Race Conditions vs. Time of Check vs. Time of Use (TOCTOU) Attacks

Race Conditions vs. Time of Check vs. Time of Use (TOCTOU) Attacks

A race condition may exist when the output of a specific architecture is dependent on the timing of certain uncontrollable events, but somehow those events are not done in the proper sequence.

In other words, in a system, there may be a need to do operations in a specific sequence, but the system somehow performs two operations at the same time.

If there are multiple threads of execution occurring at the same time, but when the proper sequence of those events needs to be done properly, a TOCTOU attack may become possible.

An example of a TOCTOU attack may be when there are changes between the moment security credential information is checked and when those credentials are actually used. The granting of privileges may be dependent on the timing of events that takes place in a multitasking operating system.

Our example involves the use of two processes and two files. Process 1 is used to validate the credentials of a user to allow | the user to open file A, and process 2 is used to call and access the file once process 1 authorizes the user access.

If an attacker can manage to redirect process 2 to open a secure file, such as a payroll file, after process 1 authorizes the user access but before process 2 executes the handed off request to retrieve and access the non-secure file called file A, then this would be an example of possibly a TOCTOU attack.

Flaws in the programming code of the operating system are what can allow this kind of attack to take place. To avoid TOCTOU attacks, the operating system should use the concept of software locking. Software locking applies a lock, or a blocking mechanism, to the file or resource being accessed by the process.

This enables the operating system to ensure that the file cannot be substituted out for another file through the process of access validation, thus ensuring that only the file initially requested by the process will be accessed by the user as the process completes.

A race condition occurs when two processes need to carry out their tasks against one resource. The processes, however, need to execute in the correct order, process 1 first, process 2 second.

If that order can be disrupted by an attacker, then the attacker can manipulate the output of the results of the combined action of the two processes and potentially create a different outcome than the one intended. This would be a race condition.

Here is a good example. Let's say the operating system were to allow the security functions for authentication and authorization to be handled by two different processes.

The outcome may be perfectly normal and acceptable almost all of the time, meaning that when a user attempts to log into a system, the user is first authenticated and then authorized to access system resources as required based on the permissions that the user has.

However, let's say an attacker was able to force the authorization process to execute before the authentication process.

The outcome may be that the user is granted access to resources in the system without authentication of their identity taking place.

To protect against a race condition attack from taking place within a system, the security professional needs to ensure that the architecture and design of the operating system and the programs that run on top of it are not allowing critical tasks to be split up for execution.

To ensure this does not happen, the use of atomic operations needs to be enforced within the system. The difference between race conditions and TOCTOU attacks is subtle but important for the security professional to understand. A race condition implies that two processes will be forced to execute out of sequence, allowing the attacker to control or manipulate the outcome. While a TOCTOU attack may happen as a result of the attacker inserting themselves in between two processes as they are executing, causing a redirection of the second process in some way to control or manipulate the outcome.