\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\usetikzlibrary{arrows}

\usetikzlibrary{shapes}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\renewcommand{\slidecaption}{APP 04, King's College London}

\newcommand{\bl}[1]{\textcolor{blue}{#1}}  

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Access Control and \\[-3mm] 

  \LARGE Privacy Policies (4)\\[-6mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

\normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also home work is there)\\

  \end{tabular}

  \end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Survey: Thanks!}

\small

\begin{itemize}

\item ``Would be good, if you provide more detailed explanations. I feel 

your slides are not as structured as they could be.''

\item ``Please consider reference book chapters to cover core subject

areas.''\pause

\item ``The homework questions don't come directly from the 

slides. So must go look things up.''

\item ``Could you please put the homework answers online, perhaps

just before the exam. That's late enough where we should have done

it and if not, we're screwed already then.''

\item ``Could you provide a brief basic answers to sheets for reference

and not to be relied on.''

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\includegraphics[scale=0.45]{../pics/trainwreck.jpg}\\

last week: buffer overflow attacks

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]

\frametitle{D-Link Wifi Router, BOA}

\small

As a proof-of-concept, the following URL allows 

attackers to control the return value saved on 

the stack (the vulnerability is triggered when

executing \pcode{"/usr/sbin/widget"}):

\begin{center}\footnotesize 

\pcode{curl http://<target ip>/post_login.xml?hash=AAA...AAABBBB}

\end{center}

The value of the "hash" HTTP GET parameter consists of

292 occurrences of the \pcode{'A'} character, followed by four 

occurrences of character \pcode{'B'}. In our lab setup, characters 

\pcode{'B'} overwrite the saved program counter (\pcode{\%ra}).\bigskip

\begin{tabular}{@{}ll}

Discovery date: & 06/03/2013\\

Release date:   & 02/08/2013

\end{tabular}\bigskip

\footnotesize

\hfill\url{http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt} 

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]

\frametitle{D-Link Backdoors}

D-Link router flaw lets anyone login through "Joel's Backdoor":\medskip

\begin{quote}\rm\small

If you tell your browser to identify itself as Joel's backdoor, instead of (say) 

as Mozilla/5.0 AppleWebKit/536.30.1 Version/6.0.5, you're in without authentication.\medskip

"What is this string," I hear you ask?

You will laugh: it is\pause 

\begin{center}\large

\pcode{xmlset_roodkcableoj28840ybtide}

\end{center}

\end{quote}\bigskip\bigskip

\hfill\footnotesize October 15, 2013\\

\hfill\footnotesize\url{http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]

CVE-2014-0476 \pcode{chkrootkit} vulnerability 4 Jun'14\medskip

\begin{quote}\rm\small

Hi,

we just found a serious vulnerability in the chkrootkit package, which

may allow local attackers to gain root access to a box in certain

configurations (\pcode{/tmp} not mounted noexec). Steps to reproduce:

\begin{itemize}

\item Put an executable file named \pcode{update} with non-root owner in 

\pcode{/tmp} (not mounted noexec, obviously)

\item Run chkrootkit (as uid \pcode{0})

\end{itemize}

Result: The file \pcode{/tmp/update} will be executed as root, thus effectively

rooting your box, if malicious content is placed inside the file.

If an attacker knows you are periodically running chkrootkit (like in

\pcode{cron.daily}) and has write access to \pcode{/tmp} (not mounted noexec), he may

easily take advantage of this.

\end{quote}

\mbox{}\\[-10mm]

\hfill\footnotesize\url{http://seclists.org/oss-sec/2014/q2/430}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Access Control in Unix}

\begin{itemize}

\item access control provided by the OS

\item authenticate principals

\item mediate access to files, ports, processes etc according to

  \alert{roles} (user ids)\\

\item roles get attached with privileges\bigskip\\

\hspace{8mm}

\begin{bubble}[8cm]

\alert{principle of least privilege:}\\

users and programs should only have as much privilege as they need to

accomplish a task

\end{bubble}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{Access Control in Unix (2)}

\begin{itemize}

\item privileges are specified by file access permissions (``everything is a file'')\medskip 

\item there are 9 (plus 2) bits that specify the permissions of a file

\begin{center}

\begin{tabular}{l}

\texttt{\$ ls -la}\\

\texttt{-rwxrw-r-{}- \hspace{3mm} foo\_file.txt}

\end{tabular}

\end{center}

\end{itemize}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Login Process}

\begin{itemize}

\item login processes run under UID $=$ \pcode{0}\medskip 

\begin{center}

\texttt{ps -axl | grep login}

\end{center}\medskip

\item after login, shells run under UID $=$ user (e.g.~501)\medskip

\begin{center}

\texttt{id cu}

\end{center}\medskip\pause

\item non-root users are not allowed to change the UID --- would break 

access control

\item but needed for example for accessing \texttt{passwd}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Setuid and Setgid}

The solution is that Unix file permissions are 9 + \underline{2 Bits}:

\alert{Setuid} and \alert{Setgid} bits

\begin{itemize}

\item When a file with setuid is executed, the resulting process will

  assume the UID given to the \underline{owner} of the file.

\item This enables users to create processes as root (or another

  user).\bigskip

\item Essential for changing passwords, for example.

\end{itemize}

\begin{center}

\texttt{chmod 4755 fobar\_file}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Discretionary Access Control}

\begin{itemize}

\item Access to objects (files, directories, devices, etc.) is

permitted based on user identity. Each object is owned by a

user. Owners can specify freely (at their discretion) how they want to

share their objects with other users, by specifying which other users

can have which form of access to their objects.\medskip

\item Discretionary access control is implemented on any modern multi-user

OS (Unix, Windows NT, etc.).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Mandatory Access Control}

\begin{itemize}

\item Access to objects is controlled by a system-wide policy, for

  example to prevent certain flows of information. In some forms, the

  system maintains security labels for both objects and subjects

  (processes, users) based on which access is granted or

  denied. Labels can change as the result of an access. Security

  policies are enforced without the cooperation of users or

  programs.\medskip

\item This is implemented in banking or military operating system 

  versions (SELinux).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Discretionary Access Control}

In its most generic form usually given by an \alert{Access Control

  Matrix} of the form

\begin{center}

\begin{tabular}{r|c|c|c}

                 & /mail/jane & edit.exe & postfix \\\hline

jane          & r, w & r, x & r, x\\\hline

john          & $\varnothing$ & r, w, x&  r, x\\\hline

postfix  & a & $\varnothing$ &  r, x\\

\end{tabular}

\end{center}

access privileges: {\bf r}ead, {\bf w}rite, e{\bf x}ecute, {\bf a}ppend

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\small

\lstinputlisting[language={},numbers=none,xleftmargin=-6mm]{lst}

\begin{center}

\begin{tabular}{@{\hspace{-24mm}}ll}

members of group staff: & ping, bob, emma\\ 

members of group students: & emma\\

\end{tabular}

\end{center}

\begin{center}

\begin{tabular}{@{\hspace{-7mm}}r|c|c|c|c|c@{}}

        & manual.txt & report.txt & microedit & src/code.c & src/code.h \\\hline

ping & & & & &\\\hline

bob & & & & &\\\hline

emma   & & & & &\\

\end{tabular}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Mandatory Access Control}

\small

\begin{itemize}

\item Restrictions to allowed information flows are not decided at the

  user's discretion (as with Unix \pcode{chmod}), but instead enforced

  by system policies.

\item Mandatory access control mechanisms are aimed in particular at

  preventing policy violations by untrusted programs, which typically

  have at least the same access privileges as the invoking

  user.\medskip\pause

Simple example: Air Gap Security. Uses a completely separate network

and computer hardware for different application classes.

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{The Bell-LaPadula Model}

\small

\begin{itemize}

\item Formal policy model for mandatory access control in a military

  multi-level security environment. All subjects (processes, users,

  terminals, files, windows, connections) are labeled

  with a confidentiality level, e.g.

\begin{center}

unclassified < confidential < secret < top secret

\end{center}\medskip

\item The system policy automatically prevents the flow of information

  from high-level objects to lower levels. A process that reads top

  secret data becomes tagged as top secret by the operating system, as

  will be all files into which it writes afterwards.

%Each user has a maximum allowed confidentiality level specified and

%cannot receive data beyond that level. A selected set of trusted

%subjects is allowed to bypass the restrictions, in order to permit

%the declassification of information.

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \begin{frame}[c]

  \frametitle{Bell-LaPadula}

  \small

  \begin{itemize}

  \item \alert{Read Rule}: A principal \bl{$P$} can read an object \bl{$O$} if and only if

  \bl{$P$}'s security level is at least as high as \bl{$O$}'s.

  \item \alert{Write Rule}: A principal \bl{$P$} can write an object \bl{$O$} if and only if

  \bl{$O$}'s security level is at least as high as \bl{$P$}'s.\medskip

  \item Meta-Rule: All principals in a system should have a sufficiently high security level

  in order to access an object.

  \end{itemize}\bigskip

  This restricts information flow $\Rightarrow$ military\bigskip\bigskip\pause

  Bell-LaPadula: {\bf `no read up'} - {\bf `no write down'}

  \end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \begin{frame}[c]

  \frametitle{\begin{tabular}{c}Principle of\\[-2mm] Least Privilege\end{tabular}}

  \begin{bubble}[10cm]

  A principal should have as few privileges as possible to access a resource.

  \end{bubble}\bigskip\bigskip

  \small

  \begin{itemize}

  \item Bob ($T\!S$) and Alice ($S$) want to communicate

  \item[] $\Rightarrow$ Bob should lower his security level

  \end{itemize}

  \end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \begin{frame}[c]

  \frametitle{Biba Policy}

  \small

  Data Integrity (rather than data confidentiality)

  \begin{itemize}

  \item Biba: {\bf `no read down'} - {\bf `no write up'}

  \item \alert{Read Rule}: A principal \bl{$P$} can read an object \bl{$O$} if and only if

  \bl{$P$}'s security level is lower or equal than \bl{$O$}'s.

  \item \alert{Write Rule}: A principal \bl{$P$} can write an object \bl{$O$} if and only if

  \bl{$O$}'s security level is lower or equal than \bl{$P$}'s.

  \end{itemize}\bigskip\bigskip\pause

  E.g.~Firewalls: you can read from inside the firewall, but not from outside\\

  Phishing: you can look at an approved PDF, but not one from a random email\\

  \end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Security Levels (2)}

\begin{itemize}

\item Bell-La Padula preserves data secrecy, but not data

  integrity\bigskip\pause

\item Biba model is for data integrity  

\begin{itemize}

\item read: your own level and above

\item write: your own level and below

\end{itemize}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Shared Access Control}

\begin{center}

\includegraphics[scale=0.7]{../pics/pointsplane.jpg}

\end{center}

\begin{textblock}{11}(10.5,10.5)

\small

To take an action you\\[-1mm] 

need at least either:

\begin{itemize}

\item 1 CEO\\[-5mm]

\item 2 MDs, or\\[-5mm]

\item 3 Ds

\end{itemize}

\end{textblock}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]