57 \end{center} |
57 \end{center} |
58 |
58 |
59 \end{frame} |
59 \end{frame} |
60 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
60 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
61 |
61 |
62 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
62 |
63 \mode<presentation>{ |
63 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
64 \begin{frame}[c] |
64 \begin{frame}[c] |
65 |
65 |
66 \large\bf |
66 \Large\bf Are there more strings in \bf{$L(a^*)$} or |
67 Using a compiler, \\how can you mount the\\ perfect attack against a system? |
67 \bf{$L((a + b)^*)$}? |
68 |
|
69 \end{frame}} |
|
70 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
71 |
|
72 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
73 \mode<presentation>{ |
|
74 \begin{frame}[c] |
|
75 |
|
76 {\large\bf |
|
77 What is a \alert{perfect} attack?}\bigskip |
|
78 |
|
79 \begin{enumerate} |
|
80 \item you can potentially completely take over a target system |
|
81 \item your attack is (nearly) undetectable |
|
82 \item the victim has (almost) no chance to recover |
|
83 \end{enumerate} |
|
84 |
|
85 \end{frame}} |
|
86 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
87 |
|
88 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
89 \mode<presentation>{ |
|
90 \begin{frame}[c] |
|
91 |
|
92 |
|
93 \begin{center} |
|
94 \begin{tikzpicture}[scale=1] |
|
95 |
|
96 \onslide<1->{ |
|
97 \node (A) at (0,0) [draw=black, rectangle, very thick, minimum height=18mm, minimum width=17mm] {}; |
|
98 \node [below right] at (A.north west) {\footnotesize\begin{tabular}{@{}l@{}} |
|
99 \only<1,2>{clean}\only<3->{\alert{hacked}}\\compiler\end{tabular}};} |
|
100 |
|
101 |
|
102 \onslide<2->{ |
|
103 \node (B) at (-2,2) [draw=black, rectangle, very thick, minimum height=10mm, minimum width=12mm] {}; |
|
104 \node [below right] at (B.north west) {\footnotesize\begin{tabular}{@{}l@{}}login\\(src)\end{tabular}}; |
|
105 |
|
106 \node (C) at (2,2) [draw=black, rectangle, very thick, minimum height=10mm, minimum width=12mm] {}; |
|
107 \node [below right] at (C.north west) {\footnotesize\begin{tabular}{@{}l@{}}login\\(bin)\end{tabular}}; |
|
108 |
|
109 \draw[->, line width=2mm] (B) -- (C); |
|
110 } |
|
111 |
|
112 \onslide<3->{\node [above left=-1.5mm] at (C.south east) {\footnotesize \alert{$\blacksquare$}};} |
|
113 |
|
114 \end{tikzpicture} |
|
115 \end{center} |
|
116 |
|
117 \end{frame}} |
|
118 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
119 |
|
120 |
|
121 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
122 \mode<presentation>{ |
|
123 \begin{frame}[c] |
|
124 |
|
125 \begin{center} |
|
126 \begin{tikzpicture}[scale=1] |
|
127 |
|
128 \onslide<1->{ |
|
129 \node (A) at (0,0) [draw=black, rectangle, very thick, minimum height=18mm, minimum width=14mm] {}; |
|
130 \node [below right] at (A.north west) {\small V0.01}; |
|
131 \node [below right] (A1) at (A.south west) {\small Scala}; |
|
132 \node [below right] (A1) at (A1.south west) {\small\textcolor{gray}{host language}}; |
|
133 \node [above right] at (A.north west) {my compiler (src)};} |
|
134 |
|
135 \onslide<2->{ |
|
136 \node (B) at (1.8,0) [draw=black, rectangle, very thick, minimum height=18mm, minimum width=14mm] {}; |
|
137 \node [below right] at (B.north west) {\small V0.02}; |
|
138 \node [below right] at (B.south west) {\small Scala}; |
|
139 \node at (3,0) {\ldots}; |
|
140 |
|
141 \node (C) at (5,0) [draw=black, rectangle, very thick, minimum height=18mm, minimum width=14mm] {}; |
|
142 \node [below right] at (C.north west) {\small V1.00}; |
|
143 \node [below right] at (C.south west) {\small Scala};} |
|
144 |
|
145 \onslide<3->{ |
|
146 \node (D) at (6.8,0) [draw=black, rectangle, very thick, minimum height=18mm, minimum width=14mm] {}; |
|
147 \node [below right] at (D.north west) {\small V1.00}; |
|
148 |
|
149 \node (E) at (6.8,2) [draw=black, rectangle, very thick, minimum height=18mm, minimum width=14mm] {}; |
|
150 \node [below right] at (E.north west) {\small V1.01};} |
|
151 |
|
152 \onslide<4->{ |
|
153 \node (F) at (8.6,0) [draw=black, rectangle, very thick, minimum height=18mm, minimum width=14mm] {}; |
|
154 \node [below right] at (F.north west) {\small V1.01}; |
|
155 |
|
156 \node (G) at (8.6,2) [draw=black, rectangle, very thick, minimum height=18mm, minimum width=14mm] {}; |
|
157 \node [below right] at (G.north west) {\small V1.02}; |
|
158 \node at (9.8,0) {\ldots}; |
|
159 \node at (9.8,2) {\ldots}; |
|
160 \node at (8,-2) {\textcolor{gray}{\begin{tabular}{@{}l@{}}no host language\\needed\end{tabular}}}; |
|
161 } |
|
162 |
|
163 \end{tikzpicture} |
|
164 \end{center} |
|
165 |
|
166 \end{frame}} |
|
167 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
168 |
|
169 |
|
170 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
171 \mode<presentation>{ |
|
172 \begin{frame}<1-3> |
|
173 \frametitle{\LARGE\begin{tabular}{c}Hacking Compilers |
|
174 \end{tabular}} |
|
175 |
|
176 %Why is it so paramount to have a small trusted code base (TCB)? |
|
177 \bigskip\bigskip |
|
178 |
|
179 \begin{columns} |
|
180 \begin{column}{2.7cm} |
|
181 \begin{minipage}{2.5cm}% |
|
182 \begin{tabular}{c@ {}} |
|
183 \includegraphics[scale=0.2]{../pics/ken-thompson.jpg}\\[-1.8mm] |
|
184 \footnotesize Ken Thompson\\[-1.8mm] |
|
185 \footnotesize Turing Award, 1983\\ |
|
186 \end{tabular} |
|
187 \end{minipage} |
|
188 \end{column} |
|
189 \begin{column}{9cm} |
|
190 \begin{tabular}{l@ {\hspace{1mm}}p{8cm}} |
|
191 |
|
192 & Ken Thompson showed how to hide a Trojan Horse in a |
|
193 compiler \textcolor{red}{without} leaving any traces in the source code.\\[2mm] |
|
194 |
|
195 & No amount of source level verification will protect |
|
196 you from such Thompson-hacks.\\[2mm] |
|
197 |
|
198 \end{tabular} |
|
199 \end{column} |
|
200 \end{columns} |
|
201 |
|
202 \only<2>{ |
|
203 \begin{textblock}{6}(4,2) |
|
204 \begin{tikzpicture} |
|
205 \draw (0,0) node[inner sep=3mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
|
206 {\normalsize |
|
207 \begin{minipage}{8cm} |
|
208 \begin{quote} |
|
209 \includegraphics[scale=0.05]{../pics/evil.png} |
|
210 \begin{enumerate} |
|
211 \item[1)] Assume you ship the compiler as binary and also with sources. |
|
212 \item[2)] Make the compiler aware when it compiles itself. |
|
213 \item[3)] Add the Trojan horse. |
|
214 \item[4)] Compile. |
|
215 \item[5)] Delete Trojan horse from the sources of the compiler. |
|
216 \item[6)] Go on holiday for the rest of your life. ;o)\\[-7mm]\mbox{} |
|
217 \end{enumerate} |
|
218 \end{quote} |
|
219 \end{minipage}}; |
|
220 \end{tikzpicture} |
|
221 \end{textblock}} |
|
222 |
|
223 \end{frame}} |
|
224 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
225 |
|
226 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
227 \begin{frame}[c] |
|
228 \frametitle{Compilers \& Boeings 777} |
|
229 |
|
230 First flight in 1994. They want to achieve triple redundancy in hardware |
|
231 faults.\bigskip |
|
232 |
|
233 They compile 1 Ada program to\medskip |
|
234 |
|
235 \begin{itemize} |
|
236 \item Intel 80486 |
|
237 \item Motorola 68040 (old Macintosh's) |
|
238 \item AMD 29050 (RISC chips used often in laser printers) |
|
239 \end{itemize}\medskip |
|
240 |
|
241 using 3 independent compilers.\bigskip\pause |
|
242 |
|
243 \small Airbus uses C and static analysers. Recently started using CompCert. |
|
244 |
|
245 \end{frame} |
|
246 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
247 |
|
248 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
249 \begin{frame}[c] |
|
250 |
|
251 {\Large\bf |
|
252 How many strings are in \bl{$L(a^*)$}?}\bigskip\pause |
|
253 |
|
254 \normalsize |
|
255 \begin{center} |
|
256 \begin{tabular}{llllll} |
|
257 \bl{$[]$} & \bl{$a$} & \bl{$aa$} & \bl{$aaa$} & \bl{$aaaa$} & \ldots\\ |
|
258 \bl{0} & \bl{1} & \bl{2} & \bl{3} & \bl{4} & \ldots |
|
259 \end{tabular} |
|
260 \end{center} |
|
261 |
68 |
262 \end{frame} |
69 \end{frame} |
263 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
70 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
264 |
71 |
265 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
72 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |