1. Università degli Studi di Trento Trusted Flow for Malware Protection F. Massacci (DIT - University of Trento - www.dit.unitn.it)

2. Università degli Studi di Trento Observation on Trust Boundaries Cheating Husbands and other stories (Fagin et al.) Corporate Network looks like an Harem –Different hierachies of husbands (each with his privileges and precious jewelry) –Bulky Guards at the door –Spies and mail surveilance and censorship –Bedchamber boys Enter Laptops and mobility… –Allow husbands to have sex in the (internet) bazar –And then come back to harem carring malware with them… –They can become zombies controlled from outside… Something clearly wrong here…

3. Università degli Studi di Trento Trusted Flow for Malware Solution: Cut mobility, tighten entrance rule –Not really possible –So we must allow sex in the bazar Solution: Check behavior of husband once inside Option 1: check clothes are untainted –Digitally signed assemblies/software (eg.NET) –Not very good: show clean clothes at the door, use completely dirty dresses (eg latest rootkit, recent IAT attack on.NET by UniTN) Option 2: trusted flow for Malware

4. Università degli Studi di Trento Implementing Trusted Flow for Malware Inoculation of Vaccines into husbands –Injecting trusted flow into important sw once inside –Give husbands obfuscated drinks on wedding day –if vaccine spots keep appearing (trusted flow) fine –else repudiate husband (isolate laptop from network) Unfortunately… –Smart husbands can always reverse engineer software –Can tell original drink from inoculated drink –Can make their own anti-vaccines: give spots even if misbehaving

5. Università degli Studi di Trento Implementing Trusted Flow for Malware 2 Fortunately… –Normal husbands can only buy ready-made (automated) anti- vaccines from the bazar –Smart husbands aren’t many and have better things to do than making anti-vaccines (or having sex in the bazar for that matter) Objective: keep normal husbands from misbehaving –Vaccines should be unique to each husband –Vaccines should require human intervention for removal or bypassing