Just how more secure is (will be) 10.3 than 10.2?

[Daniel John Debrunner <dj...@apache.org>]

Rick Hillegas wrote on derby-user>

http://mail-archives.apache.org/mod_mbox/db-derby-user/200706.mbox/%3c46648064.6000809@sun.com%3e

> The upcoming release of Derby 10.3 will make networked configurations 
> safer by installing a Java security manager if the user forgets to 
> install one. [snip]. As a result, it will be harder 
> for hackers to corrupt multi-user applications and shared machines.

One item that's missing from the post to the user list and any 
discussion around this issue is how much more secure is 10.3 than 10.2? 
It's worth stepping back and looking at the overall picture. I'd hate 
for 10.3 to be overselling its security.

Assume that the server will boot with a security manager if one is not 
configured regardless of any authentication setting (ie. DERBY-2757 is 
fixed)

Let's take a case of a non-root user is running the network server from 
the command line (don't even want to think about root running it) and an 
unauthenticated network server accepting connections from remote clients.

For actions a remote user can perform, is 10.3 more secure?

File Access:
  - 10.3 probably disallows deleting any file (more secure)
  - 10.3 probably disallows navigating the directory structure (more secure)
  - 10.3 continues to allow a remote user to read or write any file the 
user that started the server has access to. A couple more steps are 
required to read/write any file but not a significant hurdle. The remote 
user probably needs to know the path to any file, but sometimes smart 
guessing can help here. (not much more secure)
  - Significant possibility the remote user could modify the server 
startup script and/or configuration to defeat some or all security.

Cause the JVM to stop:
  - 10.3 more secure, can no longer call System.exit() directly**
  - Is there a way to terminate the network server from a remote host 
though, thus stopping the jvm?

Can shutdown database system - 10.3 not more secure

Can create databases - 10.3 not more secure

Can shutdown database - 10.3 more secure only for SQL authorization 
databases assuming authentication set up for database.

Can encrypt/upgrade existing databases - 10.3 more secure only for SQL 
authorization databases assuming authentication set up for database.

Read/Set system properties:
  - 10.3 more secure than 10.2, remote user should not be able to read 
properties**
  - could a remote user infer a few system properties through having 
read access to any file?

Open arbitrary network connections - 10.3 more secure. Should be no 
ability to open sockets etc**

Other arbitrary java actions limited by security manager - 10.3 more 
secure, all such operations will be prohibited**

** assuming security has not been defeated by the remote user having the 
ability to modify files on the remote system.

Not sure on that basis if I would call 10.3 "safer". If there are N ways 
to break security and less than N is closed, then a system is not more 
secure.
I certainly think that any documentation or discussion should not imply 
in any way that 10.3 out of the box is a secure system. I see the 
security improvements as a journey and future releases may continue to 
break backwards compatibility by closing security holes. Or if that's 
not acceptable then Derby should at provide the ability to easily set up 
a secure system and make clear it's a SDK and not an out of the box 
client/server database.

Dan.

Re: Just how more secure is (will be) 10.3 than 10.2?

[Rick Hillegas <Ri...@Sun.COM>]

> We should rather claim that 10.3 has "more security features" than
> 10.2 and that more of them are enabled by default.
>   
I like this wording. If the word "safer" is going to be misleading, then 
the 10.3 release notes should avoid it.
>   
>> [...snip...]
>>
>>     
>>> I certainly think that any documentation or discussion should not imply 
>>> in any way that 10.3 out of the box is a secure system.
>>>       
I agree.

Thanks to Dan for the analysis of the use-cases addressed (and not 
addressed) by the 10.3 security work. Thanks to John, Bernt, and 
Kristian for the additional feedback.

Regards,
-Rick

Re: Just how more secure is (will be) 10.3 than 10.2?

[Kristian Waagan <Kr...@Sun.COM>]

Bernt M. Johnsen wrote:
>>>>>>>>>>>>> John Embretsen wrote (2007-06-05 10:42:22):
>> Daniel John Debrunner wrote:
>>> Rick Hillegas wrote on derby-user>
>>>
>>> http://mail-archives.apache.org/mod_mbox/db-derby-user/200706.mbox/%3c46648064.6000809@sun.com%3e 
>>>
>>>
>>>> The upcoming release of Derby 10.3 will make networked configurations 
>>>> safer by installing a Java security manager if the user forgets to 
>>>> install one. [snip]. As a result, it will be harder for hackers to 
>>>> corrupt multi-user applications and shared machines.
>>> One item that's missing from the post to the user list and any 
>>> discussion around this issue is how much more secure is 10.3 than 10.2? 
>>> It's worth stepping back and looking at the overall picture. I'd hate 
>>> for 10.3 to be overselling its security.
>> Measuring security is very hard, so I understand why Rick did not include 
>> any such claims in the post to derby-user, but I agree that it seems that 
>> this has not been thought through as much as some of us would have
>> liked.
> 
> Personally, I think that we should not label 10.3 as "more secure"
> than 10.2. The different Derby security features will be completely
> irrelevant in some contexts while they will be cruical for the
> security in other contexts.
> 
> We should rather claim that 10.3 has "more security features" than
> 10.2 and that more of them are enabled by default.

+1 to this kind of wording!
Doesn't really matter if we have "all" security features if they are 
wrongly configured, or not used at all, at the deployment site. The 
user/deployer is still, and will always be I guess, a crucial part of 
the security picture.


-- 
Kristian

> 
>> [...snip...]
>>
>>> I certainly think that any documentation or discussion should not imply 
>>> in any way that 10.3 out of the box is a secure system.
>> +1.
> 
> +1 Definitely.
> 

Re: Just how more secure is (will be) 10.3 than 10.2?

["Bernt M. Johnsen" <Be...@Sun.COM>]

>>>>>>>>>>>> John Embretsen wrote (2007-06-05 10:42:22):
> Daniel John Debrunner wrote:
> >Rick Hillegas wrote on derby-user>
> >
> >http://mail-archives.apache.org/mod_mbox/db-derby-user/200706.mbox/%3c46648064.6000809@sun.com%3e 
> >
> >
> >>The upcoming release of Derby 10.3 will make networked configurations 
> >>safer by installing a Java security manager if the user forgets to 
> >>install one. [snip]. As a result, it will be harder for hackers to 
> >>corrupt multi-user applications and shared machines.
> >
> >One item that's missing from the post to the user list and any 
> >discussion around this issue is how much more secure is 10.3 than 10.2? 
> >It's worth stepping back and looking at the overall picture. I'd hate 
> >for 10.3 to be overselling its security.
> 
> Measuring security is very hard, so I understand why Rick did not include 
> any such claims in the post to derby-user, but I agree that it seems that 
> this has not been thought through as much as some of us would have
> liked.

Personally, I think that we should not label 10.3 as "more secure"
than 10.2. The different Derby security features will be completely
irrelevant in some contexts while they will be cruical for the
security in other contexts.

We should rather claim that 10.3 has "more security features" than
10.2 and that more of them are enabled by default.

> 
> [...snip...]
> 
> >I certainly think that any documentation or discussion should not imply 
> >in any way that 10.3 out of the box is a secure system.
> 
> +1.

+1 Definitely.

-- 
Bernt Marius Johnsen, Database Technology Group, 
Staff Engineer, Technical Lead Derby/Java DB
Sun Microsystems, Trondheim, Norway

Re: Just how more secure is (will be) 10.3 than 10.2?

[John Embretsen <Jo...@Sun.COM>]

Daniel John Debrunner wrote:
> John Embretsen wrote:
>> Daniel John Debrunner wrote:
>> If this reasoning is not valid, would it also be wrong to say that 
>> Derby 10.3 is safer than 10.0?
> 
> I hadn't thought about that much, I don't remember much improvement from 
> 10.0 to 10.2, so I would guess 10.3 is not more secure than 10.0. I'm 
> talking about the situation where a network server is listening on a 
> remote host without authentication and a user neglected to install a 
> security manager. That is some claim that Derby 10.3 is more secure in 
> that situation than before, I'm just doubting that claim. 10.3 can be 
> made to be more secure than 10.0 due to security manager improvements, 
> grant revoke etc, but that's not what the e-mail to the user list is 
> addressing.

The e-mail to the user list claimed that 10.3 was safer because a Security 
Manager would be installed if the user neglected to install one. You listed 
several remote user actions that were more secure because of this. What I was 
trying to say was that my interpretation of that list is that 10.3 is (somewhat) 
more secure (out of the box), because an adversary will have fewer good options 
to try when attacking.

>> Would it be wrong to say that using encryption is safer than not using 
>> encryption at all?
> 
> Depends on where the key is stored. If it's a fixed key (e.g. in an 
> application) or the key is easy to find then encryption is no more secure.

The attacker still has to jump through an extra hoop or two in order to find the 
key (of course, it depends on how easy it is to find it) or crack the 
encryption, which means that the probability of a successful attack has been 
reduced (for example, a lazy attacker might rather move on to some other easily 
accessible target). I'd call that (slightly) more secure.

>> For example, I know that the encryption in my home Wi-Fi network can 
>> be cracked, but I still regard the system as safer (more secure) than 
>> my neighbor's unencrypted Wi-Fi network.
> 
> And so would I, unless I could easily connect into your encrypted 
> network without knowing the password or encryption key and change its 
> configuration to no longer be secure. (Which is what 10.3 continues to 
> allow).
> 
> The wi-fi networks are a interesting comparison. Their mode out of the 
> box is insecure and allowing remote access. Derby's network server is 
> insecure but disallowing remote access.

Yes, it's comforting to know that we could always do worse ;)


-- 
John

Re: Just how more secure is (will be) 10.3 than 10.2?

[Daniel John Debrunner <dj...@apache.org>]

John Embretsen wrote:
> Daniel John Debrunner wrote:

>> Not sure on that basis if I would call 10.3 "safer". If there are N 
>> ways to break security and less than N is closed, then a system is not 
>> more secure.
> 
> I tend to disagree. There will _always_ be security holes in systems 
> such as Derby. Does that mean that we can never use the terms "more 
> secure" or "safer"? Of course, there are no guarantees, but hopefully we 
> are closing more (at least more severe) security holes than we are 
> introducing with this release. I would define this as being "more 
> secure" and "safer", though not "secure" nor "safe".

I think there's the problem, what security holes are being closed and 
which are being opened. Is there a positive net change that would make 
anyone (more?) comfortable running an unauthenticated server on their 
own machine?

> If this reasoning is not valid, would it also be wrong to say that Derby 
> 10.3 is safer than 10.0?

I hadn't thought about that much, I don't remember much improvement from 
10.0 to 10.2, so I would guess 10.3 is not more secure than 10.0. I'm 
talking about the situation where a network server is listening on a 
remote host without authentication and a user neglected to install a 
security manager. That is some claim that Derby 10.3 is more secure in 
that situation than before, I'm just doubting that claim. 10.3 can be 
made to be more secure than 10.0 due to security manager improvements, 
grant revoke etc, but that's not what the e-mail to the user list is 
addressing.

> Would it be wrong to say that using encryption is safer than not using 
> encryption at all?

Depends on where the key is stored. If it's a fixed key (e.g. in an 
application) or the key is easy to find then encryption is no more secure.

> For example, I know that the encryption in my home Wi-Fi network can be 
> cracked, but I still regard the system as safer (more secure) than my 
> neighbor's unencrypted Wi-Fi network.

And so would I, unless I could easily connect into your encrypted 
network without knowing the password or encryption key and change its 
configuration to no longer be secure. (Which is what 10.3 continues to 
allow).

The wi-fi networks are a interesting comparison. Their mode out of the 
box is insecure and allowing remote access. Derby's network server is 
insecure but disallowing remote access.

Dan.

Re: Just how more secure is (will be) 10.3 than 10.2?

[John Embretsen <Jo...@Sun.COM>]

Daniel John Debrunner wrote:
> Rick Hillegas wrote on derby-user>
> 
> http://mail-archives.apache.org/mod_mbox/db-derby-user/200706.mbox/%3c46648064.6000809@sun.com%3e 
> 
> 
>> The upcoming release of Derby 10.3 will make networked configurations 
>> safer by installing a Java security manager if the user forgets to 
>> install one. [snip]. As a result, it will be harder for hackers to 
>> corrupt multi-user applications and shared machines.
> 
> One item that's missing from the post to the user list and any 
> discussion around this issue is how much more secure is 10.3 than 10.2? 
> It's worth stepping back and looking at the overall picture. I'd hate 
> for 10.3 to be overselling its security.

Measuring security is very hard, so I understand why Rick did not include any 
such claims in the post to derby-user, but I agree that it seems that this has 
not been thought through as much as some of us would have liked.

[snip various actions that may be "more secure" in 10.3 than 10.2]

> Not sure on that basis if I would call 10.3 "safer". If there are N ways 
> to break security and less than N is closed, then a system is not more 
> secure.

I tend to disagree. There will _always_ be security holes in systems such as 
Derby. Does that mean that we can never use the terms "more secure" or "safer"? 
Of course, there are no guarantees, but hopefully we are closing more (at least 
more severe) security holes than we are introducing with this release. I would 
define this as being "more secure" and "safer", though not "secure" nor "safe".

If this reasoning is not valid, would it also be wrong to say that Derby 10.3 is 
safer than 10.0?
Would it be wrong to say that using encryption is safer than not using 
encryption at all?
For example, I know that the encryption in my home Wi-Fi network can be cracked, 
but I still regard the system as safer (more secure) than my neighbor's 
unencrypted Wi-Fi network.

> I certainly think that any documentation or discussion should not imply 
> in any way that 10.3 out of the box is a secure system.

+1.


-- 
John