|
1 \documentclass[dvipsnames,14pt,t]{beamer} |
|
2 \usepackage{beamerthemeplainculight} |
|
3 \usepackage[T1]{fontenc} |
|
4 \usepackage[latin1]{inputenc} |
|
5 \usepackage{mathpartir} |
|
6 \usepackage[absolute,overlay]{textpos} |
|
7 \usepackage{ifthen} |
|
8 \usepackage{tikz} |
|
9 \usepackage{pgf} |
|
10 \usepackage{calc} |
|
11 \usepackage{ulem} |
|
12 \usepackage{courier} |
|
13 \usepackage{listings} |
|
14 \renewcommand{\uline}[1]{#1} |
|
15 \usetikzlibrary{arrows} |
|
16 \usetikzlibrary{automata} |
|
17 \usetikzlibrary{shapes} |
|
18 \usetikzlibrary{shadows} |
|
19 \usetikzlibrary{positioning} |
|
20 \usetikzlibrary{calc} |
|
21 \usepackage{graphicx} |
|
22 |
|
23 \definecolor{javared}{rgb}{0.6,0,0} % for strings |
|
24 \definecolor{javagreen}{rgb}{0.25,0.5,0.35} % comments |
|
25 \definecolor{javapurple}{rgb}{0.5,0,0.35} % keywords |
|
26 \definecolor{javadocblue}{rgb}{0.25,0.35,0.75} % javadoc |
|
27 |
|
28 \lstset{language=Java, |
|
29 basicstyle=\ttfamily, |
|
30 keywordstyle=\color{javapurple}\bfseries, |
|
31 stringstyle=\color{javagreen}, |
|
32 commentstyle=\color{javagreen}, |
|
33 morecomment=[s][\color{javadocblue}]{/**}{*/}, |
|
34 numbers=left, |
|
35 numberstyle=\tiny\color{black}, |
|
36 stepnumber=1, |
|
37 numbersep=10pt, |
|
38 tabsize=2, |
|
39 showspaces=false, |
|
40 showstringspaces=false} |
|
41 |
|
42 \lstdefinelanguage{scala}{ |
|
43 morekeywords={abstract,case,catch,class,def,% |
|
44 do,else,extends,false,final,finally,% |
|
45 for,if,implicit,import,match,mixin,% |
|
46 new,null,object,override,package,% |
|
47 private,protected,requires,return,sealed,% |
|
48 super,this,throw,trait,true,try,% |
|
49 type,val,var,while,with,yield}, |
|
50 otherkeywords={=>,<-,<\%,<:,>:,\#,@}, |
|
51 sensitive=true, |
|
52 morecomment=[l]{//}, |
|
53 morecomment=[n]{/*}{*/}, |
|
54 morestring=[b]", |
|
55 morestring=[b]', |
|
56 morestring=[b]""" |
|
57 } |
|
58 |
|
59 \lstset{language=Scala, |
|
60 basicstyle=\ttfamily, |
|
61 keywordstyle=\color{javapurple}\bfseries, |
|
62 stringstyle=\color{javagreen}, |
|
63 commentstyle=\color{javagreen}, |
|
64 morecomment=[s][\color{javadocblue}]{/**}{*/}, |
|
65 numbers=left, |
|
66 numberstyle=\tiny\color{black}, |
|
67 stepnumber=1, |
|
68 numbersep=10pt, |
|
69 tabsize=2, |
|
70 showspaces=false, |
|
71 showstringspaces=false} |
|
72 |
|
73 % beamer stuff |
|
74 \renewcommand{\slidecaption}{APP 02, King's College London, 9 October 2012} |
|
75 |
|
76 |
|
77 \begin{document} |
|
78 |
|
79 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
80 \mode<presentation>{ |
|
81 \begin{frame}<1>[t] |
|
82 \frametitle{% |
|
83 \begin{tabular}{@ {}c@ {}} |
|
84 \\ |
|
85 \LARGE Access Control and \\[-3mm] |
|
86 \LARGE Privacy Policies (3)\\[-6mm] |
|
87 \end{tabular}}\bigskip\bigskip\bigskip |
|
88 |
|
89 %\begin{center} |
|
90 %\includegraphics[scale=1.3]{pics/barrier.jpg} |
|
91 %\end{center} |
|
92 |
|
93 \normalsize |
|
94 \begin{center} |
|
95 \begin{tabular}{ll} |
|
96 Email: & christian.urban at kcl.ac.uk\\ |
|
97 Of$\!$fice: & S1.27 (1st floor Strand Building)\\ |
|
98 Slides: & KEATS (also home work is there) |
|
99 \end{tabular} |
|
100 \end{center} |
|
101 |
|
102 |
|
103 \end{frame}} |
|
104 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
105 |
|
106 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
107 \mode<presentation>{ |
|
108 \begin{frame}[c] |
|
109 |
|
110 \begin{center} |
|
111 \includegraphics[scale=0.45]{pics/trainwreck.jpg}\\ |
|
112 one general defence mechanism is\\\alert{\bf defence in depth} |
|
113 \end{center} |
|
114 |
|
115 |
|
116 \end{frame}} |
|
117 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
118 |
|
119 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
120 \mode<presentation>{ |
|
121 \begin{frame}<1-2>[c] |
|
122 \frametitle{Defence in Depth} |
|
123 |
|
124 \begin{itemize} |
|
125 \item \alt<1>{overlapping}{{\LARGE\bf overlapping}} systems designed to provide\\ security even if one of them fails. |
|
126 \end{itemize} |
|
127 |
|
128 |
|
129 \end{frame}} |
|
130 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
131 |
|
132 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
133 \mode<presentation>{ |
|
134 \begin{frame}[c] |
|
135 \frametitle{PALs} |
|
136 |
|
137 \begin{itemize} |
|
138 \item \alert{Permissive Action Links} prevent unauthorised use of nuclear weapons (so the theory) |
|
139 \end{itemize} |
|
140 |
|
141 \begin{center} |
|
142 \includegraphics[scale=0.25]{pics/nuclear1.jpg}\hspace{3mm} |
|
143 \includegraphics[scale=0.25]{pics/nuclear2.jpg} |
|
144 \end{center} |
|
145 |
|
146 |
|
147 \onslide<3->{ |
|
148 modern PALs also include a 2-person rule |
|
149 } |
|
150 |
|
151 \only<2->{ |
|
152 \begin{textblock}{11}(3,2) |
|
153 \begin{tikzpicture} |
|
154 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
|
155 {\begin{minipage}{8cm} |
|
156 US Air Force's Strategic Air Command worried that in times of need the |
|
157 codes would not be available, so until 1977 quietly decided to set them |
|
158 to 00000000\ldots |
|
159 \end{minipage}}; |
|
160 \end{tikzpicture} |
|
161 \end{textblock}} |
|
162 |
|
163 |
|
164 \end{frame}} |
|
165 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
166 |
|
167 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
168 \mode<presentation>{ |
|
169 \begin{frame}[c] |
|
170 |
|
171 \begin{itemize} |
|
172 \item until 1998, Britain had nuclear weapons that could be launched from airplanes\bigskip\pause |
|
173 |
|
174 \item these weapons were armed with a bicycle key |
|
175 |
|
176 \begin{center} |
|
177 \begin{tabular}[b]{c} |
|
178 \includegraphics[scale=1.05]{pics/britkeys1.jpg}\\ |
|
179 \small nuclear weapon |
|
180 \end{tabular} |
|
181 \hspace{3mm} |
|
182 \begin{tabular}[b]{c} |
|
183 \includegraphics[scale=0.35]{pics/britkeys2.jpg}\\ |
|
184 \small bicycle lock |
|
185 \end{tabular} |
|
186 \end{center}\bigskip\pause |
|
187 |
|
188 \item the current Trident nuclear weapons can be launched from a submarine without any code being transmitted |
|
189 \end{itemize} |
|
190 |
|
191 \end{frame}} |
|
192 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
193 |
|
194 |
|
195 |
|
196 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
197 \mode<presentation>{ |
|
198 \begin{frame}[c] |
|
199 \frametitle{} |
|
200 |
|
201 |
|
202 \end{frame}} |
|
203 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
204 |
|
205 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
206 \mode<presentation>{ |
|
207 \begin{frame}[c] |
|
208 \frametitle{\begin{tabular}{@ {}c@ {}}Plain-text Passwords at IEEE\end{tabular}} |
|
209 |
|
210 \small\textcolor{gray}{On 25 September 2012, a report on a data breach at IEEE:} |
|
211 |
|
212 |
|
213 \begin{itemize} |
|
214 \item IEEE is a standards organisation (not-for-profit) |
|
215 \item many standards in CS are by IEEE\medskip |
|
216 \item 100k plain-text passwords were recorded in logs |
|
217 \item the logs were openly accessible on their FTP server |
|
218 \end{itemize}\bigskip |
|
219 |
|
220 \begin{flushright}\small |
|
221 \textcolor{gray}{\url{http://ieeelog.com}} |
|
222 \end{flushright} |
|
223 |
|
224 \only<2>{ |
|
225 \begin{textblock}{11}(3,2) |
|
226 \begin{tikzpicture} |
|
227 \draw (0,0) node[inner sep=2mm,fill=white, ultra thick, draw=red, rounded corners=2mm] |
|
228 {\normalsize\color{darkgray} |
|
229 \begin{minipage}{7.5cm}\raggedright\small |
|
230 \includegraphics[scale=0.6]{pics/IEEElog.jpg} |
|
231 \end{minipage}}; |
|
232 \end{tikzpicture} |
|
233 \end{textblock}} |
|
234 |
|
235 \end{frame}} |
|
236 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
237 |
|
238 |
|
239 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
240 \mode<presentation>{ |
|
241 \begin{frame}[c] |
|
242 \frametitle{\begin{tabular}{@ {}c@ {}}Virgin Mobile (USA)\end{tabular}} |
|
243 |
|
244 \begin{flushright}\small |
|
245 \textcolor{gray}{\url{http://arstechnica.com/security/2012/09/virgin-mobile-password-crack-risk/}} |
|
246 \end{flushright} |
|
247 |
|
248 \begin{itemize} |
|
249 \item for online accounts passwords must be 6 digits |
|
250 \item you must cycle through 1M combinations (online)\pause\bigskip |
|
251 |
|
252 \item he limited the attack on his own account to 1 guess per second, \alert{\bf and} |
|
253 \item wrote a script that cleared the cookie set after each guess\pause |
|
254 \item has been fixed now |
|
255 \end{itemize} |
|
256 |
|
257 |
|
258 |
|
259 \end{frame}} |
|
260 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
261 |
|
262 |
|
263 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
264 \mode<presentation>{ |
|
265 \begin{frame}[c] |
|
266 \frametitle{\begin{tabular}{@ {}c@ {}}Smash the Stack for Fun \ldots\end{tabular}} |
|
267 |
|
268 \begin{itemize} |
|
269 \item ``smashing the stack attacks'' or ``buffer overflow attacks'' |
|
270 \item one of the most popular attacks;\\ attack of the (last) decade\\ ($>$ 50\% of security incidents reported at CERT are related to buffer overflows) |
|
271 \begin{flushright}\small |
|
272 \textcolor{gray}{\url{http://www.kb.cert.org/vuls}} |
|
273 \end{flushright} |
|
274 \medskip |
|
275 \item made popular in an article by Elias Levy\\ (also known as Aleph One):\\ |
|
276 \begin{center} |
|
277 {\bf ``Smashing The Stack For Fun and Profit''} |
|
278 \end{center}\medskip |
|
279 |
|
280 \begin{flushright} |
|
281 \small\textcolor{gray}{\url{http://www.phrack.org}, Issue 49, Article 14} |
|
282 \end{flushright} |
|
283 |
|
284 \end{itemize} |
|
285 |
|
286 |
|
287 \end{frame}} |
|
288 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
289 |
|
290 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
291 \mode<presentation>{ |
|
292 \begin{frame}[c] |
|
293 \frametitle{\begin{tabular}{c}The Problem\end{tabular}} |
|
294 |
|
295 \begin{itemize} |
|
296 \item The basic problem is that library routines in C look as follows: |
|
297 \begin{center} |
|
298 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
|
299 \texttt{\lstinputlisting{app5.c}}} |
|
300 \end{center} |
|
301 \item the resulting problems are often remotely exploitable |
|
302 \item can be used to circumvents all access control |
|
303 (botnets for further attacks) |
|
304 \end{itemize} |
|
305 |
|
306 \end{frame}} |
|
307 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
308 |
|
309 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
310 \mode<presentation>{ |
|
311 \begin{frame}[c] |
|
312 \frametitle{\begin{tabular}{c}Variants\end{tabular}} |
|
313 |
|
314 There are many variants: |
|
315 |
|
316 \begin{itemize} |
|
317 \item return-to-lib-C attacks |
|
318 \item heap-smashing attacks\\ |
|
319 \textcolor{gray}{\small(Slammer Worm in 2003 infected 90\% of vulnerable systems within 10 minutes)}\bigskip |
|
320 |
|
321 \item ``zero-days-attacks'' (new unknown vulnerability) |
|
322 \end{itemize} |
|
323 |
|
324 \end{frame}} |
|
325 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
326 |
|
327 |
|
328 |
|
329 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
330 \mode<presentation>{ |
|
331 \begin{frame}[c] |
|
332 |
|
333 \small |
|
334 \texttt{my\_float} is printed twice:\bigskip |
|
335 |
|
336 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
|
337 \texttt{\lstinputlisting{C1.c}}} |
|
338 |
|
339 |
|
340 \end{frame}} |
|
341 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
342 |
|
343 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
344 \mode<presentation>{ |
|
345 \begin{frame}[c] |
|
346 |
|
347 \begin{center} |
|
348 \only<1>{\includegraphics[scale=0.9]{pics/stack1}\;\;} |
|
349 \only<2>{\includegraphics[scale=0.9]{pics/stack2}\;\;} |
|
350 \only<3>{\includegraphics[scale=0.9]{pics/stack3}\;\;} |
|
351 \end{center} |
|
352 |
|
353 |
|
354 \end{frame}} |
|
355 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
356 |
|
357 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
358 \mode<presentation>{ |
|
359 \begin{frame}[c] |
|
360 |
|
361 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
|
362 \texttt{\lstinputlisting{C2.c}}} |
|
363 |
|
364 |
|
365 \end{frame}} |
|
366 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
367 |
|
368 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
369 \mode<presentation>{ |
|
370 \begin{frame}[c] |
|
371 |
|
372 \small |
|
373 A programmer might be careful, but still introduce vulnerabilities:\bigskip |
|
374 |
|
375 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
|
376 \texttt{\lstinputlisting{C2a.c}}} |
|
377 |
|
378 |
|
379 \end{frame}} |
|
380 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
381 |
|
382 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
383 \mode<presentation>{ |
|
384 \begin{frame}[c] |
|
385 \frametitle{\begin{tabular}{c}Payloads\end{tabular}} |
|
386 |
|
387 \begin{itemize} |
|
388 \item the idea is you store some code as part to the buffer |
|
389 \item you then override the return address to execute this payload\medskip |
|
390 \item normally you start a root-shell\pause |
|
391 \item difficulty is to guess the right place where to ``jump'' |
|
392 \end{itemize} |
|
393 |
|
394 \end{frame}} |
|
395 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
396 |
|
397 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
398 \mode<presentation>{ |
|
399 \begin{frame}[c] |
|
400 \frametitle{\begin{tabular}{c}Payloads (2)\end{tabular}} |
|
401 |
|
402 \begin{itemize} |
|
403 \item another difficulty is that the code is not allowed to contain \texttt{$\backslash$x00}: |
|
404 |
|
405 \begin{center} |
|
406 \texttt{xorl \%eax, \%eax} |
|
407 \end{center} |
|
408 \end{itemize}\bigskip\bigskip |
|
409 |
|
410 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
|
411 \texttt{\lstinputlisting{app5.c}}} |
|
412 |
|
413 \end{frame}} |
|
414 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
415 |
|
416 |
|
417 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
418 \mode<presentation>{ |
|
419 \begin{frame}[c] |
|
420 \frametitle{\begin{tabular}{c}Format String Vulnerability\end{tabular}} |
|
421 |
|
422 \small |
|
423 \texttt{string} is nowhere used:\bigskip |
|
424 |
|
425 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
|
426 \texttt{\lstinputlisting{C6.c}}}\bigskip |
|
427 |
|
428 this vulnerability can be used to read out the stack |
|
429 |
|
430 \end{frame}} |
|
431 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
432 |
|
433 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
434 \mode<presentation>{ |
|
435 \begin{frame}[c] |
|
436 \frametitle{\begin{tabular}{c}Protections against BO Attacks\end{tabular}} |
|
437 |
|
438 \begin{itemize} |
|
439 \item use safe library functions |
|
440 \item ensure stack data is not executable (can be defeated) |
|
441 \item address space randomisation (makes one-size-fits-all more difficult) |
|
442 \item choice of programming language (one of the selling points of Java) |
|
443 |
|
444 \end{itemize} |
|
445 |
|
446 \end{frame}} |
|
447 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
448 |
|
449 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
450 \mode<presentation>{ |
|
451 \begin{frame}[c] |
|
452 \frametitle{\begin{tabular}{c}Security Goals\end{tabular}} |
|
453 |
|
454 \begin{itemize} |
|
455 \item Prevent common vulnerabilities from occurring (e.g. buffer overflows)\pause |
|
456 \item Recover from attacks (traceability and auditing of security-relevant actions)\pause |
|
457 \item Monitoring (detect attacks)\pause |
|
458 \item Privacy, confidentiality, anonymity (to protect secrets)\pause |
|
459 \item Authenticity (eeded for access control)\pause |
|
460 \item Integrity (prevent unwanted modification or tampering)\pause |
|
461 \item Availability and reliability (reduce the risk of DoS attacks) |
|
462 \end{itemize} |
|
463 |
|
464 \end{frame}} |
|
465 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
466 |
|
467 |
|
468 |
|
469 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
470 \mode<presentation>{ |
|
471 \begin{frame}[c] |
|
472 \frametitle{\begin{tabular}{c}Homework\end{tabular}} |
|
473 |
|
474 \begin{itemize} |
|
475 \item Assume format string attacks allow you to read out the stack. What can you do |
|
476 with this information?\bigskip |
|
477 |
|
478 \item Assume you can crash a program remotely. Why is this a problem? |
|
479 \end{itemize} |
|
480 |
|
481 \end{frame}} |
|
482 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
483 |
|
484 |
|
485 \end{document} |
|
486 |
|
487 %%% Local Variables: |
|
488 %%% mode: latex |
|
489 %%% TeX-master: t |
|
490 %%% End: |
|
491 |