So I’m dipping my toe in Cyber Security and I came across the confused deputy problem. Anyone care to break it down, please?
In: 1
You, USER A, have limited permissions.
A program, PROGRAM X, has a different set of permissions.
A confused deputy situation occurs when USER A is given permission to use PROGRAM X and thus indirectly allowed to do things you aren’t normally allowed to do. This can result in damage either through malicious use if USER A intentionally uses this loophole, or accidental damage if they just happen to try things without knowing they shouldn’t be allowed to.
In the originally described scenario, the program was a compiler. Normally the compiler would allow the user to ONLY write to a director the user had permission for. HOWEVER it also had a special permission to write to a certain directory for logging and analytics purposes. Unfortunately that directory contained other important files. The user could overwrite those files by specifying that directory as the log output location. Because it was a special case for the compiler to be able to write to this directory it didn’t check the users permission and damage could occur.
The term comes from the stereotype of an inept/confused deputy who is given authority but is tricked or accidentally uses it to cause problems, such as the character of Barney Fife in the old TV series “The Andy Griffith Show”. The deputy isn’t TRYING to do harm, its just that they get easily confused and manipulated by other people who shouldn’t have power.
Latest Answers