\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\usetikzlibrary{arrows}

\usetikzlibrary{shapes}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\renewcommand{\slidecaption}{SEN 04, King's College London}

\newcommand{\bl}[1]{\textcolor{blue}{#1}}  

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Security Engineering (4)\\[-3mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

\normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also home work is there)\\

  \end{tabular}

  \end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Survey: Thanks!}

\small

\begin{itemize}

\item ``Would be good, if you provide more detailed explanations. I feel 

your slides are not as structured as they could be.''

\item ``Please consider reference book chapters to cover core subject

areas.''\pause

\item ``The homework questions don't come directly from the 

slides. So must go look things up.''

\item ``Could you please put the homework answers online, perhaps

just before the exam. That's late enough where we should have done

it and if not, we're screwed already then.''

\item ``Could you provide a brief basic answers to sheets for reference

and not to be relied on.''

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\includegraphics[scale=0.45]{../pics/trainwreck.jpg}\\

last week: buffer overflow attacks

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]

\frametitle{D-Link Wifi Router, BOA}

\small

As a proof-of-concept, the following URL allows 

attackers to control the return value saved on 

the stack (the vulnerability is triggered when

executing \pcode{"/usr/sbin/widget"}):

\begin{center}\footnotesize 

\pcode{curl http://<target ip>/post_login.xml?hash=AAA...AAABBBB}

\end{center}

The value of the "hash" HTTP GET parameter consists of

292 occurrences of the \pcode{'A'} character, followed by four 

occurrences of character \pcode{'B'}. In our lab setup, characters 

\pcode{'B'} overwrite the saved program counter (\pcode{\%ra}).\bigskip

\begin{tabular}{@{}ll}

Discovery date: & 06/03/2013\\

Release date:   & 02/08/2013

\end{tabular}\bigskip

\footnotesize

\hfill\url{http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt} 

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]

\frametitle{D-Link Backdoors}

D-Link router flaw lets anyone login through "Joel's Backdoor":\medskip

\begin{quote}\rm\small

If you tell your browser to identify itself as Joel's backdoor, instead of (say) 

as Mozilla/5.0 AppleWebKit/536.30.1 Version/6.0.5, you're in without authentication.\medskip

"What is this string," I hear you ask?

You will laugh: it is\pause 

\begin{center}\large

\pcode{xmlset_roodkcableoj28840ybtide}

\end{center}

\end{quote}\bigskip\bigskip

\hfill\footnotesize October 15, 2013\\

\hfill\footnotesize\url{http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]

CVE-2014-0476 \pcode{chkrootkit} vulnerability 4 Jun'14\medskip

\begin{quote}\rm\small

Hi,

we just found a serious vulnerability in the chkrootkit package, which

may allow local attackers to gain root access to a box in certain

configurations (\pcode{/tmp} not mounted noexec). Steps to reproduce:

\begin{itemize}

\item Put an executable file named \pcode{update} with non-root owner in 

\pcode{/tmp} (not mounted noexec, obviously)

\item Run chkrootkit (as uid \pcode{0})

\end{itemize}

Result: The file \pcode{/tmp/update} will be executed as root, thus effectively

rooting your box, if malicious content is placed inside the file.

If an attacker knows you are periodically running chkrootkit (like in

\pcode{cron.daily}) and has write access to \pcode{/tmp} (not mounted noexec), he may

easily take advantage of this.

\end{quote}

\mbox{}\\[-10mm]

\hfill\footnotesize\url{http://seclists.org/oss-sec/2014/q2/430}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Access Control in Unix}

\begin{itemize}

\item access control provided by the OS

\item authenticate principals

\item mediate access to files, ports, processes etc according to

  \alert{roles} (user ids)\\

\item roles get attached with privileges\bigskip\\

\hspace{8mm}

\begin{bubble}[8cm]

\alert{principle of least privilege:}\\

users and programs should only have as much privilege as they need to

accomplish a task

\end{bubble}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{Access Control in Unix (2)}

\begin{itemize}

\item privileges are specified by file access permissions (``everything is a file'')\medskip 

\item there are 9 (plus 2) bits that specify the permissions of a file

\begin{center}

\begin{tabular}{l}

\texttt{\$ ls -la}\\

\texttt{-rwxrw-r-{}- \hspace{3mm} foo\_file.txt}

\end{tabular}

\end{center}

\end{itemize}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Login Process}

\begin{itemize}

\item login processes run under UID $=$ \pcode{0}\medskip 

\begin{center}

\texttt{ps -axl | grep login}

\end{center}\medskip

\item after login, shells run under UID $=$ user (e.g.~501)\medskip

\begin{center}

\texttt{id cu}

\end{center}\medskip\pause

\item non-root users are not allowed to change the UID --- would break 

access control

\item but needed for example for accessing \texttt{passwd}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Setuid and Setgid}

The solution is that Unix file permissions are 9 + \underline{2 Bits}:

\alert{Setuid} and \alert{Setgid} bits

\begin{itemize}

\item When a file with setuid is executed, the resulting process will

  assume the UID given to the \underline{owner} of the file.

\item This enables users to create processes as root (or another

  user).\bigskip

\item Essential for changing passwords, for example.

\end{itemize}

\begin{center}

\texttt{chmod 4755 fobar\_file}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Discretionary Access Control}

\begin{itemize}

\item Access to objects (files, directories, devices, etc.) is

permitted based on user identity. Each object is owned by a

user. Owners can specify freely (at their discretion) how they want to

share their objects with other users, by specifying which other users

can have which form of access to their objects.\medskip

\item Discretionary access control is implemented on any modern multi-user

OS (Unix, Windows NT, etc.).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Mandatory Access Control}

\begin{itemize}

\item Access to objects is controlled by a system-wide policy, for

  example to prevent certain flows of information. In some forms, the

  system maintains security labels for both objects and subjects

  (processes, users) based on which access is granted or

  denied. Labels can change as the result of an access. Security

  policies are enforced without the cooperation of users or

  programs.\medskip

\item This is implemented in banking or military operating system 

  versions (SELinux).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Discretionary Access Control}

In its most generic form usually given by an \alert{Access Control

  Matrix} of the form

\begin{center}

\begin{tabular}{r|c|c|c}

                 & /mail/jane & edit.exe & postfix \\\hline

jane          & r, w & r, x & r, x\\\hline

john          & $\varnothing$ & r, w, x&  r, x\\\hline

postfix  & a & $\varnothing$ &  r, x\\

\end{tabular}

\end{center}

access privileges: {\bf r}ead, {\bf w}rite, e{\bf x}ecute, {\bf a}ppend

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\small

\lstinputlisting[language={},numbers=none,xleftmargin=-6mm]{lst}

\begin{center}

\begin{tabular}{@{\hspace{-24mm}}ll}

members of group staff: & ping, bob, emma\\ 

members of group students: & emma\\

\end{tabular}

\end{center}

\begin{center}

\begin{tabular}{@{\hspace{-7mm}}r|c|c|c|c|c@{}}

        & manual.txt & report.txt & microedit & src/code.c & src/code.h \\\hline

ping & & & & &\\\hline

bob & & & & &\\\hline

emma   & & & & &\\

\end{tabular}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Mandatory Access Control}

\small

\begin{itemize}

\item Restrictions to allowed information flows are not decided at the

  user's discretion (as with Unix \pcode{chmod}), but instead enforced

  by system policies.

\item Mandatory access control mechanisms are aimed in particular at