43 \small |
43 \small |
44 |
44 |
45 \begin{itemize} |
45 \begin{itemize} |
46 \item ``Would be good, if you provide more detailed explanations. I feel |
46 \item ``Would be good, if you provide more detailed explanations. I feel |
47 your slides are not as structured as they could be.'' |
47 your slides are not as structured as they could be.'' |
48 \item Please consider reference book chapters to cover core subject |
48 \item ``Please consider reference book chapters to cover core subject |
49 areas.''\pause |
49 areas.''\pause |
50 \item ``The homework questions don't come directly from the |
50 \item ``The homework questions don't come directly from the |
51 slides. So must go look things up.'' |
51 slides. So must go look things up.'' |
52 \item ``Could you please put the homework answers online, perhaps |
52 \item ``Could you please put the homework answers online, perhaps |
53 just before the exam. That's late enough where we should have done |
53 just before the exam. That's late enough where we should have done |
111 If you tell your browser to identify itself as Joel's backdoor, instead of (say) |
111 If you tell your browser to identify itself as Joel's backdoor, instead of (say) |
112 as Mozilla/5.0 AppleWebKit/536.30.1 Version/6.0.5, you're in without authentication.\medskip |
112 as Mozilla/5.0 AppleWebKit/536.30.1 Version/6.0.5, you're in without authentication.\medskip |
113 |
113 |
114 "What is this string," I hear you ask? |
114 "What is this string," I hear you ask? |
115 |
115 |
116 You will laugh: it is |
116 You will laugh: it is\pause |
117 |
117 |
118 \begin{center}\large |
118 \begin{center}\large |
119 \pcode{xmlset_roodkcableoj28840ybtide} |
119 \pcode{xmlset_roodkcableoj28840ybtide} |
120 \end{center} |
120 \end{center} |
121 \end{quote}\bigskip\bigskip |
121 \end{quote}\bigskip\bigskip |
127 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
127 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
128 |
128 |
129 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
129 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
130 \begin{frame}[fragile] |
130 \begin{frame}[fragile] |
131 |
131 |
132 CVE-2014-0476 chkrootkit vulnerability 4 Jun'14\medskip |
132 CVE-2014-0476 \pcode{chkrootkit} vulnerability 4 Jun'14\medskip |
133 |
133 |
134 \begin{quote}\rm\small |
134 \begin{quote}\rm\small |
135 Hi, |
135 Hi, |
136 |
136 |
137 we just found a serious vulnerability in the chkrootkit package, which |
137 we just found a serious vulnerability in the chkrootkit package, which |
138 may allow local attackers to gain root access to a box in certain |
138 may allow local attackers to gain root access to a box in certain |
139 configurations (\pcode{/tmp} not mounted noexec). Steps to reproduce: |
139 configurations (\pcode{/tmp} not mounted noexec). Steps to reproduce: |
140 |
140 |
141 \begin{itemize} |
141 \begin{itemize} |
142 \item Put an executable file named \pcode{update} with non-root owner in /tmp (not |
142 \item Put an executable file named \pcode{update} with non-root owner in |
143 mounted noexec, obviously) |
143 \pcode{/tmp} (not mounted noexec, obviously) |
144 \item Run chkrootkit (as uid \pcode{0}) |
144 \item Run chkrootkit (as uid \pcode{0}) |
145 \end{itemize} |
145 \end{itemize} |
146 |
146 |
147 Result: The file \pcode{/tmp/update} will be executed as root, thus effectively |
147 Result: The file \pcode{/tmp/update} will be executed as root, thus effectively |
148 rooting your box, if malicious content is placed inside the file. |
148 rooting your box, if malicious content is placed inside the file. |
149 |
149 |
150 If an attacker knows you are periodically running chkrootkit (like in |
150 If an attacker knows you are periodically running chkrootkit (like in |
151 cron.daily) and has write access to \pcode{/tmp} (not mounted noexec), he may |
151 \pcode{cron.daily}) and has write access to \pcode{/tmp} (not mounted noexec), he may |
152 easily take advantage of this. |
152 easily take advantage of this. |
153 \end{quote} |
153 \end{quote} |
154 \mbox{}\\[-10mm] |
154 \mbox{}\\[-10mm] |
155 |
155 |
156 \hfill\footnotesize\url{http://seclists.org/oss-sec/2014/q2/430} |
156 \hfill\footnotesize\url{http://seclists.org/oss-sec/2014/q2/430} |
750 \mode<presentation>{ |
750 \mode<presentation>{ |
751 \begin{frame}[c] |
751 \begin{frame}[c] |
752 |
752 |
753 \begin{center} |
753 \begin{center} |
754 \begin{tabular}{ll} |
754 \begin{tabular}{ll} |
755 \bl{$A \rightarrow B$:} & \bl{$N_a$}\\ |
755 \bl{$A \rightarrow B$:} & \bl{$N_A$}\\ |
756 \bl{$B \rightarrow A$:} & \bl{$\{N_a, N_b\}_{K_{ab}}$}\\ |
756 \bl{$B \rightarrow A$:} & \bl{$\{N_A, N_B\}_{K_{ab}}$}\\ |
757 \bl{$A \rightarrow B$:} & \bl{$N_b$}\\ |
757 \bl{$A \rightarrow B$:} & \bl{$N_B$}\\ |
758 \end{tabular} |
758 \end{tabular} |
759 \end{center} |
759 \end{center} |
760 |
760 |
761 The attack (let $A$ decrypt her own messages): |
761 The attack (let $A$ decrypt her own messages): |
762 |
762 |
763 \begin{center} |
763 \begin{center} |
764 \begin{tabular}{ll} |
764 \begin{tabular}{ll} |
765 \bl{$A \rightarrow E$:} & \bl{$N_a$}\\ |
765 \bl{$A \rightarrow E$:} & \bl{$N_A$}\\ |
766 \textcolor{gray}{$E \rightarrow A$:} & \textcolor{gray}{$N_a$}\\ |
766 \textcolor{gray}{$E \rightarrow A$:} & \textcolor{gray}{$N_A$}\\ |
767 \textcolor{gray}{$A \rightarrow E$:} & \textcolor{gray}{$\{N_a, N_a\}_{K_{ab}}$}\\ |
767 \textcolor{gray}{$A \rightarrow E$:} & \textcolor{gray}{$\{N_A, N_A'\}_{K_{AB}}$}\\ |
768 \bl{$E \rightarrow A$:} & \bl{$\{N_a, N_a\}_{K_{ab}}$}\\ |
768 \bl{$E \rightarrow A$:} & \bl{$\{N_A, N_A'\}_{K_{AB}}$}\\ |
769 \bl{$A \rightarrow E$:} & \bl{$N_a \;\;(= N_b)$}\\ |
769 \bl{$A \rightarrow E$:} & \bl{$N_A' \;\;(= N_B)$}\\ |
770 \end{tabular} |
770 \end{tabular} |
771 \end{center}\pause |
771 \end{center}\pause |
772 |
772 |
773 \small Solutions: \bl{$K_{ab} \not= K_{ba}$} or include an id in the second message |
773 \small Solutions: \bl{$K_{AB} \not= K_{BA}$} or include an id in the second message |
774 \end{frame}} |
774 \end{frame}} |
775 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
775 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
776 |
776 |
777 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
777 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
778 \mode<presentation>{ |
778 \mode<presentation>{ |