\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\renewcommand{\slidecaption}{SEN 03, King's College London}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Security Engineering (3)\\[-3mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

  \normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also home work is there)

  \end{tabular}

  \end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Buffer Overflow Attacks}

\begin{center}

\begin{columns}[b]

\begin{column}{.4\textwidth}

\centering

\includegraphics[scale=0.3]{../pics/barrier.jpg}\\

lectures so far

\end{column}

\begin{column}{.4\textwidth}

\centering

\includegraphics[scale=0.32]{../pics/trainwreck.jpg}\\

today

\end{column}

\end{columns}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Smash the Stack for Fun\ldots}

\begin{itemize}

\item \alert{\bf Buffer Overflow Attacks (BOAs)} or\\ 

{\bf Smashing the Stack Attacks}\medskip

\item unfortunately one of the most popular attacks\\ 

($>$ 50\% of security incidents reported at CERT are related 

to buffer overflows)

\begin{flushright}

\small\url{http://www.kb.cert.org/vuls}

\end{flushright}

\medskip

\item made popular in an article from 1996 by Elias Levy

(also known as Aleph One):\\

\begin{center}

{\bf ``Smashing The Stack For Fun and Profit''}

\end{center}\medskip

\begin{flushright}

\small\url{http://phrack.org/issues/49/14.html}

\end{flushright} 

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A Long Printed ``Twice''}

\mbox{}\\[-10mm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C0.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Printing Out ``Zombies''}

\mbox{}\\[-10mm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C1.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Login'' Function (1)}

\mbox{}\\[-10mm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C2a.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Login'' Function (2)}

\mbox{}\\[-10mm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=-3mm]{../progs/C2b.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{What the Hell Is Going On?}

\begin{itemize}

\item Let's start with a very simple program:

\end{itemize}

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/example1.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Memory}

\begin{itemize}

\item each process will get a chunk of memory that is

      organised as follows: 

\end{itemize}

\begin{center}

  \begin{tikzpicture}[scale=0.8]

  %\draw[step=1cm] (-3,-3) grid (3,3);

  \draw[line width=1mm] (-2, -3) rectangle (2,3);

  \draw[line width=1mm] (-2,1) -- (2,1);

  \draw[line width=1mm] (-2,-1) -- (2,-1);

  \draw (0,2) node {\large\tt text};

  \draw (0,0) node {\large\tt heap};

  \draw (0,-2) node {\large\tt stack};

  \draw (-2.7,3) node[anchor=north east] {\tt\begin{tabular}{@{}l@{}}lower\\ address\end{tabular}};

  \draw (-2.7,-3) node[anchor=south east] {\tt\begin{tabular}{@{}l@{}}higher\\ address\end{tabular}};

  \draw[->, line width=1mm] (-2.5,3) -- (-2.5,-3);

  \draw (2.7,-2) node[anchor=west] {\tt grows};

  \draw (2.7,-3) node[anchor=south west] {\tt\footnotesize older};

  \draw (2.7,-1) node[anchor=north west] {\tt\footnotesize newer};

  \draw[|->, line width=1mm] (2.5,-3) -- (2.5,-1);

  \end{tikzpicture}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{The Stack}

\begin{textblock}{7}(1,1)

  \begin{tikzpicture}[scale=0.8]

  %\draw[step=1cm] (-3,-1) grid (3,8);

  \draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);

  \draw[line width=1mm] (-1,-1.2) -- (-1,7.4);

  \draw[line width=1mm] ( 1,-1.2) -- ( 1,7.4);

  \draw (0,-1) node[anchor=south] {\tt main};

  \draw[line width=1mm] (-1,0) -- (1,0);

  \draw (0,0) node[anchor=south] {\tt arg$_3$=3};

  \draw[line width=1mm] (-1,1) -- (1,1);

  \draw (0,1) node[anchor=south] {\tt arg$_2$=2};

  \draw[line width=1mm] (-1,2) -- (1,2);

  \draw (0,2) node[anchor=south] {\tt arg$_1$=1};

  \draw[line width=1mm] (-1,3) -- (1,3);

  \draw (0,3.1) node[anchor=south] {\tt ret};

  \draw[line width=1mm] (-1,4) -- (1,4);

  \draw (0,4) node[anchor=south] {\small\tt last sp};

  \draw[line width=1mm] (-1,5) -- (1,5);

  \draw (0,5) node[anchor=south] {\tt buf$_1$};

  \draw[line width=1mm] (-1,6) -- (1,6);

  \draw (0,6) node[anchor=south] {\tt buf$_2$};

  \draw[line width=1mm] (-1,7) -- (1,7);

  \draw (2,6.1) node[anchor=south] {\code{$esp}};

  \draw[<-,line width=0.5mm] (1.1,7) -- (2.5,7);

  \draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5) -- (1.8, 0) -- (1.1,0); 

  \draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);

  \draw (2.6,3.1) node[anchor=south west] {\tt back to main()};

  \draw[->,red,line width=2mm] (2.5,0.1) -- (4.2,0.1);

\end{tikzpicture}

\end{textblock}

\begin{textblock}{7}(6.4,8)

\begin{bubble}[6.8cm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=5mm]{../progs/example1.c} 

\end{bubble}

\end{textblock}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Behind the Scenes}

\only<2->{

\begin{textblock}{7}(1,0.6)

\begin{bubble}[6.8cm]

\footnotesize

\lstinputlisting[language=C,

                 xleftmargin=5mm,

                 belowskip=-1mm,

                 aboveskip=-1mm]{../progs/example1.c} 

\end{bubble}

\end{textblock}}

\only<2>{

\begin{textblock}{7}(0.5,6.6)

\footnotesize

\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl},xleftmargin=5mm,numbers=none]{../progs/example1a.s} 

\end{textblock}}

\only<3>{

\begin{textblock}{7}(0.5,6.6)

\footnotesize

\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl,movw},xleftmargin=5mm,numbers=none]{../progs/example1b.s} 

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Overwriting the Stack}

\begin{textblock}{7}(1,2)

  \begin{tikzpicture}[scale=0.8]

  %\draw[step=1cm] (-3,-1) grid (3,8);

  \draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);

  \draw[line width=1mm] (-1,-1.2) -- (-1,6.4);

  \draw[line width=1mm] ( 1,-1.2) -- ( 1,6.4);

  \draw (0,-1) node[anchor=south] {\tt main};

  \draw[line width=1mm] (-1,0) -- (1,0);

  \draw (0,0) node[anchor=south] {\tt arg$_3$=3};

  \draw[line width=1mm] (-1,1) -- (1,1);

  \draw (0,1) node[anchor=south] {\tt arg$_2$=2};

  \draw[line width=1mm] (-1,2) -- (1,2);

  \draw (0,2) node[anchor=south] {\tt arg$_1$=1};

  \draw[line width=1mm] (-1,3) -- (1,3);

  \draw (0,3.1) node[anchor=south] {\tt ret};

  \draw[line width=1mm] (-1,4) -- (1,4);

  \draw (0,4) node[anchor=south] {\small\tt last sp};

  \draw[line width=1mm] (-1,5) -- (1,5);

  \draw (0,5) node[anchor=south] {\tt buf};

  \draw[line width=1mm] (-1,6) -- (1,6);

  \draw (2,5.1) node[anchor=south] {\code{$esp}};

  \draw[<-,line width=0.5mm] (1.1,6) -- (2.5,6);

  \draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5);

  \draw (2.5,4.1) node[anchor=south] {\code{BBBB}};

  \draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);

  \draw (2.6,3.1) node[anchor=south west] {\tt jump to \code{\\x080483f4}};

\end{tikzpicture}

\end{textblock}

\begin{textblock}{7}(1,13.5)

\code{char buf[8] = "AAAAAAAABBBB\\xf4\\x83\\x04\\x08\\x00"}

\end{textblock}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Payloads}

\begin{itemize}

\item the idea is that you store some code in the buffer (the payload)

\item you then override the return address to execute this payload\medskip

\item difficulty is to guess the right place where to ``jump''

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{Starting a Shell}

\small

\lstinputlisting[language=C,numbers=none,xleftmargin=-6mm]{../progs/o1.c}

\begin{textblock}{7}(5,7.5)

\begin{bubble}[7cm]

\lstinputlisting[language=C,numbers=none,xleftmargin=-0mm]{../progs/shell.c}

\end{bubble}

\end{textblock}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Avoiding \texttt{$\backslash$x00}}

\begin{itemize}

\item another difficulty is that the code is not allowed to contain \texttt{$\backslash$x00}:

\begin{center}

\texttt{xorl   \%eax, \%eax}

\end{center}

\end{itemize}\bigskip\bigskip

{\small

\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Overflow.c}

\mbox{}\\[-10mm]

\small

\lstinputlisting[language=C,xleftmargin=-4mm,numbers=none]{../progs/overflow.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Optimising Success}

\begin{center}

\begin{tabular}{l@{\hspace{2cm}}l}

  \begin{tikzpicture}[scale=0.6]

  \draw[line width=1mm] (-2, -1) rectangle (2,3);

  \draw[line width=1mm,fill=blue!30] (-2, 1.9) rectangle (2,3);

  \draw (0,2.5) node {\small\tt shell code};

  \draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7);

  \draw[->,line width=0.3mm] (1.05, -1) -- (1.05,-1.7) --

  (-3,-1.7) -- (-3, 3.7) -- (-1.9, 3.7) -- (-1.9, 3.1);

   \end{tikzpicture}

&

 \onslide<2>{

 \begin{tikzpicture}[scale=0.6]

  \draw[gray!50,fill=red!30] (-2,0.3) rectangle (2,3);

  \draw[line width=1mm] (-2, -1) rectangle (2,3);

  \draw[line width=1mm,fill=blue!30] (-2, 0.3) rectangle (2, -0.7);

  \draw (0,-0.2) node {\small\tt shell code};

  \draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7);

  \draw [line width=0.5,decoration={brace,amplitude=2mm},decorate] 

    (2.3,3) -- (2.3,0.3);

  \draw[line width=0.3mm] (1.05, -1) -- (1.05,-1.7) --

  (3,-1.7) -- (3,1.65) -- (2.6, 1.65);

  \end{tikzpicture}}

\end{tabular}

\end{center}\bigskip

\onslide<2>{  

fill up the red part of the string with \pcode{NOP} operations

(Intel \texttt{$\backslash$x90})}  

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Variants}

There are many variants:

\begin{itemize}

\item return-to-lib-C attacks

\item heap-smashing attacks\\

\textcolor{gray}{\small(Slammer Worm in 2003 infected 90\% of vulnerable systems within 10 minutes)}\bigskip

\item ``zero-days-attacks'' (new unknown vulnerability)

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}

            Protections against\\

            Buffer Overflow Attacks

            \end{tabular}}

\begin{itemize}

\item use safe library functions

\item stack canaries

\item ensure stack data is not executable (can be defeated)

\item address space randomisation (makes one-size-fits-all more difficult)

\item choice of programming language (one of the selling points of Java)

\end{itemize}

\only<2>{  

\begin{textblock}{7}(6,1)

  \begin{bubble}[5.5cm]

  \begin{tabular}{cp{2.9cm}}

  \begin{tikzpicture}[baseline=40mm,scale=0.8]

  %\draw[step=1cm] (-3,-1) grid (3,8);

  \draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);