Live from PDC 2008: A First Look at Windows 7



Introduction to Threat Modeling


Part of my work at Microsoft is ensuring that we get a high quality threat model tool out to the public.  I want to take this post to introduce developers and architects to the idea.  Using the beta version of the SDL Threat Modeling Tool v3 located at https://msdn.microsoft.com/en-us/security/dd206731.aspx, I created the following diagram.  You can do this with any drawing tool, but using the SDL tool is much easier and much faster.  Note that what I am going to discuss might deviate from the official tutorial and introduction articles since this is my own perspective on threat modeling.

Here, a credit card user gives his card to a POS(point of sales) device, which then gives the card number and amount to be deducted to some credit card database system.  The system either deducts that amount and tells POS deduction succeeded or tells POS the deduction failed because the limit has been reached.  Finally, POS produces a receipt.  In between the user and the POS, we have the dotted red line, which is a trust boundary, marking the fact that anything could come from the user side, and our system to the right should take that data with a grain of salt.

What I am describing is not a software system, traditional targets of threat modeling, but a common physical and software system that exists in the real world.  It will demonstrate the idea of threat modeling nevertheless.  Given the system above, what are all possible attacks?  If we have a list, then we can go step by step and check each of the items off the list to prevent all possible attack against the system design.  Note that this is not a claim against 0 vulnerability system.  Vulnerabilities can still exist in the implementation.

An example. The card number going from the user to the POS can have following threats against it.

  • Tampering.  Did the cashier at any point change the number?  How do we verify that the card number handed by the user is the one entered into the system?  Do we require user confirmation?  This is probably not a big threat in the real world since people wouldn't mind if cashier used the wrong number.
  • Information Disclosure.  Can other people read that numbers off the card?  Information disclosure is when the information can be read by an unauthorized party.
  • Denial of Service.  Is there a way for the person to quick swipe his card at a POS 100 times in a row and cause the POS to crash?

If you entered the above system into the SDL Threat Modeling Tool v3, these threat types would automatically be generated by the tool.  All of a sudden, we have covered 3 different types of attacks possible against our card number and POS.  There are of course more, but for the purpose of this post, I've only looked at that small portion of our system.  Using this methodology, we can solve a lot of security risk at design time!


Investment


I bought some citi stock at around $2.7.  Now it's all the way up to $4 in around a week.  Woot!  Now the question is whether Fannie Mae and Freddie Mac would also be good investments.  They were both valued at $60 at one time.  Now they're both down to dollar values.  Yet their functionality/monopoly remains.  Just because people overinvested in the housing market, does that mean in a cooler market, fannie/freddie are only worth 1/60th of their older value?  Anyway, this is certainly not my forte, but intuition tells me they might be good picks.  Let's see what happens a year or two down the line.


Leaving Microsoft


This will be my last technet/msdn blog.  All my future blog posts will be at https://softienerd.blogspot.com/.


Max Int Min Int - a Common Coding Mistake and a Sample Microsoft Interview Question


Write the function atoi, a string to integer converter.
Write the function itoa, an integer to string converter.

These are problems given to a lot of entry level interview candidates at Microsoft.  I want to talk about just one aspect of this type of problem that most people do not get(maybe even the interviewer)!  This subtle yet valid trap actually can happen a lot in real life coding situations.

Depending on how you designed your answer, you might eventually come down to a path where the number you want to eventually return is a negative number, but you are keeping it as a positive integer until the last second, when you either multiply it by -1 or add the positive number to the end of a string with '-' char.  There is a subtle trap here.  What if the number passed in is the maximum negative integer, or rephrased, the minimum int possible.  I'll end the suspense right now, the absolute value of max int is smaller than the absolute value of min int.  Ie Take a signed byte.  The max signed byte value would be 2^7-1, but the min int value would be -2^7.  If you think about it, with 8 binary digits, you can fit 2^8 distinct values in.  So if the positive side contains 2^7-1 numbers, and one more for the 0, the negative side must contain 2^7 numbers.  To illustrate:

00000000 - 0
01111111 - max signed byte, 2^7-1
11111111 - 2's complement -> 00000001
10000000 - 2's complement -> 10000000

 In summary, max int != - min int

 Update: Read an excellent XKCD episode that contained the same concept at https://xkcd.com/571/.


NoScript


On my laptop, I use firefox and an extension called NoScript.  What NoScript does is blocking general javascripts from running.  Apparently, it whitelist itself so that Ads that require javascript on its own website can run.  Not only that, it went further by tampering with another Firefox extention called Adblock Plus so that Adblock Plus would not block NoScript's Ads.  Here is the apology letter sent out to the Mozilla Community by Noscript author.

https://hackademix.net/2009/05/04/dear-adblock-plus-and-noscript-users-dear-mozilla-community/

Anyway, I do recommend this extension if you have firefox.  But go ahead and modify the default whitelist once you install it.


On Windbg and Symbols


Every once a while, a developer(SDE) or a tester(SDET) will find himself needing to look at dump files or debug a process.  Here's what each debugger technology out there will support:

Feature KD NTSD WinDbg Visual Studio .NET
         
Kernel-mode debugging Y N Y N
User-mode debugging   Y Y Y
Unmanaged debugging Y Y Y Y
Managed debugging   Y Y Y
Remote debugging Y Y Y Y
Attach to process Y Y Y Y
Detach from process in Win2K and XP Y Y Y Y
SQL debugging N N N Y

My approach is to learn two debuggers to max my coverage: windbg and visual studio.  Visual Studio's design is so good that you don't have to know anything about debugging to use it.  So I want to talk a little bit regarding windbg, more specifically, troubleshooting its symbol problems.

PDBs are symbol files.  The private variety contains type, local, global, and source line information.  So provided that you have the private variety, how do you use them with a debugger to find out which line of the code you are currently executing?  First, make sure you read the excellent article written by Saikat Sen at https://www.codeproject.com/KB/debug/windbg_part1.aspx.  Instead of describing every step in detail, I will go over how to troubleshoot possible errors encountered regarding symbols.

First thing to try when symbols could not be loaded is to run the .reload command.

If that does not work, you could try to force all modules to reload by doing .reload -f.  But chance of this working is low except in only certain situations.  Instead we want to enable verbose symbol logging by running !sym noisy.  What this does is making the symbol loading portion of windbg spit out more information than normal.

Now, do .reload again.  Now you should see all the places that windbg is check for symbols in and how each attempt went.  If you actually have the symbols, there are two possibilities that could happen.

Possibility #1: symbols and executable/image does not match.  To solve this, either get good symbols or do .symopt+0x40 which forces the usage of the found symbol.  This could give you bad info so keep that in mind.

Possibility #2: windbg doesn't look at the folder location that actually has your symbol.  To fix this, do .sympath to see the symbol paths it's looking at, then do .sympath+ <path to symbol> to add the symbol directory to what's already there.  You can also replace the symbol path by doing .sympath <path to symbol>.

Anyway, that's it for now.  Hopefully I'll post more on this area in the future.


Powershell Tip #1


In Powershell, type $profile.

PS C:\Program Files\Microsoft\AxFuzzer> $profile
C:\Users\mengli\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 

That points to where your profile is stored at.  This is a powershell script that executes upon the start up of any powershell prompt for the current user.  Go ahead and make the file.  In my case, I made a new file at the location by typing this:

new-item $profile -itemtype file -force

Now, open the file and you can put in things like this:
set-executionpolicy unrestricted
. \\meng\shared\powershell\hyperv.ps1
set-executionpolicy remotesigned

Every new powershell prompt that you excute will now have executed the hyperv.ps1 file.  I've placed mine on a network so I can always load the latest copy on all my computers.