Chapter 8 — Computer architecture

Lesson map

Lesson 08 published. Map, example, EX022.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Privilege and observability"]
  N2["8.2 Side channels are physical"]
  N3["8.3 Evidence without root"]
  N4["8.3b Privilege in tickets"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX022"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Privilege and observability"]
  N2["8.2 Side channels are physical"]
  N3["8.3 Evidence without root"]
  N4["8.3b Privilege in tickets"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX022"]

[Learning outcomes]
    |
    v
[8.1 Privilege and observability]
    |
    v
[8.2 Side channels are physical]
    |
    v
[8.3 Evidence without root]
    |
    v
[8.3b Privilege in tickets]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX022]

Learning outcomes

You will (1) map privilege levels to what an authorized test may observe; (2) explain why timing and cache side channels need special ROE clauses; (3) design an evidence path that does not require kernel privileges.

8.1 Privilege and observability

User mode sees process memory and system calls it is allowed; kernel mode sees devices and page tables; a hypervisor sees guests. An authorized engagement that stays in user mode cannot claim "we ruled out a kernel rootkit". State the privilege level of each observation in the evidence package. TrackScope should record the account and role used for every action.

A finding is only as strong as the vantage point that produced it. User-mode evidence cannot rule out threats that live below it, and claiming otherwise oversells the engagement. Recording the account and role next to each action lets a reviewer see whether a later claim matches the access used. TrackScope refuses to store an observation without that field.

8.2 Side channels are physical

Cache and timing side channels measure microarchitectural state. They are research techniques, noisy, and often out of scope for commercial assessments. If they are in scope, the ROE must name the platforms, forbid production traffic, and require a stop condition if latency to users rises. Do not treat a student lab on a laptop as evidence about a server.

These techniques measure shared hardware state and can disturb production latency, which is why they need their own ROE clauses. A laptop lab says nothing about a server's cache behaviour under load. When side channels are out of scope, Sam states that limit in the report so readers do not assume they were tried. Stop conditions protect users who never agreed to be part of the experiment.

8.3 Evidence without root

Most durable evidence for an authorized assessment is logs, configuration reads and application responses — all available to a suitably authorized user account. Prefer that path: it is safer, easier to revoke after the engagement, and sufficient for findings about authentication, authorization and exposure.

Synthetic case — Riverstone Transit. A proposed "full disk image" of a fare validator needed root and would take the device offline. Sam replaced it with a configuration export and an application-level read of the account list, both authorized under the existing ROE.

8.4 Errors and limits

Architecture diagrams in marketing decks omit shared caches and management planes. Verify the actual platform before promising a privilege level in the ROE.

Marketing diagrams often hide management interfaces and shared hardware. Sam confirms the real platform with the client before the ROE promises a privilege level. If the platform cannot be confirmed, the engagement stays at the least privilege that is known to exist, and the report states that limit so readers do not invent a stronger vantage point.

8.3b Privilege in tickets

FindingsDesk should store privilege_used as an enum (user, admin-local, admin-domain, hypervisor, out-of-band). Sorting and SLA logic can then treat hypervisor findings differently from user-mode config reads. Without the field, two findings that look similar in title may have been obtained under radically different authorization, and the re-test plan will be wrong.

An enum stops free-text drift such as 'admin' meaning local on one ticket and domain on another. SLA clocks can then give hypervisor findings a different path, because verifying them needs different access and different stop conditions. Re-test plans read the field so the re-tester brings the right authorization. FindingsDesk rejects a ticket that omits it.

Exercises

• EX022 — Privilege map. List three observations possible as a standard user and three that need elevated privileges. Rubric: 3 = six concrete items mapped correctly; 2 = four; 1 = vague; 0 = none.
• EX023 — Side-channel ROE. Write two ROE clauses for an authorized cache-timing study on a spare lab host. Rubric: 3 = platform named, production excluded, stop condition; 2 = two of three; 1 = one; 0 = none.
• EX024 — Evidence path. Propose an evidence path for "default admin password on staging UI" that does not need root. Rubric: 3 = login attempt under ROE, screenshot/log, ticket, no credential left behind; 2 = missing one; 1 = vague; 0 = root required.

Synthesis

Say what privilege you used. Prefer user-level evidence. Treat side channels as special, not as a default tool.

Continue studying — chapter 08 of 50

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →