\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\usetikzlibrary{arrows}

\usetikzlibrary{shapes}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\renewcommand{\slidecaption}{SEN 04, King's College London}

\newcommand{\bl}[1]{\textcolor{blue}{#1}}  

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Security Engineering (4)\\[-3mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

\normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also home work is there)\\

  \end{tabular}

  \end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\includegraphics[scale=0.34]{../pics/trainwreck.jpg}\\

last week: buffer overflow attacks

\end{center}

\begin{itemize}

\item no ``cheating'' needed for format string attacks;

\item the main point, no real cheating (Facebook no; printer, router

etc yes)

\end{itemize}   

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Survey: Thanks!}

\small

\begin{itemize}

\item ``Would be good, if you provide more detailed explanations. I feel 

your slides are not as structured as they could be.''

\item ``Please consider reference book chapters to cover core subject

areas.''\pause

\item ``The homework questions don't come directly from the 

slides. So must go look things up.''

\item ``Could you please put the homework answers online, perhaps

just before the exam. That's late enough where we should have done

it and if not, we're screwed already then.''

\item ``Could you provide a brief basic answers to sheets for reference

and not to be relied on.''

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\includegraphics[scale=0.45]{../pics/trainwreck.jpg}\\

last week: buffer overflow attacks

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Two General Counter\\[-1mm] 

            Measures against BOAs etc\end{tabular}}

Both try to reduce the attack surface:\bigskip

\begin{itemize}

\item \alert{\bf unikernels} -- the idea is to not have

an operating system at all

\item all functionality of the server is implemented in a

single, stand-alone program

\item all functionality an operating system would normally

provide (network stack, file system) is available through

libraries

\item the best known unikernel is MirageOS using Ocaml

(\url{https://mirage.io})

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

  \begin{tikzpicture}[scale=1]

  \draw[line width=1mm] (-.3, 0) rectangle (1.5,2);

  \draw (4.7,1) node {Internet};

  \draw (-2.7,1.7) node {\footnotesize Application};

  \draw (0.6,1.7) node {\footnotesize Interface};

  \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] process\end{tabular}};

  \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}};

  \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);

  \draw[white] (1.7,1) node (X) {};

  \draw[white] (3.7,1) node (Y) {};

  \draw[red, <->, line width = 2mm] (X) -- (Y);

  \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1);

  \end{tikzpicture}

\end{center}

\begin{itemize}

\item the idea is make the attack surface smaller and mitigate the

  consequences of an attack

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

\begin{frame}[c]

\begin{itemize}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Unix-Style Access Control}

\small

\begin{itemize}

\item 

Q: ``I am using Windows. Why should I care?'' \\ 

A: In Windows you have similar AC:

\begin{center}

\begin{tabular}{l}

administrators group\\ 

\hspace{5mm}(has complete control over the machine)\\

authenticated users\\

server operators\\

power users\\

network configuration operators

\end{tabular}

\end{center}\medskip

\item Modern versions of Windows have more fine-grained AC than Unix;

  they do not have a setuid bit, but have \texttt{runas} (asks for a

  password).\pause

\item OS-provided access control can \alert{\bf add} to your security.

  (defence in depth)

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Weaknesses of Unix AC}

Not just restricted to Unix:

\begin{itemize}

\item if you have too many roles (i.e.~too finegrained AC), then

  hierarchy is too complex\\ \textcolor{gray}{you invite situations

    like\ldots let's be root}\bigskip

\item you can still abuse the system\ldots

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Cron''-Attack}

The idea is to trick a privileged person to do something on your

behalf:

\begin{itemize}

\item root:\\\texttt{rm /tmp/*/*}\bigskip\bigskip\pause

\footnotesize

\begin{minipage}{1.1\textwidth}

\textcolor{gray}{the shell behind the scenes:}\\

\textcolor{gray}{\texttt{rm /tmp/dir$_1$/file$_1$ /tmp/dir$_1$/file$_2$ /tmp/dir$_2$/file$_1$ \ldots}}\bigskip\\

\textcolor{gray}{this takes time}

\end{minipage}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Cron''-Attack}

\begin{enumerate}

\item attacker \textcolor{gray}{(creates a fake passwd file)}\\ 

\texttt{mkdir /tmp/a; cat > /tmp/a/passwd}\medskip

\item root \textcolor{gray}{(does the daily cleaning)}\\

\texttt{rm /tmp/*/*}\medskip\\

\hspace{2cm}\textcolor{gray}{\small records that \texttt{/tmp/a/passwd}}\\ 

\hspace{2cm}\textcolor{gray}{\small should be deleted, but does not do it yet}\medskip\\

\item attacker \textcolor{gray}{(meanwhile deletes the fake passwd file, and establishes a link to 

the real passwd file)}\\

\texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a}\\

\item root now deletes  the real passwd file

\end{enumerate}

\only<2>{

\begin{textblock}{11}(2,5)

\begin{bubble}[8cm]

\normalsize To prevent this kind of attack, you need additional

policies (don't do such operations as root).

\end{bubble}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Login Process}

\begin{itemize}

\item login processes run under UID $=$ \pcode{0}\medskip 

\begin{center}

\texttt{ps -axl | grep login}

\end{center}\medskip

\item after login, shells run under UID $=$ user (e.g.~501)\medskip

\begin{center}

\texttt{id cu}

\end{center}\medskip\pause

\item non-root users are not allowed to change the UID --- would break 

access control

\item but needed for example for accessing \texttt{passwd}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Setuid and Setgid}

The solution is that Unix file permissions are 9 + \underline{2 Bits}:

\begin{itemize}

\item When a file with setuid is executed, the resulting process will

  assume the UID given to the \underline{owner} of the file.

\item This enables users to create processes as root (or another

  user).\bigskip

\item Essential for changing passwords, for example.

\end{itemize}

\begin{center}

\texttt{chmod 4755 fobar\_file}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Discretionary Access Control}

\begin{itemize}

\item Access to objects (files, directories, devices, etc.) is

permitted based on user identity. Each object is owned by a

user. Owners can specify freely (at their discretion) how they want to

share their objects with other users, by specifying which other users

can have which form of access to their objects.\medskip

\item Discretionary access control is implemented on any modern multi-user

OS (Unix, Windows NT, etc.).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Mandatory Access Control}

\begin{itemize}

\item Access to objects is controlled by a system-wide policy, for

  example to prevent certain flows of information. In some forms, the

  system maintains security labels for both objects and subjects

  (processes, users) based on which access is granted or

  denied. Labels can change as the result of an access. Security

  policies are enforced without the cooperation of users or

  programs.\medskip

\item This is implemented in banking or military operating system 

  versions (SELinux).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Discretionary Access Control}

In its most generic form usually given by an \alert{Access Control

  Matrix} of the form

\begin{center}

\begin{tabular}{r|c|c|c}

                 & /mail/jane & edit.exe & postfix \\\hline

jane          & r, w & r, x & r, x\\\hline

john          & $\varnothing$ & r, w, x&  r, x\\\hline

postfix  & a & $\varnothing$ &  r, x\\

\end{tabular}

\end{center}

access privileges: {\bf r}ead, {\bf w}rite, e{\bf x}ecute, {\bf a}ppend

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\small

\lstinputlisting[language={},numbers=none,xleftmargin=-6mm]{lst}

\begin{center}

\begin{tabular}{@{\hspace{-24mm}}ll}

members of group staff: & ping, bob, emma\\ 

members of group students: & emma\\

\end{tabular}

\end{center}

\begin{center}

\begin{tabular}{@{\hspace{-7mm}}r|c|c|c|c|c@{}}

        & manual.txt & report.txt & microedit & src/code.c & src/code.h \\\hline

ping & & & & &\\\hline

bob & & & & &\\\hline

emma   & & & & &\\

\end{tabular}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Mandatory Access Control}

\small

\begin{itemize}

\item Restrictions to allowed information flows are not decided at the

  user's discretion (as with Unix \pcode{chmod}), but instead enforced

  by system policies.

\item Mandatory access control mechanisms are aimed in particular at

  preventing policy violations by untrusted programs, which typically

  have at least the same access privileges as the invoking

  user.\medskip\pause

Simple example: Air Gap Security. Uses a completely separate network

and computer hardware for different application classes.

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{The Bell-LaPadula Model}

\small

\begin{itemize}

\item Formal policy model for mandatory access control in a military

  multi-level security environment. All subjects (processes, users,

  terminals, files, windows, connections) are labeled

  with a confidentiality level, e.g.

\begin{center}

unclassified < confidential < secret < top secret

\end{center}\medskip

\item The system policy automatically prevents the flow of information

  from high-level objects to lower levels. A process that reads top

  secret data becomes tagged as top secret by the operating system, as