98   Slides: & KEATS (also home work is there)

    98   Slides: & KEATS (also home work is there)\\

    99                & \alert{\bf (I have put a temporary link in there.)}\\

   179 \small nuclear weapon

   184 \small nuclear weapon keys

   199 \frametitle{}

   204 \frametitle{Access Control in Unix}

   200 

   205 

   206 \begin{itemize}

   207 \item access control provided by the OS

   208 \item authenticate principals (login)

   209 \item mediate access to files, ports, processes according to \alert{roles} (user ids)\\

   210 \item roles get attached with privileges\bigskip\\%

   211 \hspace{8mm}

   212 \begin{tikzpicture}

   213 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

   214 {\begin{minipage}{8cm}

   215 \alert{principle of least privilege:}\\

   216 programs should only have as much privilege as they need 

   217 \end{minipage}};

   218 \end{tikzpicture}

   219 \end{itemize}

   208 \frametitle{\begin{tabular}{@ {}c@ {}}Plain-text Passwords at IEEE\end{tabular}}

   227 \frametitle{Access Control in Unix (2)}

   209 

   228 

   210 \small\textcolor{gray}{On 25 September 2012, a report on a data breach at IEEE:}

   229 \begin{itemize}

   211 

   230 \item the idea is to restrict access to files and therefore lower the consequences of an attack\\[1cm]\mbox{}

   212 

   231 \end{itemize}

   213 \begin{itemize}

   232 

   214 \item IEEE is a standards organisation (not-for-profit) 

   233 \begin{textblock}{1}(2.5,9.5)

   215 \item many standards in CS are by IEEE\medskip

   234   \begin{tikzpicture}[scale=1]

   216 \item 100k plain-text passwords were recorded in logs

   235   

   217 \item the logs were openly accessible on their FTP server

   236   \draw[line width=1mm] (-.3, 0) rectangle (1.5,2);

   218 \end{itemize}\bigskip

   237   \draw (4.7,1) node {Internet};

   219 

   238   \draw (0.6,1.7) node {\footnotesize Interface};

   220 \begin{flushright}\small

   239   \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unpriviledged\\[-1mm] process\end{tabular}};

   221 \textcolor{gray}{\url{http://ieeelog.com}}

   240   \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}priviledged\\[-1mm] process\end{tabular}};

   222 \end{flushright}

   241   

   223 

   242   \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);

   224 \only<2>{

   243 

   225 \begin{textblock}{11}(3,2)

   244   \draw[white] (1.7,1) node (X) {};

   245   \draw[white] (3.7,1) node (Y) {};

   246   \draw[red, <->, line width = 2mm] (X) -- (Y);

   247  

   248   \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1);

   249   \end{tikzpicture}

   250 \end{textblock}

   251 

   252 \end{frame}}

   253 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

   254 

   255 

   256 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   257 \mode<presentation>{

   258 \begin{frame}[t]

   259 \frametitle{Process Ownership}

   260 

   261 \begin{itemize}

   262 \item access control in Unix is very coarse

   263 \end{itemize}\bigskip\bigskip\bigskip

   264 

   265 \begin{center}

   266 \begin{tabular}{c}

   267 root\\

   268 \hline

   269 

   270 user$_1$ user$_2$ \ldots www, mail, lp

   271 \end{tabular}

   272 \end{center}\bigskip\bigskip\bigskip

   273 

   274 

   275 \textcolor{gray}{\small root has UID $=$ 0}\\\pause

   276 \textcolor{gray}{\small you also have groups that can share access to a file}\\

   277 \textcolor{gray}{\small but it is difficult to exclude access selectively}\\

   278 \end{frame}}

   279 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

   280 

   281 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   282 \mode<presentation>{

   283 \begin{frame}[c]

   284 \frametitle{Access Control in Unix (2)}

   285 

   286 

   287 \begin{itemize}

   288 \item privileges are specified by file access permissions (``everything is a file'') 

   289 \item there are 9 (plus 2) bits that specify the permissions of a file

   290 

   291 \begin{center}

   292 \begin{tabular}{l}

   293 \texttt{\$ ls - la}\\

   294 \texttt{-rwxrw-r-{}- \hspace{3mm} foo\_file.txt}

   295 \end{tabular}

   296 \end{center}

   297 \end{itemize}

   298 

   299 \end{frame}}

   300 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   301 

   302 

   303 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   304 \mode<presentation>{

   305 \begin{frame}[c]

   306 \frametitle{Login Process}

   307 

   308 

   309 \begin{itemize}

   310 \item login processes run under UID $=$ 0\medskip 

   311 \begin{center}

   312 \texttt{ps -axl | grep login}

   313 \end{center}\medskip

   314 

   315 \item after login, shells run under UID $=$ user (e.g.~501)\medskip

   316 \begin{center}

   317 \texttt{id cu}

   318 \end{center}\medskip\pause

   319 

   320 \item non-root users are not allowed to change the UID --- would break 

   321 access control

   322 \item but needed for example for \texttt{passwd}

   323 \end{itemize}

   324 

   325 \end{frame}}

   326 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   327 

   328 

   329 

   330 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   331 \mode<presentation>{

   332 \begin{frame}[c]

   333 \frametitle{Setuid and Setgid}

   334 

   335 The solution is that unix file permissions are 9 + \underline{2 Bits}:

   336 \alert{Setuid} and \alert{Setgid} Bits

   337 

   338 \begin{itemize}

   339 \item When a file with setuid is executed, the resulting process will assume the UID given to the owner of the file. 

   340 \item This enables users to create processes as root (or another user).\bigskip

   341 

   342 \item Essential for changing passwords, for example.

   343 \end{itemize}

   344 

   345 \begin{center}

   346 \texttt{chmod 4755 fobar\_file}

   347 \end{center}

   348 

   349 \end{frame}}

   350 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

   351 

   352 

   353 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   354 \mode<presentation>{

   355 \begin{frame}[c]

   356 \frametitle{\begin{tabular}{c}Privilege Separation in\\ OpenSSH\end{tabular}}

   357 

   358 \begin{center}

   359 \begin{tikzpicture}[scale=1]

   360   

   361   \draw[line width=1mm] (0, 1.1) rectangle (1.2,2);

   362   \draw (4.7,1) node {Internet};

   363   \draw (0.6,1.7) node {\footnotesize Slave};

   364   \draw[line width=1mm] (0, 0) rectangle (1.2,0.9);

   365   \draw (0.6,1.7) node {\footnotesize Slave};

   366   \draw (0.6,0.6) node {\footnotesize Slave};

   367   \draw (0.6,-0.5) node {\footnotesize \begin{tabular}{c}unpriviledged\\[-1mm] processes\end{tabular}};

   368   \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}priviledged\\[-1mm] process\end{tabular}};

   369   

   370   \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);

   371   \draw (-2.9,1.7) node {\footnotesize Monitor};

   372 

   373   \draw[white] (1.7,1) node (X) {};

   374   \draw[white] (3.7,1) node (Y) {};

   375   \draw[red, <->, line width = 2mm] (X) -- (Y);

   376  

   377   \draw[red, <->, line width = 1mm] (-0.4,1.4) -- (-1.4,1.1);

   378   \draw[red, <->, line width = 1mm] (-0.4,0.6) -- (-1.4,0.9);

   379 

   380   \end{tikzpicture}

   381 \end{center}

   382 

   383 \begin{itemize}

   384 \item pre-authorisation slave 

   385 \item post-authorisation\bigskip

   386 \item 25\% codebase is privileged, 75\% is unprivileged

   387 \end{itemize}

   388 \end{frame}}

   389 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

   390 

   391 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   392 \mode<presentation>{

   393 \begin{frame}[c]

   394 \frametitle{Network Applications}

   395 

   396 ideally network application in Unix should be designed as follows:

   397 

   398 \begin{itemize}

   399 \item need two distinct processes

   400 \begin{itemize}

   401 \item one that listens to the network; has no privilege

   402 \item one that is privileged and listens to the latter only (but does not trust it)

   403  

   404 \end{itemize}

   405 

   406 \item to implement this you need a parent process, which forks a child process

   407 \item this child process drops privileges and listens to hostile data\medskip

   408 

   409 \item after authentication the parent forks again and the new child becomes the user

   410 \end{itemize}

   411 

   412 

   413 \end{frame}}

   414 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

   415 

   416 

   417 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   418 \mode<presentation>{

   419 \begin{frame}[c]

   420 \frametitle{\begin{tabular}{@ {}c@ {}}Famous Security Flaws in Unix\end{tabular}}

   421 

   422 

   423 \begin{itemize}

   424 \item \texttt{lpr} unfortunately runs with root privileges; you had the option to delete files after printing \ldots\pause\pause

   425 \item for debugging purposes (FreeBSD) Unix provides a ``core dump'', but allowed to follow links \ldots\pause

   426 \item \texttt{mkdir foo} is owned by root\medskip

   427 \begin{center}

   428 \texttt{-rwxr-xr-x  1 root  wheel /bin/mkdir}

   429 \end{center}\medskip

   430 it first creates an i-node as root and then changes to ownership to the user's id\\ \textcolor{gray}{\small (automated with a shell script)}

   431 \end{itemize}

   432 

   433 \only<1>{

   434 \begin{textblock}{1}(3,3)

   227 \draw (0,0) node[inner sep=2mm,fill=white, ultra thick, draw=red, rounded corners=2mm] 

   436 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

   228 {\normalsize\color{darkgray}

   437 {\begin{minipage}{8cm}

   229 \begin{minipage}{7.5cm}\raggedright\small

   438 Only failure makes us experts.

   230 \includegraphics[scale=0.6]{pics/IEEElog.jpg}

   439 	-- Theo de Raadt (OpenBSD, OpenSSH)

   235 \end{frame}}

   444 

   236 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   445 

   237 

   446 \end{frame}}

   238 

   447 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   239 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   448 

   240 \mode<presentation>{

   449 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   241 \begin{frame}[c]

   450 \mode<presentation>{

   242 \frametitle{\begin{tabular}{@ {}c@ {}}Virgin Mobile (USA)\end{tabular}}

   451 \begin{frame}[c]

   243 

   452 \frametitle{\begin{tabular}{@ {}c@ {}}Other Problems\end{tabular}}

   244 \begin{flushright}\small

   453 

   245 \textcolor{gray}{\url{http://arstechnica.com/security/2012/09/virgin-mobile-password-crack-risk/}}

   454 There are thing's you just cannot solve on the programming side:\bigskip

   246 \end{flushright}

   455 

   247 

   456 \begin{itemize}

   248 \begin{itemize}

   457 \item for system maintenance you often have \texttt{cron}-jobs cleaning \texttt{/tmp}\medskip

   249 \item for online accounts passwords must be 6 digits

   458 \begin{itemize}

   250 \item you must cycle through 1M combinations (online)\pause\bigskip

   459 \item attacker:\\ 

   251 

   460 \texttt{mkdir /tmp/a; cat > /tmp/a/passwd}

   252 \item he limited the attack on his own account to 1 guess per second, \alert{\bf and}

   461 \item root:\\\texttt{rm /tmp/*/*}:

   253 \item wrote a script that cleared the cookie set after each guess\pause

   462 \item attacker:\\

   254 \item has been fixed now

   463 \texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a}

   255 \end{itemize}

   464 \end{itemize}

   256 

   465 \end{itemize}

   257 

   466 

   258 

   467 \end{frame}}

   259 \end{frame}}

   468 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   260 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   469 

   261 

   470 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   262 

   471 \mode<presentation>{

   263 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   472 \begin{frame}[c]

   264 \mode<presentation>{

   473 \frametitle{\begin{tabular}{@ {}c@ {}}Security Levels\end{tabular}}

   265 \begin{frame}[c]

   474 

   266 \frametitle{\begin{tabular}{@ {}c@ {}}Smash the Stack for Fun \ldots\end{tabular}}

   475 Unix essentially can only distinguish between two security levels (root and non-root).

   267 

   476 

   268 \begin{itemize}

   477 \begin{itemize}

   269 \item ``smashing the stack attacks'' or ``buffer overflow attacks''

   478 \item In military applications you often have many security levels (top-secret, secret, confidential, unclassified)\bigskip\pause 

   270 \item one of the most popular attacks;\\ attack of the (last) decade\\ ($>$ 50\% of security incidents reported at CERT are related to buffer overflows)

   479 

   271 \begin{flushright}\small

   480 \item Information flow: Bell --- La Pudela model

   272 \textcolor{gray}{\url{http://www.kb.cert.org/vuls}}

   481 

   273 \end{flushright}

   482 \begin{itemize}

   274 \medskip

   483 \item read: your own level and below

   275 \item made popular in an article by Elias Levy\\ (also known as Aleph One):\\

   484 \item write: your own level and above

   276 \begin{center}

   485 \end{itemize}

   277 {\bf ``Smashing The Stack For Fun and Profit''}

   486 \end{itemize}

   278 \end{center}\medskip

   487 

   279 

   488 \end{frame}}

   280 \begin{flushright}

   489 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   281 \small\textcolor{gray}{\url{http://www.phrack.org}, Issue 49, Article 14}

   490 

   282 \end{flushright} 

   491 

   283  

   492 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   284 \end{itemize}

   493 \mode<presentation>{

   285 

   494 \begin{frame}[c]

   286 

   495 \frametitle{\begin{tabular}{@ {}c@ {}}Security Levels (2)\end{tabular}}

   287 \end{frame}}

   496 

   288 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   497 \begin{itemize}

   289 

   498 \item Bell --- La Pudela preserves data secrecy, but not data integrity\bigskip\pause

   290 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   499 

   291 \mode<presentation>{

   500 \item Biba model is for data integrity  

   292 \begin{frame}[c]

   501 

   293 \frametitle{\begin{tabular}{c}The Problem\end{tabular}}

   502 \begin{itemize}

   294 

   503 \item read: your own level and above

   295 \begin{itemize}

   504 \item write: your own level and below

   296 \item The basic problem is that library routines in C look as follows:

   505 \end{itemize}

   297 \begin{center}

   506 \end{itemize}

   298 {\lstset{language=Java}\fontsize{8}{10}\selectfont%

   507 

   299 \texttt{\lstinputlisting{app5.c}}}

   508 \end{frame}}

   509 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   510 

   511 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   512 \mode<presentation>{

   513 \begin{frame}[c]

   514 \frametitle{\begin{tabular}{@ {}c@ {}}Access Control in 2000\end{tabular}}

   515 

   516 According to Ross Anderson (1st edition of his book), some senior Microsoft people held the

   517 following view:

   518 

   519 \begin{center}

   520 \begin{tikzpicture}

   521 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

   522 {\begin{minipage}{10.5cm}

   523 \small Access control does not matter. Computers are becoming single-purpose

   524 or single-user devices. Single-purpose devices, such as Web servers that deliver a single service, don't 

   525 need much in the way of access control as there's nothing for operating system access controls

   526 to do; the job of separating users from each other is best left to application code. As for the PC

   527 on your desk, if all the software on it comes from a single source, then again there's no need 

   528 for the operating system to provide separation. \hfill{}\textcolor{gray}{(in 2000)} 

   529 \end{minipage}};

   530 \end{tikzpicture}

   301 \item the resulting problems are often remotely exploitable 

   532 

   302 \item can be used to circumvents all access control

   533 \end{frame}}

   303 (botnets for further attacks)

   534 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   304 \end{itemize}

   535 

   305   

   536 

   306 \end{frame}}

   537 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   307 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   538 \mode<presentation>{

   308 

   539 \begin{frame}[t]

   309 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   540 \frametitle{\begin{tabular}{@ {}c@ {}}Research Problems\end{tabular}}

   310 \mode<presentation>{

   541 

   311 \begin{frame}[c]

   542 \begin{itemize}

   312 \frametitle{\begin{tabular}{c}Variants\end{tabular}}

   543 \item with access control we are back to 1970s\bigskip

   313 

   544 

   314 There are many variants:

   545 \only<1>{

   315 

   546 \begin{tikzpicture}

   316 \begin{itemize}

   547 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

   317 \item return-to-lib-C attacks

   548 {\begin{minipage}{10cm}

   318 \item heap-smashing attacks\\

   549 \small Going all the way back to early time-sharing systems we systems people regarded the users, and any code they wrote, as the mortal enemies of us and each other. We were like the police force in a violent slum.\\

   319 \textcolor{gray}{\small(Slammer Worm in 2003 infected 90\% of vulnerable systems within 10 minutes)}\bigskip

   550 \mbox{}\hfill--- Roger Needham

   320 

   551 \end{minipage}};

   321 \item ``zero-days-attacks'' (new unknown vulnerability)

   552 \end{tikzpicture}}\pause

   322 \end{itemize}

   553 

   323   

   554 \item the largest research area in access control in 2000-07 has been ``Trusted Computing'', but thankfully it

   324 \end{frame}}

   555 is dead now\bigskip

   325 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   556 \item a useful research area is to not just have robust access control, but also usable access control --- by programmers and users\\ 

   326 

   557 (one possible answer is operating system virtualisation, e.g.~Xen, VMWare)\medskip\pause

   327 

   558 

   328 

   559 \item electronic voting

   329 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   560 \end{itemize}

   330 \mode<presentation>{

   561 \end{frame}}

   331 \begin{frame}[c]

   562 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   332 

   563 

   333 \small

   564 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   334 \texttt{my\_float} is printed twice:\bigskip

   565 \mode<presentation>{

   335 

   566 \begin{frame}[t]

   336 {\lstset{language=Java}\fontsize{8}{10}\selectfont%

   567 \frametitle{\begin{tabular}{@ {}c@ {}}Mobile OS\end{tabular}}

   337 \texttt{\lstinputlisting{C1.c}}}

   568 

   338 

   569 \begin{itemize}

   339   

   570 \item iOS and Android solve the defence-in-depth problem by \alert{sandboxing} applications\bigskip

   340 \end{frame}}

   571 

   341 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   572 \item you as developer have to specify the resources an application needs

   342 

   573 \item the OS provides a sandbox where access is restricted to only these resources

   343 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   574 \end{itemize}

   344 \mode<presentation>{

   575 \end{frame}}

   345 \begin{frame}[c]

   576 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   346 

   577 

   347 \begin{center}

   578 

   348 \only<1>{\includegraphics[scale=0.9]{pics/stack1}\;\;}

   579 

   349 \only<2>{\includegraphics[scale=0.9]{pics/stack2}\;\;}

   580 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   350 \only<3>{\includegraphics[scale=0.9]{pics/stack3}\;\;}

   581 \mode<presentation>{

   351 \end{center}

   582 \begin{frame}[c]

   352   

   583 \frametitle{\begin{tabular}{@ {}c@ {}}Security Theater\end{tabular}}

   353   

   584 

   354 \end{frame}}

   585 

   355 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   586 Security theater is the practice of investing in countermeasures intended to provide the 

   356 

   587 \underline{feeling} of improved security while doing little or nothing to actually achieve it.\hfill{}\textcolor{gray}{Bruce Schneier}

   357 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   588 

   358 \mode<presentation>{

   589 \end{frame}}

   359 \begin{frame}[c]

   590 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   360 

   591 

   361 {\lstset{language=Java}\fontsize{8}{10}\selectfont%

   592 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   362 \texttt{\lstinputlisting{C2.c}}}

   593 \mode<presentation>{

   363 

   594 \begin{frame}[c]

   364   

   595 \frametitle{\begin{tabular}{@ {}c@ {}}\end{tabular}}

   365 \end{frame}}

   596 

   366 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   597 

   367 

   598 Security theater is the practice of investing in countermeasures intended to provide the 

   368 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   599 \underline{feeling} of improved security while doing little or nothing to actually achieve it.\hfill{}\textcolor{gray}{Bruce Schneier}

   369 \mode<presentation>{

   600 

   370 \begin{frame}[c]

   601 \end{frame}}

   371 

   602 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   372 \small

   603 

   373 A programmer might be careful, but still introduce vulnerabilities:\bigskip

   604 

   374 

   605 From: Ross Anderson <Ross.Anderson@cl.cam.ac.uk>

   375 {\lstset{language=Java}\fontsize{8}{10}\selectfont%

   606 Sender: cl-security-research-bounces@lists.cam.ac.uk

   376 \texttt{\lstinputlisting{C2a.c}}}

   607 To: cl-security-research@lists.cam.ac.uk

   377 

   608 Subject: Tip off

   378   

   609 Date: Tue, 02 Oct 2012 13:12:50 +0100

   379 \end{frame}}

   610 

   380 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   611 I received the following tip off, and have removed the sender's

   381 

   612 coordinates. I suspect it is one of many security vendors who

   382 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   613 don't even get the basics right; if you ever go to the RSA 

   383 \mode<presentation>{

   614 conference, there are a thousand such firms in the hall, each

   384 \begin{frame}[c]

   615 with several eager but ignorant salesmen. A trying experience

   385 \frametitle{\begin{tabular}{c}Payloads\end{tabular}}

   616 

   386 

   617 Ross

   387 \begin{itemize}

   388 \item the idea is you store some code as part to the buffer

   389 \item you then override the return address to execute this payload\medskip

   390 \item normally you start a root-shell\pause

   391 \item difficulty is to guess the right place where to ``jump''

   392 \end{itemize}

   393   

   394 \end{frame}}

   395 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   396 

   397 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   398 \mode<presentation>{

   399 \begin{frame}[c]

   400 \frametitle{\begin{tabular}{c}Payloads (2)\end{tabular}}

   401 

   402 \begin{itemize}

   403 \item another difficulty is that the code is not allowed to contain \texttt{$\backslash$x00}:

   404 

   405 \begin{center}

   406 \texttt{xorl   \%eax, \%eax}

   407 \end{center}

   408 \end{itemize}\bigskip\bigskip

   409   

   410 {\lstset{language=Java}\fontsize{8}{10}\selectfont%

   411 \texttt{\lstinputlisting{app5.c}}}

   412   

   413 \end{frame}}

   414 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   415 

   416 

   417 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   418 \mode<presentation>{

   419 \begin{frame}[c]

   420 \frametitle{\begin{tabular}{c}Format String Vulnerability\end{tabular}}

   421 

   422 \small

   423 \texttt{string} is nowhere used:\bigskip

   424 

   425 {\lstset{language=Java}\fontsize{8}{10}\selectfont%

   426 \texttt{\lstinputlisting{C6.c}}}\bigskip

   427 

   428 this vulnerability can be used to read out the stack

   429   

   430 \end{frame}}

   431 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   432 

   433 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   434 \mode<presentation>{

   435 \begin{frame}[c]

   436 \frametitle{\begin{tabular}{c}Protections against BO Attacks\end{tabular}}

   437 

   438 \begin{itemize}

   439 \item use safe library functions

   440 \item ensure stack data is not executable (can be defeated)

   441 \item address space randomisation (makes one-size-fits-all more difficult)

   442 \item choice of programming language (one of the selling points of Java)

   443 

   444 \end{itemize}

   445   

   446 \end{frame}}

   447 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   448 

   449 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   450 \mode<presentation>{

   451 \begin{frame}[c]

   452 \frametitle{\begin{tabular}{c}Security Goals\end{tabular}}

   453 

   454 \begin{itemize}

   455 \item Prevent common vulnerabilities from occurring (e.g. buffer overflows)\pause

   456 \item Recover from attacks (traceability and auditing of security-relevant actions)\pause

   457 \item Monitoring (detect attacks)\pause

   458 \item Privacy, confidentiality, anonymity (to protect secrets)\pause

   459 \item Authenticity (eeded for access control)\pause

   460 \item Integrity (prevent unwanted modification or tampering)\pause

   461 \item Availability and reliability (reduce the risk of DoS attacks)

   462 \end{itemize}

   463   

   464 \end{frame}}

   465 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   466 

   467 

   468 

   469 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   470 \mode<presentation>{

   471 \begin{frame}[c]

   472 \frametitle{\begin{tabular}{c}Homework\end{tabular}}

   473 

   474 \begin{itemize}

   475 \item Assume format string attacks allow you to read out the stack. What can you do

   476 	with this information?\bigskip

   477 

   478 \item Assume you can crash a program remotely. Why is this a problem?

   479 \end{itemize}

   480   

   481 \end{frame}}

   482 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%