\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\usetikzlibrary{arrows}

\usetikzlibrary{shapes}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\renewcommand{\slidecaption}{SEN 04, King's College London}

\newcommand{\bl}[1]{\textcolor{blue}{#1}}  

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Security Engineering (4)\\[-3mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

\normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also home work is there)\\

  \end{tabular}

  \end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\includegraphics[scale=0.34]{../pics/trainwreck.jpg}\\

last week: buffer overflow attacks

\end{center}

\begin{itemize}

\item no ``cheating'' needed for format string attacks

\item the main point: no cheating to start with 

\end{itemize} 

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Case-In-Point: Android}

\begin{itemize}

\item a list of common Android vulnerabilities

(5 BOAs out of 35 vulnerabilities; all from 2013 and later)

\begin{center}

\url{http://androidvulnerabilities.org/}

\end{center}\bigskip

\item a paper that attempts measures security of Android phones

\begin{quote}\small\rm ``We find that on average 87.7\% of Android

devices are exposed to at least one of 11 known critical

vulnerabilities\ldots''

\end{quote} 

\begin{center}\small

\makebox[0mm]

{\url{https://www.cl.cam.ac.uk/~drt24/papers/spsm-scoring.pdf}}

\end{center}

\end{itemize} 

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

A student asked:

\begin{bubble}[10cm]\small How do we implement BOAs? On a

webpage login, for example Facebook, we can't do this. 

I am sure the script will stop us even before we reach the 

server. The

script will not let us enter hexadecimal numbers where email

or username is required and plus it will have a max length,

like 32 characters only. In this case, what can we do, since

the method you showed us wouldn't work?

\end{bubble}\bigskip\bigskip\pause

\begin{itemize}

\item Facebook no

\item printers, routers, cars, IoT etc likely\pause

\item I do not want to teach you hacking, rather defending

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Survey}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\includegraphics[scale=0.45]{../pics/trainwreck.jpg}\\

last week: buffer overflow attacks

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Two General Counter\\[-1mm] 

            Measures against BOAs etc\end{tabular}}

Both try to reduce the attack surface:\bigskip

\begin{itemize}

\item \alert{\bf unikernels} -- the idea is to not have

an operating system at all

\item all functionality of the server is implemented in a

single, stand-alone program

\item all functionality an operating system would normally

provide (network stack, file system) is available through

libraries

\item the best known unikernel is MirageOS using Ocaml

(\url{https://mirage.io})

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Network Applications:\\[-1mm] 

            Privilege Separation\end{tabular}}

\begin{center}

  \begin{tikzpicture}[scale=1]

  \draw[line width=1mm] (-.3, 0) rectangle (1.5,2);

  \draw (4.7,1) node {Internet};

  \draw (-2.7,1.7) node {\footnotesize Application};

  \draw (0.6,1.7) node {\footnotesize Interface};

  \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] process\end{tabular}};

  \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}};

  \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);

  \draw[white] (1.7,1) node (X) {};

  \draw[white] (3.7,1) node (Y) {};

  \draw[red, <->, line width = 2mm] (X) -- (Y);

  \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1);

  \end{tikzpicture}

\end{center}

\begin{itemize}

\item the idea is make the attack surface smaller and mitigate the

  consequences of an attack

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Access Control in Unix}

\begin{itemize}

\item access control provided by the OS

\item authenticate principals

\item mediate access to files, ports, processes etc according to

  \alert{roles} (user ids)\\

\item roles get attached with privileges (some special roles: root)\bigskip\\

\hspace{8mm}

\begin{bubble}[8cm]

\alert{\bf principle of least privilege:}\\

users and programs should only have as much privilege as they need to

accomplish a task

\end{bubble}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

\begin{frame}[c]

\frametitle{Access Control in Unix (2)}

\begin{itemize}

\item privileges are specified by file access permissions (``everything is a file'')\medskip 

\item there are 9 (plus 2) bits that specify the permissions of a file

\end{itemize}

\begin{center}

${\underbrace{\LARGE\texttt{-}}_{\text{\makebox[0mm]{directory}}}}

 \;{\underbrace{\LARGE\texttt{r{}-{}-}}_{\text{user}}}\,

 {\underbrace{\LARGE\texttt{r{}w{}-}}_{\text{group}}}\,

 {\underbrace{\LARGE\texttt{r{}w{}x}}_{\text{other}}}\;\;\;

 \LARGE\texttt{bob}\;\;\texttt{staff}\;\;\texttt{file}$

\end{center}  

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Unix-Style Access Control}

\small

\begin{itemize}

\item 

Q: ``I am using Windows. Why should I care?'' \\ 

A: In Windows you have similar AC:

\begin{center}

\begin{tabular}{l}

administrators group\\ 

\hspace{5mm}(has complete control over the machine)\\

authenticated users\\

server operators\\

power users\\

network configuration operators

\end{tabular}

\end{center}\medskip

\item Modern versions of Windows have more fine-grained AC than Unix;

  they do not have a setuid bit, but have \texttt{runas} (asks for a

  password).\pause

\item OS-provided access control can \alert{\bf add} to your security.

  (defence in depth)

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Weaknesses of Unix AC}

Not just restricted to Unix:

\begin{itemize}

\item if you have too many roles (i.e.~too finegrained AC), then

  hierarchy is too complex\\ \textcolor{gray}{you invite situations

    like\ldots let's be root}\bigskip

\item you can still abuse the system\ldots

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Cron''-Attack}

The idea is to trick a privileged person to do something on your

behalf:

\begin{itemize}

\item root:\\\texttt{rm /tmp/*/*}\bigskip\bigskip\pause

\footnotesize

\begin{minipage}{1.1\textwidth}

\textcolor{gray}{the shell behind the scenes:}\\

\textcolor{gray}{\texttt{rm /tmp/dir$_1$/file$_1$ /tmp/dir$_1$/file$_2$ /tmp/dir$_2$/file$_1$ \ldots}}\bigskip\\

\textcolor{gray}{this takes time}

\end{minipage}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Cron''-Attack}

\begin{enumerate}

\item attacker \textcolor{gray}{(creates a fake passwd file)}\\ 

\texttt{mkdir /tmp/a; cat > /tmp/a/passwd}\medskip

\item root \textcolor{gray}{(does the daily cleaning)}\\

\texttt{rm /tmp/*/*}\medskip\\

\hspace{2cm}\textcolor{gray}{\small records that \texttt{/tmp/a/passwd}}\\ 

\hspace{2cm}\textcolor{gray}{\small should be deleted, but does not do it yet}\medskip\\

\item attacker \textcolor{gray}{(meanwhile deletes the fake passwd file, and establishes a link to 

the real passwd file)}\\

\texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a}\\

\item root now deletes  the real passwd file

\end{enumerate}

\only<2>{

\begin{textblock}{11}(2,5)

\begin{bubble}[8cm]

\normalsize To prevent this kind of attack, you need additional

policies (don't do such operations as root).

\end{bubble}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Infamous Security Flaws\\[-1mm] 

in Unix\end{tabular}}

\begin{itemize}

\item \texttt{lpr} unfortunately runs with root privileges; you had the option to delete files after printing \ldots\pause

\item for debugging purposes (FreeBSD) Unix provides a ``core dump'', but allowed to follow links \ldots\pause

\item \texttt{mkdir foo} is owned by root\medskip

\begin{center}

\texttt{-rwxr-xr-x  1 root  wheel /bin/mkdir}

\end{center}\medskip

it first creates an i-node as root and then changes to ownership to the user's id\\ \textcolor{gray}{\small (race condition -- can be automated with a shell script)}

\end{itemize}

\only<4->{

\begin{textblock}{1}(3,7)

\begin{tikzpicture}

\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

{\begin{minipage}{8cm}

Only failure makes us experts.

	-- Theo de Raadt (OpenBSD, OpenSSH)

\end{minipage}};

\end{tikzpicture}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

\begin{frame}[c]

\frametitle{Subtleties}

\begin{itemize}

\item<1-> Can Bob write \pcode{file}?

\item<2-> What if Bob is member of \pcode{staff}?

\end{itemize}\bigskip

\begin{center}

${\underbrace{\Large\texttt{-}}_{\text{\makebox[0mm]{directory}}}}

 \;{\underbrace{\Large\texttt{r{}-{}-}}_{\text{user}}}\,

 {\underbrace{\Large\texttt{r{}w{}-}}_{\text{group}}}\,

 {\underbrace{\Large\texttt{r{}w{}x}}_{\text{other}}}\;\;\;

 \Large\texttt{bob}\;\;\texttt{staff}\;\;\texttt{file}$

\end{center}  

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Login Processes}

\begin{itemize}

\item login processes run under UID $=$ \pcode{0}\medskip 

\begin{center}

\texttt{ps -axl | grep login}

\end{center}\medskip

\item after login, shells run under UID $=$ user (e.g.~501)\medskip

\begin{center}

\texttt{id cu}

\end{center}\medskip\pause