not. Firewall software can attempt to
192:
Not every program that misuses authority is a confused deputy. Sometimes misuse of authority is simply a result of a program error. The confused deputy problem occurs when the designation of an object is passed from one program to another, and the associated permission changes unintentionally,
227:, rather than the name of the file. Since it lacks a capability to the billing file, it cannot designate that file for output. In the cross-site request forgery example, a URL supplied "cross"-site would include its own authority independent of that of the client of the web browser.
85:
to open (SYSX)BILL. Even though the user did not have access to that file, the compiler did, so the open succeeded. The compiler wrote the compilation output to the file (here "(SYSX)BILL") as normal, overwriting it, and the billing information was destroyed.
156:(XSS) to turn the browser's authenticated MySpace session into a confused deputy. Using XSS the worm forced the browser into posting an executable copy of the worm as a MySpace message which was then viewed and executed by friends of the infected user.
73:
The compiler also collected statistics about language feature usage. Those statistics were stored in a file called "(SYSX)STAT", in the directory "SYSX". To make this possible, the compiler program was given permission to write to files in SYSX.
162:
is an attack where the user acts as the confused deputy. In this attack a user thinks they are harmlessly browsing a website (an attacker-controlled website) but they are in fact tricked into performing sensitive actions on another website.
69:
service. Users could run the compiler and optionally specify a filename where it would write debugging output, and the compiler would be able to write to that file if the user had permission to write there.
77:
But there were other files in SYSX: in particular, the system's billing information was stored in a file "(SYSX)BILL". A user ran the compiler and named "(SYSX)BILL" as the desired debugging output file.
94:
In this example, the compiler program is the deputy because it is acting at the request of the user. The program is seen as 'confused' because it was tricked into overwriting the system's billing file.
137:
to perform sensitive actions against a web application. A common form of this attack occurs when a web application uses a cookie to authenticate all requests transmitted by a browser. Using
264:"PaddyFrog: systematically detecting confused deputy vulnerability in Android applications: PaddyFrog: systematically detecting confused deputy vulnerability in Android applications"
216:
The simplest way to solve the confused deputy problem is to bundle together the designation of an object and the permission to access that object. This is exactly what a
208:
It becomes more difficult to identify the correct permission if the server is in turn the client of another service and wants to pass along access to the file.
437:
201:
In some systems it is possible to ask the operating system to open a file using the permissions of another client. This solution has some drawbacks:
31:
that is tricked by another program (with fewer privileges or less rights) into misusing its authority on the system. It is a specific type of
102:
It is not essential to the attack that the billing file be designated by a name represented as a string. The essential points are that:
430:
389:
311:
223:
Using capability security in the compiler example, the client would pass to the server a capability to the output file, such as a
193:
without any explicit action by either party. It is insidious because neither party did anything explicit to change the authority.
423:
205:
It requires explicit attention to security by the server. A naive or careless server might not take this extra step.
581:
171:
629:
461:
497:
709:
534:
482:
130:
118:
571:
521:
492:
46:
40:
619:
561:
487:
446:
217:
606:
153:
149:
32:
20:
8:
502:
50:
106:
the designator for the file does not carry the full authority needed to access the file;
688:
552:
315:
263:
472:
242:
185:
167:
383:
517:
395:
275:
82:
28:
529:
477:
262:
Wu, Jianliang; Cui, Tingting; Ban, Tao; Guo, Shanqing; Cui, Lizhen (2015-09-10).
224:
409:
336:
683:
590:
377:
703:
678:
415:
293:
81:
This produced a confused deputy problem. The compiler made a request to the
673:
668:
614:
159:
66:
374:, ACM SIGOPS Operating Systems Review, Volume 22, Issue 4 (October 1988).
639:
354:
134:
123:
647:
596:
138:
586:
404:
Capability Theory Notes from several sources (collated by Norm Hardy)
279:
174:
312:"The Confused Deputy (or why capabilities might have been invented)"
566:
372:
The
Confused Deputy: (or why capabilities might have been invented)
109:
the program's own permission to access the file is used implicitly.
62:
141:, an attacker can force a browser into transmitting authenticated
507:
403:
556:
548:
544:
539:
236:
133:(CSRF) is an example of a confused deputy attack that uses the
353:
Alfred
Spiessens: Patterns of Safe Collaboration, PhD thesis.
177:
to which the attacker's machine has no access, using a remote
624:
576:
663:
142:
61:
In the original example of a confused deputy, there was a
178:
390:
Document text on
University of Pennsylvania's website
49:
protect against the confused deputy problem, whereas
701:
337:"clickjacking: The Confused Deputy rides again!"
212:request) in order to act for arbitrary clients.
170:can allow an attacker to connect indirectly to
445:
431:
261:
438:
424:
117:
702:
355:http://www.evoluware.eu/fsp_thesis.pdf
89:
419:
384:Document text on Norm Hardy's website
39:is often cited as an example of why
268:Security and Communication Networks
13:
14:
721:
364:
113:
65:program provided on a commercial
412:(some introductory level text).
181:server as the confused deputy.
16:Computer security vulnerability
347:
329:
304:
286:
255:
1:
248:
122:Prototypical confused deputy
462:Principle of least privilege
410:Everything2: Confused Deputy
196:
7:
498:Capability-based addressing
230:
184:Another example relates to
10:
726:
131:cross-site request forgery
56:
656:
638:
605:
516:
493:Capability-based security
454:
41:capability-based security
396:Citeseer cross reference
488:Object-capability model
468:Confused deputy problem
53:–based systems do not.
37:confused deputy problem
378:ACM published document
126:
607:Programming languages
121:
657:Specialised hardware
154:cross-site scripting
33:privilege escalation
21:information security
239:executables in Unix
90:The confused deputy
51:access-control list
689:Plessey System 250
150:Samy computer worm
127:
47:Capability systems
710:Computer security
697:
696:
518:Operating systems
473:Ambient authority
447:Object-capability
274:(13): 2338–2349.
243:Ambient authority
186:personal firewall
168:FTP bounce attack
717:
503:Zooko's triangle
440:
433:
426:
417:
416:
358:
351:
345:
344:
333:
327:
326:
324:
323:
314:. Archived from
308:
302:
301:
290:
284:
283:
280:10.1002/sec.1179
259:
83:operating system
29:computer program
725:
724:
720:
719:
718:
716:
715:
714:
700:
699:
698:
693:
652:
634:
601:
512:
478:File descriptor
450:
444:
367:
362:
361:
352:
348:
341:sourceforge.net
335:
334:
330:
321:
319:
310:
309:
305:
298:sourceforge.net
292:
291:
287:
260:
256:
251:
233:
225:file descriptor
199:
116:
92:
59:
25:confused deputy
17:
12:
11:
5:
723:
713:
712:
695:
694:
692:
691:
686:
684:Intel iAPX 432
681:
676:
671:
666:
660:
658:
654:
653:
651:
650:
644:
642:
636:
635:
633:
632:
627:
622:
617:
611:
609:
603:
602:
600:
599:
594:
591:HarmonyOS NEXT
584:
579:
574:
569:
564:
559:
542:
537:
532:
526:
524:
514:
513:
511:
510:
505:
500:
495:
490:
485:
480:
475:
470:
465:
458:
456:
452:
451:
443:
442:
435:
428:
420:
414:
413:
407:
401:
400:
399:
393:
387:
381:
370:Norman Hardy,
366:
365:External links
363:
360:
359:
346:
328:
303:
285:
253:
252:
250:
247:
246:
245:
240:
232:
229:
214:
213:
209:
206:
198:
195:
115:
114:Other examples
112:
111:
110:
107:
91:
88:
58:
55:
43:is important.
15:
9:
6:
4:
3:
2:
722:
711:
708:
707:
705:
690:
687:
685:
682:
680:
679:IBM System/38
677:
675:
672:
670:
669:Cambridge CAP
667:
665:
662:
661:
659:
655:
649:
646:
645:
643:
641:
637:
631:
628:
626:
623:
621:
618:
616:
613:
612:
610:
608:
604:
598:
595:
592:
588:
585:
583:
580:
578:
575:
573:
570:
568:
565:
563:
560:
558:
554:
550:
546:
543:
541:
538:
536:
533:
531:
528:
527:
525:
523:
519:
515:
509:
506:
504:
501:
499:
496:
494:
491:
489:
486:
484:
481:
479:
476:
474:
471:
469:
466:
463:
460:
459:
457:
453:
448:
441:
436:
434:
429:
427:
422:
421:
418:
411:
408:
405:
402:
397:
394:
391:
388:
385:
382:
379:
376:
375:
373:
369:
368:
357:Section 8.1.5
356:
350:
342:
338:
332:
318:on 2003-12-05
317:
313:
307:
299:
295:
289:
281:
277:
273:
269:
265:
258:
254:
244:
241:
238:
235:
234:
228:
226:
221:
219:
210:
207:
204:
203:
202:
194:
190:
187:
182:
180:
176:
173:
169:
164:
161:
157:
155:
151:
146:
144:
140:
136:
132:
125:
120:
108:
105:
104:
103:
100:
96:
87:
84:
79:
75:
71:
68:
64:
54:
52:
48:
44:
42:
38:
34:
30:
26:
22:
640:File systems
467:
371:
349:
340:
331:
320:. Retrieved
316:the original
306:
297:
294:"ACLs don't"
288:
271:
267:
257:
222:
215:
200:
191:
183:
165:
160:Clickjacking
158:
147:
128:
101:
97:
93:
80:
76:
72:
60:
45:
36:
24:
18:
135:web browser
124:Barney Fife
67:timesharing
648:Tahoe-LAFS
597:Phantom OS
322:2003-12-31
249:References
218:capability
145:requests.
139:JavaScript
587:HarmonyOS
197:Solutions
704:Category
567:iMAX 432
530:Capsicum
508:Petnames
455:Concepts
449:security
231:See also
63:compiler
535:Fuchsia
522:kernels
57:Example
615:Cajita
572:Midori
557:CapROS
549:KeyKOS
545:GNOSIS
540:Genode
483:C-list
464:(PoLP)
237:Setuid
35:. The
630:Joule
625:Joe-E
577:NLTSS
562:Hydra
175:ports
152:used
27:is a
674:Flex
664:BiiN
582:seL4
553:EROS
220:is.
148:The
143:HTTP
23:, a
276:doi
179:FTP
172:TCP
166:An
19:In
706::
555:→
551:→
547:→
520:,
339:.
296:.
270:.
266:.
129:A
620:E
593:)
589:(
439:e
432:t
425:v
406:.
398:.
392:.
386:.
380:.
343:.
325:.
300:.
282:.
278::
272:8
Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.
