KGSIssueSecurityTEMP

    Keywords: Online Go

This is a suggestion of how to split the page into three pages "Internet Security", "Internet Security of All Go Clients and Servers", "Internet Security of KGS and CGoban". (The pages may still be a bit short, but that is only natural for new pages. More contents will be added later.)


Internet Security

General

When using any Internet program, PC users must be careful about their own Internet security. This page suggests some methods related to software connecting you to online go servers.

Java Applications

Java applications run inside an virtual machine, a [ext] sandbox specifically designed to control and limit access to the computer. Details are available in the [ext] Java Security Architecture documents published by [ext] Sun Microsystems.

Native Applications

Native applications' access to the computer is limited, if at all, by the measures taken by the programmer of the application and the designers of the operating system. Threats include, but are not limited to, trojans, spyware, spambots and other forms of malware.

Personal Firewall

Unless one is a security expert and knows how to do better, using a personal firewall for one's PC should be considered mandatory. There is no general advice because every PC, environment, and user demand a different solution. The simplest (but comparatively weak) solution would be using the operating system's default inbound firewall. An intermediate solution on the application level configures the specific program's paths to for local IP addresses, remote IP addresses, and ports. Alternatively or additionally one can configure firewall rules for the packet level. Good personal firewall software furthermore allows the setting of rules for (mostly prohibited) communications (indirect access and process talk) in between different programs so that malware may not abuse the go client related processes.

Windows-Specific

PC Login with Restricted Rights

Do not connect to the Internet when logged in to your PC as an administrator! Under Windows, log in as a standard user. If necessary, create such a standard user account.

More sophisticated is the creation of yet another standard user, call it "InternetUser?", that is always and only used when going online. Protect your private folders by changing their access rights. Right click a folder, say "Private", and choose "Security". Edit the users and their rights (and inherit the rights to subfolders): E.g. for that folder, delete the user "InternetUser?" and delete all generic entries for standard users (this might be something like "Authentified Users" and "Domain\Users"). Be careful to leave some user(s) with access to and ownership of the folder, e.g., SYSTEM, all "Administrators", and the specific user standing for your administrator account, say, "Domain\AdminName?". Now the effect will be: Log in as "InternetUser?", open some program, and it may not access "Private"! (You also should know how to revert changed rights if the easier and obvious methods fail: In the folder's context menu, under Vista choose "Sicherheit | Erweitert | Berechtigungen | Bearbeiten | (Enter UAC Passwort, if necessary) | Hinzufügen | Erweitert | Jetzt Suchen" and you get to see any user handle you might otherwise be missing. Somebody translate that to English Windows text, please. Under earlier Windows versions, it may be slightly different.) With the command line tool icacls, you can also inspect the currently assigned rights and valid users of every particular folder or file.

Sandbox

There are VM-ware solutions or sandbox softwares but security experts have doubts about them because malware can break out or even abuse such software. In principle, Windows Vista allows the PC user to specify [ext] Integrity Levels; Internet software should get the level Low and thereby be prohibited to access one's private folders and data, which is stored at Medium level.

Watching Files Actions

There are tools for logging files actions. E.g., for Windows there is the tool [ext] ProcessExplorer. With it, you can select a process and view details in the lower pane. Inspect the type File: There the directories are listed to that a particular process has had access. Besides the program directories, you may find the directory to which an SGF is stored or from which an SGF is read. However, if you should see other private directories in the list, you should wonder whether the program would be spyware. Such behaviour has not been reported so far but simply trusting each game client is somewhat unreasonable in the long run. We all want secure software; so if everybody occasionally watches a little, we are protecting ourselves against bugs, intentional spying, or malware attacks on supposedly harmless software like a go client and its interaction with Java.

Other Operating Systems

(Please provide specific contents for MacOS X, FreeBSD, Linux, or other operating systems!)


Internet Security of All Go Clients and Servers

Examples of Java Applications

Java applications include glGo and CGoban.

Examples of Native Applications

Native applications include [ext] Panda-IGS and CyberOro software.


Internet Security of KGS and CGoban

Firewall Settings

An intermediate solution on the application level configures the specific program's paths to CGoban.exe, java.exe, or javaw.exe for local IP addresses, remote IP addresses, and ports. Also see CGoban firewall settings.

Separating CGoban from Private Folders

Suppose one has created an InternetUser? account under Windows and protected one's private folders according to (insert link to Internet Security page). Then e.g., open CGoban and it calls, e.g., javaw.exe. Now that in turn cannot and may not open an SGF from or save to one of the private folders.

CGoban and Vista's Integrity Levels

CGoban3 does not comply with Vista's integrity level design yet. It won't work if lowered to the integrity level Low because its or Java's access to the registry wants to access Medium level registry keys. Currently we need to wait for CGoban3 being recoded in part so that this new feature of Windows Vista can be used.

Watching Files Actions of CGoban

If you run CGoban as an application that calls Java, then the executable will be either java.exe or javaw.exe. Watch the latter's files actions in a process explorer, as is explained here (insert link to the Internet Security page).


This is a copy of the living page "KGSIssueSecurityTEMP" at Sensei's Library.
(OC) 2008 the Authors, published under the OpenContent License V1.0.
[Welcome to Sensei's Library!]
StartingPoints
ReferenceSection
About