\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\usetikzlibrary{arrows}

\usetikzlibrary{shapes}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\renewcommand{\slidecaption}{SEN 04, King's College London}

\newcommand{\bl}[1]{\textcolor{blue}{#1}}  

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Security Engineering (4)\\[-3mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

\normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also home work is there)\\

  \end{tabular}

  \end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\includegraphics[scale=0.34]{../pics/trainwreck.jpg}\\

last week: buffer overflow attacks

\end{center}

\begin{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Survey: Thanks!}

\small

\begin{itemize}

\item ``Would be good, if you provide more detailed explanations. I feel 

your slides are not as structured as they could be.''

\item ``Please consider reference book chapters to cover core subject

areas.''\pause

\item ``The homework questions don't come directly from the 

slides. So must go look things up.''

\item ``Could you please put the homework answers online, perhaps

just before the exam. That's late enough where we should have done

it and if not, we're screwed already then.''

\item ``Could you provide a brief basic answers to sheets for reference

and not to be relied on.''

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\includegraphics[scale=0.45]{../pics/trainwreck.jpg}\\

last week: buffer overflow attacks

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Two General Counter\\[-1mm] 

            Measures against BOAs etc\end{tabular}}

Both try to reduce the attack surface:\bigskip

\begin{itemize}

\item \alert{\bf unikernels} -- the idea is to not have

an operating system at all

\item all functionality of the server is implemented in a

single, stand-alone program

\item all functionality an operating system would normally

provide (network stack, file system) is available through

libraries

\item the best known unikernel is MirageOS using Ocaml

(\url{https://mirage.io})

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Network Applications:\\[-1mm] 

            Privilege Separation\end{tabular}}

\begin{center}

  \begin{tikzpicture}[scale=1]

  \draw[line width=1mm] (-.3, 0) rectangle (1.5,2);

  \draw (4.7,1) node {Internet};

  \draw (-2.7,1.7) node {\footnotesize Application};

  \draw (0.6,1.7) node {\footnotesize Interface};

  \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] process\end{tabular}};

  \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}};

  \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);

  \draw[white] (1.7,1) node (X) {};

  \draw[white] (3.7,1) node (Y) {};

  \draw[red, <->, line width = 2mm] (X) -- (Y);

  \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1);

  \end{tikzpicture}

\end{center}

\begin{itemize}

\item the idea is make the attack surface smaller and mitigate the

  consequences of an attack

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Access Control in Unix}

\begin{itemize}

\item access control provided by the OS

\item authenticate principals

\item mediate access to files, ports, processes etc according to

  \alert{roles} (user ids)\\

\item roles get attached with privileges (some special roles: root)\bigskip\\

\hspace{8mm}

\begin{bubble}[8cm]

users and programs should only have as much privilege as they need to

accomplish a task

\end{bubble}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

\begin{frame}[c]

\frametitle{Access Control in Unix (2)}

\begin{itemize}

\item privileges are specified by file access permissions (``everything is a file'')\medskip 

\item there are 9 (plus 2) bits that specify the permissions of a file

\end{itemize}

\begin{center}

${\underbrace{\LARGE\texttt{-}}_{\text{\makebox[0mm]{directory}}}}

 \;{\underbrace{\LARGE\texttt{r{}-{}-}}_{\text{user}}}\,

 {\underbrace{\LARGE\texttt{r{}w{}-}}_{\text{group}}}\,

 {\underbrace{\LARGE\texttt{r{}w{}x}}_{\text{other}}}\;\;\;

 \LARGE\texttt{bob}\;\;\texttt{staff}\;\;\texttt{file}$

\end{center}  

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Unix-Style Access Control}

\small

\begin{itemize}

\item 

Q: ``I am using Windows. Why should I care?'' \\ 

A: In Windows you have similar AC:

\begin{center}

\begin{tabular}{l}

administrators group\\ 

\hspace{5mm}(has complete control over the machine)\\

authenticated users\\

server operators\\

power users\\

network configuration operators

\end{tabular}

\end{center}\medskip

\item Modern versions of Windows have more fine-grained AC than Unix;

  they do not have a setuid bit, but have \texttt{runas} (asks for a

  password).\pause

\item OS-provided access control can \alert{\bf add} to your security.

  (defence in depth)

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Weaknesses of Unix AC}

Not just restricted to Unix:

\begin{itemize}

\item if you have too many roles (i.e.~too finegrained AC), then

  hierarchy is too complex\\ \textcolor{gray}{you invite situations

    like\ldots let's be root}\bigskip

\item you can still abuse the system\ldots

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Cron''-Attack}

The idea is to trick a privileged person to do something on your

behalf:

\begin{itemize}

\item root:\\\texttt{rm /tmp/*/*}\bigskip\bigskip\pause

\footnotesize

\begin{minipage}{1.1\textwidth}

\textcolor{gray}{the shell behind the scenes:}\\

\textcolor{gray}{\texttt{rm /tmp/dir$_1$/file$_1$ /tmp/dir$_1$/file$_2$ /tmp/dir$_2$/file$_1$ \ldots}}\bigskip\\

\textcolor{gray}{this takes time}

\end{minipage}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Cron''-Attack}

\begin{enumerate}

\item attacker \textcolor{gray}{(creates a fake passwd file)}\\ 

\texttt{mkdir /tmp/a; cat > /tmp/a/passwd}\medskip

\item root \textcolor{gray}{(does the daily cleaning)}\\

\texttt{rm /tmp/*/*}\medskip\\

\hspace{2cm}\textcolor{gray}{\small records that \texttt{/tmp/a/passwd}}\\ 

\hspace{2cm}\textcolor{gray}{\small should be deleted, but does not do it yet}\medskip\\

\item attacker \textcolor{gray}{(meanwhile deletes the fake passwd file, and establishes a link to 

the real passwd file)}\\

\texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a}\\

\item root now deletes  the real passwd file

\end{enumerate}

\only<2>{

\begin{textblock}{11}(2,5)

\begin{bubble}[8cm]

\normalsize To prevent this kind of attack, you need additional

policies (don't do such operations as root).

\end{bubble}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Infamous Security Flaws\\[-1mm] 

in Unix\end{tabular}}

\begin{itemize}

\item \texttt{lpr} unfortunately runs with root privileges; you had the option to delete files after printing \ldots\pause

\item for debugging purposes (FreeBSD) Unix provides a ``core dump'', but allowed to follow links \ldots\pause

\item \texttt{mkdir foo} is owned by root\medskip

\begin{center}

\texttt{-rwxr-xr-x  1 root  wheel /bin/mkdir}

\end{center}\medskip

it first creates an i-node as root and then changes to ownership to the user's id\\ \textcolor{gray}{\small (race condition -- can be automated with a shell script)}

\end{itemize}

\only<4->{

\begin{textblock}{1}(3,7)

\begin{tikzpicture}

\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

{\begin{minipage}{8cm}

Only failure makes us experts.

	-- Theo de Raadt (OpenBSD, OpenSSH)

\end{minipage}};

\end{tikzpicture}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{itemize}

\item login processes run under UID $=$ \pcode{0}\medskip 

\begin{center}

\texttt{ps -axl | grep login}

\end{center}\medskip

\item after login, shells run under UID $=$ user (e.g.~501)\medskip

\begin{center}

\texttt{id cu}

\end{center}\medskip\pause

\item non-root users are not allowed to change the UID --- would break 

access control

\item but needed for example for accessing \texttt{passwd}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Setuid and Setgid}

The solution is that Unix file permissions are 9 + \underline{2 Bits}:

\alert{\bf Setuid} and \alert{\bf Setgid} bits

\begin{itemize}

\item When a file with setuid is executed, the resulting process will

  assume the UID given to the \underline{owner} of the file.

\item This enables users to create processes as root (or another

  user).\bigskip

\item Essential for changing passwords, for example.

\end{itemize}

\begin{center}

\texttt{chmod 4755 fobar\_file}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\small

\lstinputlisting[language={},numbers=none,xleftmargin=-6mm]{lst}

\begin{center}

\begin{tabular}{@{\hspace{-24mm}}ll}

members of group staff: & ping, bob, emma\\ 

members of group students: & emma\\

\end{tabular}

\end{center}

\begin{center}

\begin{tabular}{@{\hspace{-7mm}}r|c|c|c|c|c@{}}

        & manual.txt & report.txt & microedit & src/code.c & src/code.h \\\hline

ping & & & & &\\\hline

bob & & & & &\\\hline

emma   & & & & &\\

\end{tabular}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\small

\begin{itemize}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{The Bell-LaPadula Model}

\small

\begin{itemize}

\item Formal policy model for mandatory access control in a military

  multi-level security environment. All subjects (processes, users,

  terminals, files, windows, connections) are labeled

  with a confidentiality level, e.g.

\begin{center}

unclassified < confidential < secret < top secret

\end{center}\medskip

\item The system policy automatically prevents the flow of information