Windows Access Control Demystified

Short Description
We have constructed a logical model of Windows XP access control, … on a typical Windows installation managed by a careful systems administrator, we find …

Website: www.cs.princeton.edu | Filesize: 228kb

Content
Windows Access Control Demystied
Sudhakar Govindavajhala and Andrew W. Appel
Princeton University
fsudhakar,appelg@cs.princeton.edu
January 31, 2006
Abstract
In the Secure Internet Programming laboratory at Princeton University, we have been investigating
network security management by using logic programming. We developed a rule based framework .
Multihost, Multistage, Vulnerability Analysis(MulVAL) . to perform end-to-end, automatic analysis
of multi-host, multi-stage attacks on a large network where hosts run different operating systems. The
tool nds attack paths where the adversary will have to use one or more than one weaknesses (buffer
overows) in multiple software to attack the network. The MulVAL framework has been demonstrated
to be modular, exible, scalable and efcient [20]. We applied these techniques to perform security
analysis of a single host with commonly used software.
We have constructed a logical model of Windows XP access control, in a declarative but executable
(Datalog) format. We have built a scanner that reads access-control conguration information from the
Windows registry, le system, and service control manager database, and feeds raw conguration data
to…