Measuring the attack surfaces of two FTP daemons

ABSTRACT

Software consumers often need to choose between different software that provide the same functionality. Today, security is a quality that many consumers, especially system administrators, care about and will use in choosing one soft- ware system over another. An attack surface metric is a security metric for comparing the relative security of similar software systems [7]. The measure of a system's attack surface is an indicator of the system's security: given two systems, we compare their attack surface measurements to decide whether one is more secure than another along each of the following three dimensions: methods, channels, and data. In this paper, we use the attack surface metric to measure the attack surfaces of two open source FTP daemons: ProFTPD 1.2.10 and Wu-FTPD 2.6.2. Our measurements show that ProFTPD is more secure along the method dimension, ProFTPD is as secure as Wu-FTPD along the channel dimension, and Wu-FTPD is more secure along the data dimension. We also demonstrate how software consumers can use the attack surface metric in making a choice between the two FTP daemons.

REFERENCES

• 1: CERT. Cert advisories. http://www.cert.org/.
• 2: GNU cflow. http://www.gnu.org/software/cflow.
• 3: Dan DaCosta , Christopher Dahn , Spiros Mancoridis , Vassilis Prevelakis, Characterizing the 'Security Vulnerability Likelihood' of Software Functions, Proceedings of the International Conference on Software Maintenance, p.266, September 22-26, 2003
• 4: M. Howard. Fending off future attacks by reducing attack surface. http://msdn.microsoft.com/library/default.asp url=/library/enus/dncode%/html/secure02132003.asp, 2003.
• 5: M. Howard, J. Pincus, and J.M. Wing. Measuring relative attack surfaces,. In Proc. of Workshop on Advanced Developments in Software and Systems Security, 2003.
• 6: P. Manadhata and J. M. Wing. Measuring a system's attack surface. In Technical Report CMU-CS-04-102, 2004.
• 7: P. Manadhata and J. M. Wing. An attack surface metric. In Technical Report CMU-CS-05-155, 2005.
• 8: MITRE. Common vulnerabilities and exposures. http://cve.mitre.org/.
• 9: The ProFTPD Project. http://www.proftpd.org/.
• 10: The ProFTPD Project. Project goals. http://www.proftpd.org/goals.html.
• 11: SecurityFocus. Securityfocus vulnerabilities. http://www.securityfocus.com/vulnerabilities.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.8 Metrics

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection

General Terms:
Security

Keywords:
attack surface, attack surface metric, security metric