Lecture 8: Operating System Security

Comprehensive vocabulary flashcards covering operating system security, VPN architectures, user identifiers, access controls, process and memory protection, buffer overflows, and patch management.

Virtual Private Network (VPN)

A technology that establishes a secure, encrypted connection through a public network (such as the Internet), allowing users to remotely access private network resources while protecting data confidentiality and integrity.

IPSec VPN

A type of VPN that uses the IPSec protocol for encryption and authentication; it is primarily suitable for site-to-site connections between two or more private networks, such as enterprise branches and data centers.

SSL/TLS VPN

A protocol-based VPN that uses SSL/TLS encryption to provide an encrypted tunnel between a user's device and a private network; it is widely used for remote access scenarios such as mobile office work.

Operating System Security

The measures and mechanisms implemented to protect an operating system from threats, vulnerabilities, and unauthorized access, ensuring the confidentiality, integrity, and availability of the system and its resources.

Spectre Attack

A fundamental hardware vulnerability discovered in 2018 affecting modern CPUs that tricks a program into accessing arbitrary memory locations by exploiting speculative execution.

Speculative Execution

An optimization technique where a CPU guesses the path of a conditional branch and executes future instructions ahead of time, discarding the work if the guess turns out to be wrong.

Gadget (Spectre Attack)

A specific sequence of instructions that an attacker trains the CPU to speculatively execute, causing it to read secret data (such as passwords or keys) from a protected memory area into the CPU cache.

Discretionary Access Control

An access control model where the owner of a resource decides who is allowed access to that resource at their own discretion.

Mandatory Access Control

An access control model where a system-wide central policy decrees who is permitted access to resources, rather than individual resource owners.

User Identifier (UID)

A unique numerical value assigned to a user in an operating system to identify them and manage their access rights to system resources.

Group ID (GID)

A unique numerical value assigned to a group of users to manage group-based permissions and resource access.

Effective UID (EUID)

The user identifier used by the operating system kernel to determine access rights and privileges for an active process.

Real UID (RUID)

The user identifier that represents the specific user who originally started the process.

Saved UID (SUID)

A stored user identifier that allows a running process to switch back to a privileged UID after it has temporarily dropped elevated privileges.

Security Identifier (SID)

A unique alphanumeric string assigned to users, groups, and processes in Windows operating systems for access control instead of a numerical UID.

Root User (UID 0)

The superuser account in Linux/Unix operating systems, assigned a UID of 0, which possesses unrestricted access to all system files, resources, and commands.

System Users (UID 1-999)

User accounts reserved in Linux/Unix systems for background services and daemons, such as www-data for web servers like Apache and Nginx.

Nobody (UID 65534)

A special user account in Linux/Unix systems with minimal privileges, often used for running untrusted or restricted processes.

File System Security

The mechanisms, permissions, and technical controls used to protect files and directories from unauthorized access, modification, corruption, or loss.

File Permissions (r, w, x)

Access rights assigned to files and directories categorized as Read (r) for viewing, Write (w) for modifying/deleting, and Execute (x) for running a file or accessing a directory.

File Integrity Checking

The practice of using specialized software tools (such as Tripwire or AIDE) to detect unauthorized changes by comparing current file states against a known baseline.

Process Isolation

A memory protection mechanism where each process executes inside its own dedicated virtual address space, preventing it from corrupting or reading the memory of other processes.

Kernel Mode

A privileged CPU execution mode reserved for the operating system core, providing unrestricted access to system memory and hardware.

User Mode

A restricted CPU execution mode in which normal application processes execute with limited privileges to prevent direct hardware access and kernel disruption.

Buffer Overflow

A software vulnerability where a program writes more data into a fixed-size block of memory than it can hold, causing data to overwrite adjacent memory addresses.

Segmentation Fault

An operating system error message generated when a program attempts to access a memory location that memory protection hardware or permissions deny access to.

Bus Error

An error message indicating that a process attempted to access a memory address that does not physically exist or violates hardware alignment constraints.

Morris Worm (1988)

One of the earliest computer worms that exploited a buffer overflow vulnerability, specifically targeting the Unix finger daemon.

Code Red (2001)

A computer worm that exploited a buffer overflow in Microsoft IIS web servers using repeated strings of the letter 'N' to execute arbitrary code.

Heartbleed (2014)

A severe buffer over-read vulnerability in OpenSSL that allowed attackers to read unauthorized private memory data from remote servers.

Address-Space Layout Randomization (ASLR)

A memory protection mechanism that randomizes the memory locations of program execution areas, making buffer overflow exploit targets unpredictable.

Patch Management

The systematic process of identifying, acquiring, testing, and deploying updates (patches) to software and operating systems to resolve vulnerabilities and bugs.