\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\usetikzlibrary{arrows}

\usetikzlibrary{shapes}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\renewcommand{\slidecaption}{SEN 04, King's College London}

\newcommand{\bl}[1]{\textcolor{blue}{#1}}  

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Security Engineering (4)\\[-3mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

\normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also home work is there)\\

  \end{tabular}

  \end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\includegraphics[scale=0.34]{../pics/trainwreck.jpg}\\

last week: buffer overflow attacks

\end{center}

\begin{itemize}

\item no ``cheating'' needed for format string attacks

\item the main point: no cheating to start with 

\end{itemize} 

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{bubble}[10cm]\small How do we implement BOAs? On a

webpage login, for example Facebook, we can't do this. The

script will not let us enter hexadecimal numbers where email

or username is required and plus it will have a max length,

like 32 characters only. In this case, what can we do, since

the method you showed us wouldn't work?

\end{bubble}\bigskip\bigskip\pause

\begin{itemize}

\item Facebook no

\item printers, routers, cars, IoT etc likely

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\includegraphics[scale=0.45]{../pics/trainwreck.jpg}\\

last week: buffer overflow attacks

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Two General Counter\\[-1mm] 

            Measures against BOAs etc\end{tabular}}

Both try to reduce the attack surface:\bigskip

\begin{itemize}

\item \alert{\bf unikernels} -- the idea is to not have

an operating system at all

\item all functionality of the server is implemented in a

single, stand-alone program

\item all functionality an operating system would normally

provide (network stack, file system) is available through

libraries

\item the best known unikernel is MirageOS using Ocaml

(\url{https://mirage.io})

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Network Applications:\\[-1mm] 

            Privilege Separation\end{tabular}}

\begin{center}

  \begin{tikzpicture}[scale=1]

  \draw[line width=1mm] (-.3, 0) rectangle (1.5,2);

  \draw (4.7,1) node {Internet};

  \draw (-2.7,1.7) node {\footnotesize Application};

  \draw (0.6,1.7) node {\footnotesize Interface};

  \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] process\end{tabular}};

  \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}};

  \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);

  \draw[white] (1.7,1) node (X) {};

  \draw[white] (3.7,1) node (Y) {};

  \draw[red, <->, line width = 2mm] (X) -- (Y);

  \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1);

  \end{tikzpicture}

\end{center}

\begin{itemize}

\item the idea is make the attack surface smaller and mitigate the

  consequences of an attack

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Access Control in Unix}

\begin{itemize}

\item access control provided by the OS

\item authenticate principals

\item mediate access to files, ports, processes etc according to

  \alert{roles} (user ids)\\

\item roles get attached with privileges (some special roles: root)\bigskip\\

\hspace{8mm}

\begin{bubble}[8cm]

\alert{\bf principle of least privilege:}\\

users and programs should only have as much privilege as they need to

accomplish a task

\end{bubble}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

\begin{frame}[c]

\frametitle{Access Control in Unix (2)}

\begin{itemize}

\item privileges are specified by file access permissions (``everything is a file'')\medskip 

\item there are 9 (plus 2) bits that specify the permissions of a file

\end{itemize}

\begin{center}

${\underbrace{\LARGE\texttt{-}}_{\text{\makebox[0mm]{directory}}}}

 \;{\underbrace{\LARGE\texttt{r{}-{}-}}_{\text{user}}}\,

 {\underbrace{\LARGE\texttt{r{}w{}-}}_{\text{group}}}\,

 {\underbrace{\LARGE\texttt{r{}w{}x}}_{\text{other}}}\;\;\;

 \LARGE\texttt{bob}\;\;\texttt{staff}\;\;\texttt{file}$

\end{center}  

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Unix-Style Access Control}

\small

\begin{itemize}

\item 

Q: ``I am using Windows. Why should I care?'' \\ 

A: In Windows you have similar AC:

\begin{center}

\begin{tabular}{l}

administrators group\\ 

\hspace{5mm}(has complete control over the machine)\\

authenticated users\\

server operators\\

power users\\

network configuration operators

\end{tabular}

\end{center}\medskip

\item Modern versions of Windows have more fine-grained AC than Unix;

  they do not have a setuid bit, but have \texttt{runas} (asks for a

  password).\pause

\item OS-provided access control can \alert{\bf add} to your security.

  (defence in depth)

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Weaknesses of Unix AC}

Not just restricted to Unix:

\begin{itemize}

\item if you have too many roles (i.e.~too finegrained AC), then

  hierarchy is too complex\\ \textcolor{gray}{you invite situations

    like\ldots let's be root}\bigskip

\item you can still abuse the system\ldots

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Cron''-Attack}

The idea is to trick a privileged person to do something on your

behalf:

\begin{itemize}

\item root:\\\texttt{rm /tmp/*/*}\bigskip\bigskip\pause

\footnotesize

\begin{minipage}{1.1\textwidth}

\textcolor{gray}{the shell behind the scenes:}\\

\textcolor{gray}{\texttt{rm /tmp/dir$_1$/file$_1$ /tmp/dir$_1$/file$_2$ /tmp/dir$_2$/file$_1$ \ldots}}\bigskip\\

\textcolor{gray}{this takes time}

\end{minipage}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Cron''-Attack}

\begin{enumerate}

\item attacker \textcolor{gray}{(creates a fake passwd file)}\\ 

\texttt{mkdir /tmp/a; cat > /tmp/a/passwd}\medskip

\item root \textcolor{gray}{(does the daily cleaning)}\\

\texttt{rm /tmp/*/*}\medskip\\

\hspace{2cm}\textcolor{gray}{\small records that \texttt{/tmp/a/passwd}}\\ 

\hspace{2cm}\textcolor{gray}{\small should be deleted, but does not do it yet}\medskip\\

\item attacker \textcolor{gray}{(meanwhile deletes the fake passwd file, and establishes a link to 

the real passwd file)}\\

\texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a}\\

\item root now deletes  the real passwd file

\end{enumerate}

\only<2>{

\begin{textblock}{11}(2,5)

\begin{bubble}[8cm]

\normalsize To prevent this kind of attack, you need additional

policies (don't do such operations as root).

\end{bubble}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Infamous Security Flaws\\[-1mm] 

in Unix\end{tabular}}

\begin{itemize}

\item \texttt{lpr} unfortunately runs with root privileges; you had the option to delete files after printing \ldots\pause

\item for debugging purposes (FreeBSD) Unix provides a ``core dump'', but allowed to follow links \ldots\pause

\item \texttt{mkdir foo} is owned by root\medskip

\begin{center}

\texttt{-rwxr-xr-x  1 root  wheel /bin/mkdir}

\end{center}\medskip

it first creates an i-node as root and then changes to ownership to the user's id\\ \textcolor{gray}{\small (race condition -- can be automated with a shell script)}

\end{itemize}

\only<4->{

\begin{textblock}{1}(3,7)

\begin{tikzpicture}

\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

{\begin{minipage}{8cm}

Only failure makes us experts.

	-- Theo de Raadt (OpenBSD, OpenSSH)

\end{minipage}};

\end{tikzpicture}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

\begin{frame}[c]

\frametitle{Subtleties}

\begin{itemize}

\item<1-> Can Bob write \pcode{file}?

\item<2-> What if Bob is member of \pcode{staff}?

\end{itemize}\bigskip

\begin{center}

${\underbrace{\Large\texttt{-}}_{\text{\makebox[0mm]{directory}}}}

 \;{\underbrace{\Large\texttt{r{}-{}-}}_{\text{user}}}\,

 {\underbrace{\Large\texttt{r{}w{}-}}_{\text{group}}}\,

 {\underbrace{\Large\texttt{r{}w{}x}}_{\text{other}}}\;\;\;

 \Large\texttt{bob}\;\;\texttt{staff}\;\;\texttt{file}$

\end{center}  

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Login Processes}

\begin{itemize}

\item login processes run under UID $=$ \pcode{0}\medskip 

\begin{center}

\texttt{ps -axl | grep login}

\end{center}\medskip

\item after login, shells run under UID $=$ user (e.g.~501)\medskip

\begin{center}

\texttt{id cu}

\end{center}\medskip\pause

\item non-root users are not allowed to change the UID --- would break 

access control

\item but needed for example for accessing \texttt{passwd}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Setuid and Setgid}

The solution is that Unix file permissions are 9 + \underline{2 Bits}:

\alert{\bf Setuid} and \alert{\bf Setgid} bits

\begin{itemize}

\item When a file with setuid is executed, the resulting process will

  assume the UID given to the \underline{owner} of the file.

\item This enables users to create processes as root (or another

  user).\bigskip

\item Essential for changing passwords, for example.

\end{itemize}

\begin{center}

\texttt{chmod 4755 fobar\_file}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\small

\lstinputlisting[language={},numbers=none,xleftmargin=-6mm]{lst}

\begin{center}

\begin{tabular}{@{\hspace{-24mm}}ll}

members of group staff: & ping, bob, emma\\ 

members of group students: & emma\\

\end{tabular}

\end{center}

\begin{center}

\begin{tabular}{@{\hspace{-7mm}}r|c|c|c|c|c@{}}

        & manual.txt & report.txt & microedit & src/code.c & src/code.h \\\hline

ping & & & & &\\\hline

bob & & & & &\\\hline

emma   & & & & &\\

\end{tabular}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Discretionary Access Control}

\small

\begin{itemize}

\item Access to objects (files, directories, devices, etc.) is

permitted based on user identity. Each object is owned by a

user. Owners can specify freely (at their discretion) how they want to

share their objects with other users, by specifying which other users

can have which form of access to their objects.\medskip

\item Discretionary access control is implemented on any modern multi-user

OS (Unix, Windows NT, etc.).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Mandatory Access Control}

\small

\begin{itemize}

\item Access to objects is controlled by a system-wide policy, for

  example to prevent certain flows of information. In some forms, the

  system maintains security labels for both objects and subjects

  (processes, users) based on which access is granted or

  denied. Labels can change as the result of an access. Security

  policies are enforced without the cooperation of users or

  programs.\medskip

\item This is implemented in banking or military operating system 

  versions (SELinux).\pause

\item A simple example: Air Gap Security. Uses a completely separate network

and computer hardware for different application classes (Bin Laden, Bruce Schneier had

airgaps).\pause

\item What do we want to protect: Secrecy or Integrity?

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{The Bell-LaPadula Model}

\small

\begin{itemize}

\item Formal policy model for mandatory access control in a military

  multi-level security environment. All subjects (processes, users,

  terminals, files, windows, connections) are labeled

  with a confidentiality level, e.g.

\begin{center}

unclassified < confidential < secret < top secret

\end{center}\medskip

\item The system policy automatically prevents the flow of information

  from high-level objects to lower levels. A process that reads top

  secret data becomes tagged as top secret by the operating system, as

  will be all files into which it writes afterwards.

%Each user has a maximum allowed confidentiality level specified and

%cannot receive data beyond that level. A selected set of trusted

%subjects is allowed to bypass the restrictions, in order to permit

%the declassification of information.

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \begin{frame}[c]

  \frametitle{Bell-LaPadula}