\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\usepackage{../data}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\renewcommand{\slidecaption}{SEN 03, King's College London}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Security Engineering (3)\\[-3mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

  \normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & N7.07 (North Wing, Bush House)\\

  Slides: & KEATS (also home work is there)

  \end{tabular}

  \end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

  \frametitle{\Large Homework, Slides etc}

  \begin{itemize}

  \item include the question text  

  \item please send the homework as PDF (or txt)\bigskip

  \item coursework 10\% \bigskip  

  \end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Buffer Overflow Attacks}

\begin{center}

\begin{columns}[b]

\begin{column}{.4\textwidth}

\centering

\includegraphics[scale=0.3]{../pics/barrier.jpg}\\

lectures so far

\end{column}

\begin{column}{.4\textwidth}

\centering

\includegraphics[scale=0.32]{../pics/trainwreck.jpg}\\

today

\end{column}

\end{columns}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{@{}c@{}}According to\\ US Vulnerability DB\end{tabular}}

\begin{center}

\mbox{}\hspace{-8mm}\begin{tikzpicture}

\begin{axis}[

    xlabel={year},

    xlabel style={yshift=-1em},

    ylabel={\% of total attacks},

    ylabel style={yshift=-0em},

    enlargelimits=false,

    xmin=1996.5,

    ymax=23,

    ytick={0,5,...,20},

    scaled ticks=false,

    axis lines=left,

    width=11.5cm,

    height=5cm, 

    ybar,

    x tick label style={text height=1ex,font=\footnotesize,/pgf/number format/1000 sep={}},

    nodes near coords=

     {\footnotesize

      $\pgfmathprintnumber[fixed,fixed zerofill,precision=1,use comma]{\pgfkeysvalueof{/data point/y}}$}

    ]

\addplot

  table [x=Year,y=Percentage] {bufferoverflows.data};

\end{axis}

\end{tikzpicture}

\end{center}

from the US National Vulnerability Database\\

\small\url{http://web.nvd.nist.gov/view/vuln/statistics}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Smash the Stack for Fun\ldots}

\begin{itemize}

\item \alert{\bf Buffer Overflow Attacks (BOAs)} or\\ 

{\bf Smashing the Stack Attacks}\medskip

\item unfortunately one of the most popular attacks\\ 

($>$ 50\% of security incidents reported at CERT are related 

to buffer overflows)

\begin{flushright}

\small\url{http://www.kb.cert.org/vuls}

\end{flushright}

\medskip

(also known as Aleph One):\\

\begin{center}

{\bf ``Smashing The Stack For Fun and Profit''}

\end{center}\medskip

\begin{flushright}

\small\url{http://phrack.org/issues/49/14.html}

\end{flushright} 

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A Long Printed ``Twice''}

\mbox{}\\[-6mm]

\footnotesize 

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C0.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Printing Out ``Zombies''}

\mbox{}\\[-6mm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C1.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Login'' Function (1)}

\mbox{}\\[-6mm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C2a.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A ``Login'' Function (2)}

\mbox{}\\[-6mm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=-3mm]{../progs/C2b.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{What the Hell Is Going On?}

\begin{itemize}

\item Let's start with a very simple program:

\end{itemize}

\lstinputlisting[language=C,xleftmargin=4mm]{../progs/example1.c}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Memory}

\begin{itemize}

\item each process will get a chunk of memory that is

      organised as follows: 

\end{itemize}

\begin{center}

  \begin{tikzpicture}[scale=0.8]

  %\draw[step=1cm] (-3,-3) grid (3,3);

  \draw[line width=1mm] (-2, -3) rectangle (2,3);

  \draw[line width=1mm] (-2,1) -- (2,1);

  \draw[line width=1mm] (-2,-1) -- (2,-1);

  \draw (0,2) node {\large\tt text};

  \draw (0,0) node {\large\tt heap};

  \draw (0,-2) node {\large\tt stack};

  \draw (-2.7,3) node[anchor=north east] {\tt\begin{tabular}{@{}l@{}}lower\\ address\end{tabular}};

  \draw (-2.7,-3) node[anchor=south east] {\tt\begin{tabular}{@{}l@{}}higher\\ address\end{tabular}};

  \draw[->, line width=1mm] (-2.5,3) -- (-2.5,-3);

  \draw (2.7,-2) node[anchor=west] {\tt grows};

  \draw (2.7,-3) node[anchor=south west] {\tt\footnotesize older};

  \draw (2.7,-1) node[anchor=north west] {\tt\footnotesize newer};

  \draw[|->, line width=1mm] (2.5,-3) -- (2.5,-1);

  \end{tikzpicture}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{The Stack}

\begin{textblock}{7}(1,1)

  \begin{tikzpicture}[scale=0.8]

  %\draw[step=1cm] (-3,-1) grid (3,8);

  \draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);

  \draw[line width=1mm] (-1,-1.2) -- (-1,7.4);

  \draw[line width=1mm] ( 1,-1.2) -- ( 1,7.4);

  \draw (0,-1) node[anchor=south] {\tt main};

  \draw[line width=1mm] (-1,0) -- (1,0);

  \draw (0,0) node[anchor=south] {\tt arg$_3$=3};

  \draw[line width=1mm] (-1,1) -- (1,1);

  \draw (0,1) node[anchor=south] {\tt arg$_2$=2};

  \draw[line width=1mm] (-1,2) -- (1,2);

  \draw (0,2) node[anchor=south] {\tt arg$_1$=1};

  \draw[line width=1mm] (-1,3) -- (1,3);

  \draw (0,3.1) node[anchor=south] {\tt ret};

  \draw[line width=1mm] (-1,4) -- (1,4);

  \draw (0,4) node[anchor=south] {\small\tt last sp};

  \draw[line width=1mm] (-1,5) -- (1,5);

  \draw (0,5) node[anchor=south] {\tt buf$_1$};

  \draw[line width=1mm] (-1,6) -- (1,6);

  \draw (0,6) node[anchor=south] {\tt buf$_2$};

  \draw[line width=1mm] (-1,7) -- (1,7);

  \draw (2,6.1) node[anchor=south] {\code{$esp}};

  \draw[<-,line width=0.5mm] (1.1,7) -- (2.5,7);

  \draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5) -- (1.8, 0) -- (1.1,0); 

  \draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);

  \draw (2.6,3.1) node[anchor=south west] {\tt back to main()};

  \draw[->,red,line width=2mm] (2.5,0.1) -- (4.2,0.1);

\end{tikzpicture}

\end{textblock}

\begin{textblock}{7}(6.4,8)

\begin{bubble}[6.8cm]

\footnotesize

\lstinputlisting[language=C,xleftmargin=5mm]{../progs/example1.c} 

\end{bubble}

\end{textblock}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Behind the Scenes}

\only<1>{

\begin{textblock}{7}(3,3)

\begin{bubble}[6.8cm]

\footnotesize

\lstinputlisting[language=C,

                 xleftmargin=5mm,

                 belowskip=-1mm,

                 aboveskip=-1mm]{../progs/example1.c} 

\end{bubble}

\end{textblock}}

\only<2->{

\begin{textblock}{7}(1,0.6)

\begin{bubble}[6.8cm]

\footnotesize

\lstinputlisting[language=C,

                 xleftmargin=5mm,

                 belowskip=-1mm,

                 aboveskip=-1mm]{../progs/example1.c} 

\end{bubble}

\end{textblock}}

\only<2>{

\begin{textblock}{7}(0.5,6.6)

\footnotesize

\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl},xleftmargin=5mm,numbers=none]{../progs/example1a.s} 

\end{textblock}}

\only<3>{

\begin{textblock}{7}(0.5,6.6)

\footnotesize

\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl,movw},xleftmargin=5mm,numbers=none]{../progs/example1b.s} 

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Overwriting the Stack}

\begin{textblock}{7}(1,2)

  \begin{tikzpicture}[scale=0.8]

  %\draw[step=1cm] (-3,-1) grid (3,8);

  \draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);

  \draw[line width=1mm] (-1,-1.2) -- (-1,6.4);

  \draw[line width=1mm] ( 1,-1.2) -- ( 1,6.4);

  \draw (0,-1) node[anchor=south] {\tt main};

  \draw[line width=1mm] (-1,0) -- (1,0);

  \draw (0,0) node[anchor=south] {\tt arg$_3$=3};

  \draw[line width=1mm] (-1,1) -- (1,1);

  \draw (0,1) node[anchor=south] {\tt arg$_2$=2};

  \draw[line width=1mm] (-1,2) -- (1,2);

  \draw (0,2) node[anchor=south] {\tt arg$_1$=1};

  \draw[line width=1mm] (-1,3) -- (1,3);

  \draw (0,3.1) node[anchor=south] {\tt ret};

  \draw[line width=1mm] (-1,4) -- (1,4);

  \draw (0,4) node[anchor=south] {\small\tt last sp};

  \draw[line width=1mm] (-1,5) -- (1,5);

  \draw (0,5) node[anchor=south] {\tt buf};

  \draw[line width=1mm] (-1,6) -- (1,6);

  \draw (2,5.1) node[anchor=south] {\code{$esp}};

  \draw[<-,line width=0.5mm] (1.1,6) -- (2.5,6);

  \draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5);

  \draw (2.5,4.1) node[anchor=south] {\code{BBBB}};

  \draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);

  \draw (2.6,3.1) node[anchor=south west] {\tt jump to \code{\\x080483f4}};

\end{tikzpicture}

\end{textblock}

\begin{textblock}{7}(1,13.5)

\code{char buf[8] = "AAAAAAAABBBB\\xf4\\x83\\x04\\x08\\x00"}

\end{textblock}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\tikzset{alt/.code args={<#1>#2#3#4}{%

  \alt<#1>{\pgfkeysalso{#2}}{\pgfkeysalso{#3}} % \pgfkeysalso doesn't change the path

}}

\begin{frame}[t]

\frametitle{Buffer Overflow Attacks}

\begin{itemize}

\item the problem arises from the way C/C++ organises its function calls\\[-8mm]\mbox{}

\end{itemize}

\begin{center}

\begin{tikzpicture}[scale=1]

%\draw[black!10,step=2mm] (0,0) grid (9,4);

%\draw[black!10,thick,step=10mm] (0,0) grid (9,4);

\node at (0.5,4.5) {\small\begin{tabular}{l}main\\[-2mm] prog.\end{tabular}};

\draw[line width=0mm, white, alt=<2->{fill=red}{fill=blue}] (0,2.5) rectangle (1,3.8);

\draw[line width=0mm, white, alt=<9->{fill=red}{fill=blue}] (0,0.2) rectangle (1,0.5);

\draw[line width=1mm, alt=<3->{fill=yellow}{fill=blue}] (0,2.0) rectangle (1,2.5);

\draw[line width=1mm, alt=<6->{fill=red}{fill=blue}] (0,1.0) rectangle (1,2.0);

\draw[line width=1mm, alt=<7->{fill=yellow}{fill=blue}] (0,0.5) rectangle (1,1.0);

\draw[line width=1mm] (0,0) -- (0,4);

\draw[line width=1mm] (1,0) -- (1,4);

\node at (3.5,3.5) {\small\begin{tabular}{l}fact(n)\end{tabular}};

\draw[line width=1mm, alt=<{4-5,8}>{fill=red}{fill=blue}] (3,1.0) rectangle (4,3.0);

\onslide<3-4>{\draw[->, line width=1mm,red] (1,2.3) to node [above,sloped,midway] {n=4} (3,3);}

\onslide<5>{\draw[<-, line width=1mm,red] (1,2.3) to node [above,sloped,midway] {res=24} (3,1);}

\onslide<7-8>{\draw[->, line width=1mm,red] (1,0.8) to node [above,sloped,midway] {n=3} (3,3);}

\onslide<9>{\draw[<-, line width=1mm,red] (1,0.8) to node [above,sloped,midway] {res=6} (3,1);}

\node at (7.75,3.9) {\small\begin{tabular}{l}stack\end{tabular}};

\draw[line width=1mm] (7,3.5) -- (7,0.5) -- (8.5,0.5) -- (8.5,3.5);

\onslide<3,4,7,8>{

\node at (7.75, 1.4) {ret};

\draw[line width=1mm] (7,1.1) -- (8.5,1.1);

\node at (7.75, 2.0) {sp};

\draw[line width=1mm] (7,2.3) -- (8.5,2.3);

}

\onslide<3,4>{

\node at (7.75, 0.8) {4};

\draw[line width=1mm] (7,1.7) -- (8.5,1.7);

}

\onslide<7,8>{

\node at (7.75, 0.8) {3};

\draw[line width=1mm] (7,1.7) -- (8.5,1.7);

}

\end{tikzpicture}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\begin{center}

\begin{tikzpicture}[scale=1]

%\draw[black!10,step=2mm] (0,0) grid (9,4);

%\draw[black!10,thick,step=10mm] (0,0) grid (9,4);

\node at (0.5,4.5) {\small\begin{tabular}{l}main\\[-2mm] prog.\end{tabular}};

\draw[line width=0mm, white, alt=<2->{fill=red}{fill=blue}] (0,2.5) rectangle (1,3.8);

\draw[line width=1mm, white, fill=blue] (0,1.0) rectangle (1,2.0);

\draw[line width=1mm, alt=<3->{fill=yellow}{fill=blue}] (0,2.0) rectangle (1,2.5);

\draw[line width=1mm] (0,0) -- (0,4);

\draw[line width=1mm] (1,0) -- (1,4);

\node at (3.5,3.5) {\small\begin{tabular}{l}fact(n)\end{tabular}};

\draw[line width=0mm, alt=<{4-}>{red, fill=red}{blue, fill=blue}] (3,2.8) rectangle (4,3.0);

\draw[line width=0mm, alt=<{5-}>{red, fill=red}{blue, fill=blue}] (3,2.8) rectangle (4,2.0);

\draw[line width=0mm, alt=<{7-}>{red, fill=red}{blue, fill=blue}] (3,2.0) rectangle (4,1.0);

\draw[line width=1mm] (3,1.0) rectangle (4,3.0);

\onslide<3->{\draw[->, line width=1mm,red] (1,2.3) to node [above,sloped,midway] {n=4} (3,3);}

\onslide<5->{\draw[<-, line width=2mm,red] (4,2) to node [above,sloped,midway] 

{\begin{tabular}{l}user\\[-1mm] input\end{tabular}} (6,2);}

\onslide<8->{\draw[<-, line width=1mm,red] (1,-2) to (3,1);}

\node at (7.75,3.9) {\small\begin{tabular}{l}stack\end{tabular}};

\draw[line width=1mm] (7,3.5) -- (7,-0.1) -- (8.5,-0.1) -- (8.5,3.5);

\onslide<3->{

\node at (7.75, 0.2) {4};

\draw[line width=1mm,alt=<6->{fill=red}{fill=white}] (7,0.5) rectangle (8.5,1.1);

\node at (7.75, 0.8) {\alt<6->{@a\#}{ret}};

\draw[line width=1mm,alt=<6->{fill=red}{fill=white}] (7,1.1) rectangle (8.5,1.7);

\node at (7.75, 1.4) {\alt<6->{!?w;}sp};

}

\onslide<4->{

\draw[line width=1mm,fill=red] (7,1.7) rectangle (8.5,3.0);

\node[white] at (7.75, 2.4) {buffer};

}

\end{tikzpicture}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{C-Library Functions}

\begin{itemize}

\item copy everything up to the zero byte

\end{itemize}\medskip

{\small

\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}