Computer Security Applications Conference, Annual (2005)
Dec. 5, 2005 to Dec. 9, 2005
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/CSAC.2005.7
Norman Feske , Technische Universitat Dresden
Christian Helmuth , Technische Universitat Dresden
Malware such as Trojan Horses and spyware remain to be persistent security threats that exploit the overly complex graphical user interfaces of today?s commodity operating systems. In this paper, we present the design and implementation of Nitpicker an extremely minimized secure graphical user interface that addresses these problems while retaining compatibility to legacy operating systems. We describe our approach of kernelizing the window server and present the deployed security mechanisms and protocols. Our implementation comprises only 1,500 lines of code while supporting commodity software such as X11 applications alongside protected graphical security applications. We discuss key techniques such as client-side window handling, a new floating-labels mechanism, dragand- drop, and denial-of-service-preventing resource management. Furthermore, we present an application scenario to evaluate the feasibility, performance, and usability of our approach.
Norman Feske, Christian Helmuth, "A Nitpicker?s guide to a minimal-complexity secure GUI", Computer Security Applications Conference, Annual, vol. 00, no. , pp. 85-94, 2005, doi:10.1109/CSAC.2005.7