74 \renewcommand{\slidecaption}{APP 03, King's College London, 1 October 2013}

    74 \renewcommand{\slidecaption}{APP 03, King's College London, 22 October 2014}

    75 

    75 \makeatletter

    76 \def\verbatim@font{\consolas\footnotesize}

    77 \makeatother

    86   \LARGE Privacy Policies (2)\\[-6mm] 

    88   \LARGE Privacy Policies (4)\\[-6mm] 

    93   Of$\!$fice: & S1.27 (1st floor Strand Building)\\

    95   Office: & S1.27 (1st floor Strand Building)\\

   108 one general defence mechanism is\\\alert{\bf defence in depth}

   110 two weeks ago: buffer overflow attacks

   116 \mode<presentation>{

   118 \begin{frame}[fragile]

   117 \begin{frame}<1-2>[c]

   119 \frametitle{Buffer Overflows}

   118 \frametitle{Defence in Depth}

   120 

   119 

   121 \begin{verbatim}

   120 \begin{itemize}

   122 As a proof-of-concept, the following URL allows 

   121 \item \alt<1>{overlapping}{{\LARGE\bf overlapping}} systems designed to provide\\ security even if one of them fails.

   123 attackers to control the return value saved on 

   122 \end{itemize}

   124 the stack (the vulnerability is triggered when

   123 

   125 executing "/usr/sbin/widget"):

   124 \only<2->{

   126 

   125 \begin{textblock}{11}(2,12)

   127  curl http://<target ip>/post_login.xml?hash=AAA...AAABBBB

   126 \small otherwise your ``added security'' can become the point of failure 

   128 

   127 \end{textblock}}

   129 The value of the "hash" HTTP GET parameter consists in 

   130 292 occurrences of the 'A' character, followed by four 

   131 occurrences of character 'B'. In our lab setup, characters 

   132 'B' overwrite the saved program counter (%ra).

   133 

   134 Discovery date: 06/03/2013

   135 Release date:   02/08/2013

   136 \end{verbatim}

   137 

   138 \mbox{}\footnotesize\hfill\url{http://pastebin.com/vbiG42VD}  

   139 \end{frame}

   140 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   141 

   142 

   143 

   144 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   145 \begin{frame}[fragile]

   146 \frametitle{Backdoors}

   147 

   148 D-Link router flaw lets anyone login through "Joel's Backdoor":\medskip

   149 

   150 If you tell your browser to identify itself as Joel's backdoor, instead of (say) 

   151 as Mozilla/5.0 AppleWebKit/536.30.1 Version/6.0.5, you're in without authentication.\medskip

   129 \end{frame}}

   153 "What is this string," I hear you ask?

   130 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   154 

   131 

   155 You will laugh: it is 

   132 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   156 

   133 \mode<presentation>{

   157 \begin{verbatim}

   134 \begin{frame}[c]

   158 xmlset_roodkcableoj28840ybtide

   135 \frametitle{PALs}

   159 \end{verbatim}

   136 

   160 

   137 \begin{itemize}

   161 

   138 \item \alert{Permissive Action Links} prevent unauthorised use of nuclear weapons (so the theory)

   162 \hfill\footnotesize October 15, 2013\\

   139 \end{itemize}

   163 \hfill\tiny\url{http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/}

   140 

   141 \begin{center}

   142 \includegraphics[scale=0.25]{pics/nuclear1.jpg}\hspace{3mm}

   143 \includegraphics[scale=0.25]{pics/nuclear2.jpg}

   144 \end{center}

   146   

   165 \end{frame}

   147 \onslide<3->{

   166 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   148 modern PALs also include a 2-person rule

   149 } 

   150  

   151  \only<2->{

   152 \begin{textblock}{11}(3,2)

   153 \begin{tikzpicture}

   154 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

   155 {\begin{minipage}{8cm}

   156 US Air Force's Strategic Air Command worried that in times of need the 

   157 codes would not be available, so until 1977 quietly decided to set them 

   158 to 00000000\ldots

   159 \end{minipage}};

   160 \end{tikzpicture}

   161 \end{textblock}}

   162 

   163   

   164 \end{frame}}

   165 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   166 

   167 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   168 \mode<presentation>{

   169 \begin{frame}[c]

   170 

   171 \begin{itemize}

   172 \item until 1998, Britain had nuclear weapons that could be launched from airplanes\bigskip\pause

   173 

   174 \item these weapons were armed with a bicycle key

   175 

   176 \begin{center}

   177 \begin{tabular}[b]{c}

   178 \includegraphics[scale=1.05]{pics/britkeys1.jpg}\\

   179 \small nuclear weapon keys

   180 \end{tabular}

   181 \hspace{3mm}

   182 \begin{tabular}[b]{c}

   183 \includegraphics[scale=0.35]{pics/britkeys2.jpg}\\

   184 \small bicycle lock

   185 \end{tabular}

   186 \end{center}\bigskip\pause

   187 

   188 \item the current Trident nuclear weapons can be launched from a submarine without any code being transmitted

   189 \end{itemize}

   190   

   191 \end{frame}}

   192 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   193 

   194 

   249 

   221 \newcommand{\bl}[1]{\textcolor{blue}{#1}}  

   250 

   222 

   251 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   223 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   252 \mode<presentation>{

   224 \begin{frame}[c]

   253 \begin{frame}[t]

   225 \frametitle{Access Control}

   254 \frametitle{Process Ownership}

   226 

   255 

   227 \begin{itemize}

   256 \begin{itemize}

   228 \item \bl{Discretionary Access Control:}\mbox{}\medskip\\

   257 \item access control in Unix is very coarse

   229 \small Access to objects (files, directories, devices, etc.) is permitted 

   258 \end{itemize}\bigskip\bigskip\bigskip

   230 based on user identity. Each object is owned by a user. Owners can 

   231 specify freely (at their discretion) how they want to share their objects 

   232 with other users, by specifying which other users can have which 

   233 form of access to their objects.\medskip

   234 

   235 Discretionary access control is implemented on any multi-user OS 

   236 (Unix, Windows NT, etc.).

   237 \end{itemize}

   238 

   239 \end{frame}

   240 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   241 

   242 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   243 \begin{frame}[c]

   244 \frametitle{Access Control}

   245 

   246 \begin{itemize}

   247 \item \bl{Mandatory Access Control:}\mbox{}\medskip\\

   248 \small Access to objects is controlled by a system-wide policy, for example 

   249 to prevent certain flows of information. In some forms, the system maintains 

   250 security labels for both objects and subjects (processes, users), based on 

   251 which access is granted or denied. Labels can change as the result of an 

   252 access. Security policies are enforced without the cooperation of users or 

   253 application programs.\medskip

   254 

   255 This is implemented today in special military operating system versions

   256 (SELinux).

   257 \end{itemize}

   258 

   259 \end{frame}

   260 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   261 

   262 

   263 

   264 

   265 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   266 \mode<presentation>{

   267 \begin{frame}[c]

   268 \frametitle{Discretionary Access Control}

   269 

   270 In its most generic form usually given by an Access Control Matrix 

   271 of the form

   261 \begin{tabular}{c}

   274 \begin{tabular}{r|c|c|c}

   262 root\\

   275                  & /mail/jane & edit.exe & sendmail \\\hline

   263 \hline

   276 jane          & r, w & r, x & r, x\\\hline

   264 

   277 john          & $\varnothing$ & r, w, x&  r, x\\\hline

   265 user$_1$ user$_2$ \ldots www, mail, lp

   278 sendmail  & a & $\varnothing$ &  r, x\\

   266 \end{tabular}

   267 \end{center}\bigskip\bigskip\bigskip

   268 

   269 

   270 \textcolor{gray}{\small root has UID $=$ 0}\\\pause

   271 \textcolor{gray}{\small you also have groups that can share access to a file}\\

   272 \textcolor{gray}{\small but it is difficult to exclude access selectively}\\

   273 \end{frame}}

   274 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

   275 

   276 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   277 \mode<presentation>{

   278 \begin{frame}[c]

   279 \frametitle{Access Control in Unix (2)}

   280 

   281 

   282 \begin{itemize}

   283 \item privileges are specified by file access permissions (``everything is a file'') 

   284 \item there are 9 (plus 2) bits that specify the permissions of a file

   285 

   286 \begin{center}

   287 \begin{tabular}{l}

   288 \texttt{\$ ls - la}\\

   289 \texttt{-rwxrw-r-{}- \hspace{3mm} foo\_file.txt}

   292 \end{itemize}

   281 

   293 

   282 

   294 \end{frame}}

   283 access privileges: {\bf r}ead, {\bf w}rite, e{\bf x}ecute, {\bf a}ppend

   295 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   284 \end{frame}}

   296 

   285 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   297 

   286 

   298 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   287 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   299 \mode<presentation>{

   288 \begin{frame}[c]

   300 \begin{frame}[c]

   289 \frametitle{Mandatory Access Control}

   301 \frametitle{Login Process}

   290 

   302 

   291 \begin{itemize}

   303 

   292 \item Restrictions to allowed information flows are not decided at the user’s 

   304 \begin{itemize}

   293 discretion (as with Unix chmod), but instead enforced by system policies.

   305 \item login processes run under UID $=$ 0\medskip 

   294 

   306 \begin{center}

   295 \item Mandatory access control mechanisms are aimed in particular at 

   307 \texttt{ps -axl | grep login}

   296 preventing policy violations by untrusted application software, which 

   308 \end{center}\medskip

   297 typically have at least the same access privileges as the invoking user.\medskip

   309 

   298 

   310 \item after login, shells run under UID $=$ user (e.g.~501)\medskip

   299 Simple example: Air Gap Security.

   311 \begin{center}

   300 Uses completely separate network and computer hardware for different application classes.

   312 \texttt{id cu}

   301 \end{itemize}

   313 \end{center}\medskip\pause

   302 

   314 

   303 \end{frame}

   315 \item non-root users are not allowed to change the UID --- would break 

   304 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   316 access control

   305 

   317 \item but needed for example for \texttt{passwd}

   318 \end{itemize}

   319 

   320 \end{frame}}

   321 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%