\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{beamerthemeplaincu}

%\usepackage[T1]{fontenc}

\usepackage[latin1]{inputenc}

\usepackage{mathpartir}

\usepackage[absolute,overlay]{textpos}

\usepackage{ifthen}

\usepackage{tikz}

\usepackage{pgf}

\usepackage{calc} 

\usepackage{ulem}

\usepackage{courier}

\usepackage{listings}

\renewcommand{\uline}[1]{#1}

\usetikzlibrary{arrows}

\usetikzlibrary{automata}

\usetikzlibrary{shapes}

\usetikzlibrary{shadows}

\usetikzlibrary{positioning}

\usetikzlibrary{calc}

\usepackage{graphicx} 

\definecolor{javared}{rgb}{0.6,0,0} % for strings

\definecolor{javagreen}{rgb}{0.25,0.5,0.35} % comments

\definecolor{javapurple}{rgb}{0.5,0,0.35} % keywords

\definecolor{javadocblue}{rgb}{0.25,0.35,0.75} % javadoc

\lstset{language=Java,

	basicstyle=\ttfamily,

	keywordstyle=\color{javapurple}\bfseries,

	stringstyle=\color{javagreen},

	commentstyle=\color{javagreen},

	morecomment=[s][\color{javadocblue}]{/**}{*/},

	numbers=left,

	numberstyle=\tiny\color{black},

	stepnumber=1,

	numbersep=10pt,

	tabsize=2,

	showspaces=false,

	showstringspaces=false}

\lstdefinelanguage{scala}{

  morekeywords={abstract,case,catch,class,def,%

    do,else,extends,false,final,finally,%

    for,if,implicit,import,match,mixin,%

    new,null,object,override,package,%

    private,protected,requires,return,sealed,%

    super,this,throw,trait,true,try,%

    type,val,var,while,with,yield},

  otherkeywords={=>,<-,<\%,<:,>:,\#,@},

  sensitive=true,

  morecomment=[l]{//},

  morecomment=[n]{/*}{*/},

  morestring=[b]",

  morestring=[b]',

  morestring=[b]"""

}

\lstset{language=Scala,

	basicstyle=\ttfamily,

	keywordstyle=\color{javapurple}\bfseries,

	stringstyle=\color{javagreen},

	commentstyle=\color{javagreen},

	morecomment=[s][\color{javadocblue}]{/**}{*/},

	numbers=left,

	numberstyle=\tiny\color{black},

	stepnumber=1,

	numbersep=10pt,

	tabsize=2,

	showspaces=false,

	showstringspaces=false}

% beamer stuff 

\renewcommand{\slidecaption}{APP 03, King's College London, 22 October 2014}

\makeatletter

\def\verbatim@font{\consolas\footnotesize}

\makeatother

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}<1>[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Access Control and \\[-3mm] 

  \LARGE Privacy Policies (4)\\[-6mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

\normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also home work is there)\\

  \end{tabular}

  \end{center}

\end{frame}}

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\begin{center}

\includegraphics[scale=0.45]{pics/trainwreck.jpg}\\

two weeks ago: buffer overflow attacks

\end{center}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]

\frametitle{D-Link Router, Buffer Overflows}

\begin{verbatim}

As a proof-of-concept, the following URL allows 

attackers to control the return value saved on 

the stack (the vulnerability is triggered when

executing "/usr/sbin/widget"):

 curl http://<target ip>/post_login.xml?hash=AAA...AAABBBB

The value of the "hash" HTTP GET parameter consists of

292 occurrences of the 'A' character, followed by four 

occurrences of character 'B'. In our lab setup, characters 

'B' overwrite the saved program counter (%ra).

Discovery date: 06/03/2013

Release date:   02/08/2013

\end{verbatim}

\mbox{}\footnotesize\hfill\url{http://pastebin.com/vbiG42VD}  

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]

\frametitle{Backdoors}

D-Link router flaw lets anyone login through "Joel's Backdoor":\medskip

If you tell your browser to identify itself as Joel's backdoor, instead of (say) 

as Mozilla/5.0 AppleWebKit/536.30.1 Version/6.0.5, you're in without authentication.\medskip

"What is this string," I hear you ask?

You will laugh: it is 

\begin{verbatim}

xmlset_roodkcableoj28840ybtide

\end{verbatim}

\hfill\footnotesize October 15, 2013\\

\hfill\tiny\url{http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{Access Control in Unix}

\begin{itemize}

\item access control provided by the OS

\item authenticate principals (login)

\item mediate access to files, ports, processes according to \alert{roles} (user ids)\\

\item roles get attached with privileges\bigskip\\%

\hspace{8mm}

\begin{tikzpicture}

\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

{\begin{minipage}{8cm}

\alert{principle of least privilege:}\\

programs should only have as much privilege as they need 

\end{minipage}};

\end{tikzpicture}

\end{itemize}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{Access Control in Unix (2)}

\begin{itemize}

\item the idea is to restrict access to files and therefore lower the consequences of an attack\\[1cm]\mbox{}

\end{itemize}

\begin{textblock}{1}(2.5,9.5)

  \begin{tikzpicture}[scale=1]

  \draw[line width=1mm] (-.3, 0) rectangle (1.5,2);

  \draw (4.7,1) node {Internet};

  \draw (0.6,1.7) node {\footnotesize Interface};

  \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] process\end{tabular}};

  \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}};

  \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);

  \draw[white] (1.7,1) node (X) {};

  \draw[white] (3.7,1) node (Y) {};

  \draw[red, <->, line width = 2mm] (X) -- (Y);

  \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1);

  \end{tikzpicture}

\end{textblock}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

\newcommand{\bl}[1]{\textcolor{blue}{#1}}  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Access Control}

\begin{itemize}

\item \bl{Discretionary Access Control:}\mbox{}\medskip\\
\small Access to objects (files, directories, devices, etc.) is permitted 

based on user identity. Each object is owned by a user. Owners can 

specify freely (at their discretion) how they want to share their objects 

with other users, by specifying which other users can have which 

form of access to their objects.\medskip

Discretionary access control is implemented on any multi-user OS 

(Unix, Windows NT, etc.).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Access Control}

\begin{itemize}

\item \bl{Mandatory Access Control:}\mbox{}\medskip\\
\small Access to objects is controlled by a system-wide policy, for example 

to prevent certain flows of information. In some forms, the system maintains 

security labels for both objects and subjects (processes, users), based on 

which access is granted or denied. Labels can change as the result of an 

access. Security policies are enforced without the cooperation of users or 

application programs.\medskip

This is implemented today in special military operating system versions

(SELinux).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{Discretionary Access Control}

In its most generic form usually given by an Access Control Matrix 

of the form

\begin{center}

\begin{tabular}{r|c|c|c}

                 & /mail/jane & edit.exe & sendmail \\\hline

jane          & r, w & r, x & r, x\\\hline

john          & $\varnothing$ & r, w, x&  r, x\\\hline

sendmail  & a & $\varnothing$ &  r, x\\

\end{tabular}

\end{center}

access privileges: {\bf r}ead, {\bf w}rite, e{\bf x}ecute, {\bf a}ppend

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Mandatory Access Control}

\begin{itemize}

\item Restrictions to allowed information flows are not decided at the user’s 

discretion (as with Unix chmod), but instead enforced by system policies.

\item Mandatory access control mechanisms are aimed in particular at 

preventing policy violations by untrusted application software, which 

typically have at least the same access privileges as the invoking user.\medskip

Simple example: Air Gap Security.
Uses completely separate network and computer hardware for different application classes.

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{The Bell/LaPadula Model}

\begin{itemize}

\item Formal policy model for mandatory access control in a military multi-level security environment.
All subjects (processes, users, terminals) and data objects (files, directories, windows, connections) are labeled with a confidentiality level, e.g. 

\begin{center}

unclassified < confidential < secret < top secret.

\end{center}

\item 
The system policy automatically prevents the flow of information from high-level objects to lower levels. A process that reads top secret data becomes tagged as top secret by the operating system, as will be all files into which it writes afterwards. 

%Each user has a maximum allowed confidentiality level specified and cannot receive data beyond that level. A selected set of trusted subjects is allowed to bypass the restrictions, in order to permit the declassification of information.

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}[c]

  \frametitle{Bell-LaPadula}

  \small

  \begin{itemize}

  \item \alert{Read Rule}: A principal \bl{$P$} can read an object \bl{$O$} if and only if

  \bl{$P$}'s security level is at least as high as \bl{$O$}'s.

  \item \alert{Write Rule}: A principal \bl{$P$} can write an object \bl{$O$} if and only if

  \bl{$O$}'s security level is at least as high as \bl{$P$}'s.\medskip

  \item Meta-Rule: All principals in a system should have a sufficiently high security level

  in order to access an object.

  \end{itemize}\bigskip

  This restricts information flow $\Rightarrow$ military\bigskip\bigskip\pause

  Bell-LaPadula: {\bf `no read up'} - {\bf `no write down'}

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}[c]

  \frametitle{\begin{tabular}{c}Principle of\\[-2mm] Least Privilege\end{tabular}}

  \begin{tikzpicture}

  \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

  {\normalsize\color{darkgray}

  \begin{minipage}{10cm}\raggedright

  A principal should have as few privileges as possible to access a resource.

  \end{minipage}};

  \end{tikzpicture}\bigskip\bigskip

  \small

  \begin{itemize}

  \item Bob ($T\!S$) and Alice ($S$) want to communicate

  \item[] $\Rightarrow$ Bob should lower his security level

  \end{itemize}

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}[c]

  \frametitle{Biba Policy}

  \small

  Data Integrity (rather than data confidentiality)

  \begin{itemize}

  \item Biba: {\bf `no read down'} - {\bf `no write up'}

  \item \alert{Read Rule}: A principal \bl{$P$} can read an object \bl{$O$} if and only if

  \bl{$P$}'s security level is lower or equal than \bl{$O$}'s.

  \item \alert{Write Rule}: A principal \bl{$P$} can write an object \bl{$O$} if and only if

  \bl{$O$}'s security level is lower or equal than \bl{$P$}'s.

  \end{itemize}\bigskip\bigskip\pause

  E.g.~Firewalls: you can read from inside the firewall, but not from outside\\

  Phishing: you can look at an approved PDF, but not one from a random email\\

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{\begin{tabular}{@ {}c@ {}}Security Levels (2)\end{tabular}}

\begin{itemize}

\item Bell --- La Padula preserves data secrecy, but not data integrity\bigskip\pause

\item Biba model is for data integrity  

\begin{itemize}

\item read: your own level and above

\item write: your own level and below

\end{itemize}

\end{itemize}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{Shared Access Control}

\begin{center}

\includegraphics[scale=0.7]{pics/pointsplane.jpg}

\end{center}

\begin{textblock}{11}(10.5,10.5)

\small

To take an action you\\[-1mm] 

need at least either:

\begin{itemize}

\item 1 CEO\\[-5mm]

\item 2 MDs, or\\[-5mm]

\item 3 Ds

\end{itemize}

\end{textblock}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{Lessons from Access Control}

Not just restricted to Unix:

\begin{itemize}

\item if you have too many roles (i.e.~too finegrained AC), then 

	hierarchy is too complex\\

	\textcolor{gray}{you invite situations like\ldots let's be root}\bigskip

\item you can still abuse the system\ldots

\end{itemize}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}[t]

  \frametitle{Protocols}

\mbox{} 

\begin{tabular}{l}

{\Large \bl{$A\;\rightarrow\; B : \ldots$}}\\

\onslide<2->{\Large \bl{$B\;\rightarrow\; A : \ldots$}}\\

\onslide<2->{\Large \;\;\;\;\;\bl{$:$}}\bigskip

\end{tabular}  

 \begin{itemize}

 \item by convention \bl{$A$}, \bl{$B$} are named principals \bl{Alice\ldots}\\

 but most likely they are programs, which just follow some instructions (they are more like roles)\bigskip

\item<2-> indicates one ``protocol run'', or session,  which specifies some 

order in the communication

\item<2-> there can be several sessions in parallel (think of wifi routers) 

\end{itemize} 

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{A mutual authentication protocol}

\begin{center}

\begin{tabular}{ll}

\bl{$A \rightarrow B$:} & \bl{$N_a$}\\  

\bl{$B \rightarrow A$:} & \bl{$\{N_a, N_b\}_{K_{ab}}$}\\

\bl{$A \rightarrow B$:} & \bl{$N_b$}\\

\end{tabular}

\end{center}\pause

An attacker \bl{$E$} can launch an impersonation attack by 

intercepting all messages for \bl{$B$} and make \bl{$A$} decrypt her own challenges.

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{Nonces}