Squatting attack (original) (raw)
Squatting attack, in computer science, is a kind of DoS attack where a program interferes with another program through the use of shared synchronization objects in an unwanted or unexpected way. That attack is known in the Microsoft Windows operating system, which offers named objects as an interprocess synchronization mechanism. With named objects, a process may open a synchronization object as a shared resource by just specifying a name. Subsequent processes may use the same name to open that resource and have a way to synchronize with the first process. The squatting attack is possible because, if the legitimate program does not enforce tight security rules for the resources, processes from arbitrary security contexts may gain access to them and ultimately take control of the system.
| Property | Value |
|---|---|
| dbo:abstract | Squatting attack, in computer science, is a kind of DoS attack where a program interferes with another program through the use of shared synchronization objects in an unwanted or unexpected way. That attack is known in the Microsoft Windows operating system, which offers named objects as an interprocess synchronization mechanism. With named objects, a process may open a synchronization object as a shared resource by just specifying a name. Subsequent processes may use the same name to open that resource and have a way to synchronize with the first process. The squatting attack is possible because, if the legitimate program does not enforce tight security rules for the resources, processes from arbitrary security contexts may gain access to them and ultimately take control of the system. Consider, for example, antivirus software installed on a Microsoft Windows machine. The solution has two pieces: a service, which monitors and scans every file when it is opened, and a manual scanner, which scans the file system when a user requests it. Under normal conditions the service should scan the system occasionally. However, if a user requests a manual scan, the service must stop temporarily to let the manual scanner work, otherwise every file would be scanned twice: by the manual scanner and by the service. To solve this problem the vendor chooses to implement an event based synchronization mechanism, where the service keeps a named event opened and checks it whenever a file is opened. If the event is unset the file is scanned, otherwise it is ignored. The manual scanner, then, to operate, opens the named event, sets it before scanning (disabling the service), scans the file system and resets the event back when finished. This design is prone to a squatting attack because a malicious program can set the named event and disable the service completely. (en) |
| dbo:wikiPageExternalLink | http://msdn2.microsoft.com/en-us/library/ms684292.aspx http://blogs.technet.com/markrussinovich/archive/2007/02/12/638372.aspx |
| dbo:wikiPageID | 11238435 (xsd:integer) |
| dbo:wikiPageLength | 3112 (xsd:nonNegativeInteger) |
| dbo:wikiPageRevisionID | 1040084198 (xsd:integer) |
| dbo:wikiPageWikiLink | dbr:Denial-of-service_attack dbr:Antivirus_software dbr:Computer_program dbr:Computer_science dbr:Synchronization_(computer_science) dbc:Concurrency_control dbc:Denial-of-service_attacks dbr:File_system dbr:Microsoft_Developer_Network dbr:Microsoft_Windows dbr:Windows_service |
| dbp:wikiPageUsesTemplate | dbt:Cite_web |
| dcterms:subject | dbc:Concurrency_control dbc:Denial-of-service_attacks |
| gold:hypernym | dbr:Kind |
| rdf:type | yago:Abstraction100002137 yago:Act100030358 yago:Activity100407535 yago:Attack100972621 yago:Event100029378 yago:Operation100955060 yago:PsychologicalFeature100023100 yago:YagoPermanentlyLocatedEntity yago:WikicatDenial-of-serviceAttacks |
| rdfs:comment | Squatting attack, in computer science, is a kind of DoS attack where a program interferes with another program through the use of shared synchronization objects in an unwanted or unexpected way. That attack is known in the Microsoft Windows operating system, which offers named objects as an interprocess synchronization mechanism. With named objects, a process may open a synchronization object as a shared resource by just specifying a name. Subsequent processes may use the same name to open that resource and have a way to synchronize with the first process. The squatting attack is possible because, if the legitimate program does not enforce tight security rules for the resources, processes from arbitrary security contexts may gain access to them and ultimately take control of the system. (en) |
| rdfs:label | Squatting attack (en) |
| owl:sameAs | freebase:Squatting attack yago-res:Squatting attack wikidata:Squatting attack https://global.dbpedia.org/id/4vT19 |
| prov:wasDerivedFrom | wikipedia-en:Squatting_attack?oldid=1040084198&ns=0 |
| foaf:isPrimaryTopicOf | wikipedia-en:Squatting_attack |
| is dbo:wikiPageDisambiguates of | dbr:Squat |
| is dbo:wikiPageWikiLink of | dbr:Squat dbr:Mandatory_Integrity_Control |
| is foaf:primaryTopic of | wikipedia-en:Squatting_attack |