32 \end{center} |
32 \end{center} |
33 |
33 |
34 \end{frame} |
34 \end{frame} |
35 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
35 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
36 |
36 |
37 |
|
38 |
|
39 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
40 \begin{frame}[c] |
|
41 \frametitle{\begin{tabular}{c}Network Applications:\\[-1mm] Privilege Separation\end{tabular}} |
|
42 |
|
43 \begin{center} |
|
44 \begin{tikzpicture}[scale=1] |
|
45 |
|
46 \draw[line width=1mm] (-.3, 0) rectangle (1.5,2); |
|
47 \draw (4.7,1) node {Internet}; |
|
48 \draw (-2.7,1.7) node {\footnotesize Application}; |
|
49 \draw (0.6,1.7) node {\footnotesize Interface}; |
|
50 \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] process\end{tabular}}; |
|
51 \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}}; |
|
52 |
|
53 \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2); |
|
54 |
|
55 \draw[white] (1.7,1) node (X) {}; |
|
56 \draw[white] (3.7,1) node (Y) {}; |
|
57 \draw[red, <->, line width = 2mm] (X) -- (Y); |
|
58 |
|
59 \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1); |
|
60 \end{tikzpicture} |
|
61 \end{center} |
|
62 |
|
63 \begin{itemize} |
|
64 \item the idea is make the attack surface smaller and |
|
65 mitigate the consequences of an attack |
|
66 \item you need an OS that supports different roles (root vs.~users) |
|
67 \end{itemize} |
|
68 |
|
69 \end{frame} |
|
70 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
71 |
|
72 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
73 \begin{frame}[c] |
|
74 \frametitle{Weaknesses of Unix AC} |
|
75 |
|
76 \begin{itemize} |
|
77 \item if you have too many roles (for example too finegrained AC), then |
|
78 hierarchy is too complex\medskip\\ \textcolor{gray}{you invite situations |
|
79 like\ldots let's be root}\bigskip |
|
80 |
|
81 \item you can still abuse the system\ldots |
|
82 \end{itemize} |
|
83 |
|
84 \end{frame} |
|
85 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
86 |
|
87 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
88 \begin{frame}[c] |
|
89 \frametitle{A ``Cron''-Attack} |
|
90 |
|
91 The idea is to trick a privileged person to do something on your |
|
92 behalf: |
|
93 |
|
94 \begin{itemize} |
|
95 \item root:\\\texttt{rm /tmp/*/*}\bigskip\bigskip\pause |
|
96 |
|
97 \small |
|
98 \begin{minipage}{1.1\textwidth} |
|
99 \textcolor{gray}{the shell behind the scenes:}\\ |
|
100 \textcolor{gray}{\texttt{rm /tmp/dir$_1$/file$_1$ /tmp/dir$_1$/file$_2$ /tmp/dir$_2$/file$_1$ \ldots}}\bigskip\\ |
|
101 |
|
102 \textcolor{gray}{this takes time} |
|
103 \end{minipage} |
|
104 \end{itemize} |
|
105 |
|
106 \end{frame} |
|
107 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
108 |
|
109 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
110 \begin{frame}[c] |
|
111 \frametitle{A ``Cron''-Attack} |
|
112 |
|
113 \begin{enumerate} |
|
114 \item attacker \textcolor{gray}{(creates a fake passwd file)}\\ |
|
115 \texttt{mkdir /tmp/a; cat > /tmp/a/passwd}\medskip |
|
116 \item root \textcolor{gray}{(does the daily cleaning)}\\ |
|
117 \texttt{rm /tmp/*/*}\medskip\\ |
|
118 \hspace{2cm}\textcolor{gray}{records that \texttt{/tmp/a/passwd}}\\ |
|
119 \hspace{2cm}\textcolor{gray}{should be deleted, but does not do it yet}\medskip\\ |
|
120 |
|
121 \item attacker \textcolor{gray}{(meanwhile deletes the fake passwd file, and establishes a link to |
|
122 the real passwd file)}\\ |
|
123 \texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a}\\ |
|
124 \item root now deletes the real passwd file |
|
125 \end{enumerate} |
|
126 |
|
127 \only<2>{ |
|
128 \begin{textblock}{11}(2,5) |
|
129 \begin{tikzpicture} |
|
130 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
|
131 {\normalsize\color{darkgray} |
|
132 \begin{minipage}{9.5cm}\raggedright |
|
133 To prevent this kind of attack, you need additional |
|
134 policies (don't do such operations as root). |
|
135 \end{minipage}}; |
|
136 \end{tikzpicture} |
|
137 \end{textblock}} |
|
138 |
|
139 \end{frame} |
|
140 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
141 |
|
142 |
|
143 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
37 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
144 \begin{frame}[c] |
38 \begin{frame}[c] |
145 \frametitle{\Large Buffer Overflow Attacks} |
39 \frametitle{\Large Buffer Overflow Attacks} |
146 |
40 |
147 \begin{center} |
41 \begin{center} |
148 \begin{columns}[b] |
42 \begin{columns}[b] |
149 \begin{column}{.4\textwidth} |
43 \begin{column}{.4\textwidth} |
150 \centering |
44 \centering |
151 \includegraphics[scale=1.2]{../pics/barrier.jpg}\\ |
45 \includegraphics[scale=0.3]{../pics/barrier.jpg}\\ |
152 lectures so far |
46 lectures so far |
153 \end{column} |
47 \end{column} |
154 \begin{column}<2>{.4\textwidth} |
48 \begin{column}{.4\textwidth} |
155 \centering |
49 \centering |
156 \includegraphics[scale=0.32]{../pics/trainwreck.jpg}\\ |
50 \includegraphics[scale=0.32]{../pics/trainwreck.jpg}\\ |
157 today |
51 today |
158 \end{column} |
52 \end{column} |
159 \end{columns} |
53 \end{columns} |
160 \end{center} |
54 \end{center} |
161 |
55 |
162 \end{frame} |
56 \end{frame} |
163 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
57 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
164 |
58 |
165 |
|
166 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
59 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
167 \begin{frame}[c] |
60 \begin{frame}[c] |
168 \frametitle{Smash the Stack for Fun\ldots} |
61 \frametitle{Smash the Stack for Fun\ldots} |
169 |
62 |
170 \begin{itemize} |
63 \begin{itemize} |
171 \item {\bf Buffer Overflow Attacks} or\\ {\bf Smashing the Stack Attacks}\medskip |
64 \item {\bf Buffer Overflow Attacks} or\\ |
|
65 {\bf Smashing the Stack Attacks}\medskip |
172 |
66 |
173 \item one of the most popular attacks, unfortunately\\ |
67 \item one of the most popular attacks, unfortunately\\ |
174 ($>$ 50\% of security incidents reported at CERT are related |
68 ($>$ 50\% of security incidents reported at CERT are related |
175 to buffer overflows) |
69 to buffer overflows) |
176 \begin{flushright} |
70 \begin{flushright} |
456 |
350 |
457 |
351 |
458 \end{frame} |
352 \end{frame} |
459 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
353 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
460 |
354 |
|
355 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
356 \begin{frame}[c] |
|
357 \frametitle{Optimising Success} |
|
358 |
|
359 \begin{center} |
|
360 \begin{tabular}{l@{\hspace{2cm}}l} |
|
361 \begin{tikzpicture}[scale=0.6] |
|
362 \draw[line width=1mm] (-2, -1) rectangle (2,3); |
|
363 \draw[line width=1mm,fill=blue!30] (-2, 1.9) rectangle (2,3); |
|
364 \draw (0,2.5) node {\small\tt shell code}; |
|
365 \draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7); |
|
366 \draw[->,line width=0.3mm] (1.05, -1) -- (1.05,-1.7) -- |
|
367 (-3,-1.7) -- (-3, 3.7) -- (-1.9, 3.7) -- (-1.9, 3.1); |
|
368 \end{tikzpicture} |
|
369 & |
|
370 \onslide<2>{ |
|
371 \begin{tikzpicture}[scale=0.6] |
|
372 \draw[gray!50,fill=red!30] (-2,0.3) rectangle (2,3); |
|
373 \draw[line width=1mm] (-2, -1) rectangle (2,3); |
|
374 \draw[line width=1mm,fill=blue!30] (-2, 0.3) rectangle (2, -0.7); |
|
375 \draw (0,-0.2) node {\small\tt shell code}; |
|
376 \draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7); |
|
377 \draw [line width=0.5,decoration={brace,amplitude=2mm},decorate] |
|
378 (2.3,3) -- (2.3,0.3); |
|
379 \draw[line width=0.3mm] (1.05, -1) -- (1.05,-1.7) -- |
|
380 (3,-1.7) -- (3,1.65) -- (2.6, 1.65); |
|
381 \end{tikzpicture}} |
|
382 \end{tabular} |
|
383 \end{center}\bigskip |
|
384 |
|
385 \onslide<2>{ |
|
386 fill up the red part of the string with \pcode{NOP} operations |
|
387 (Intel \texttt{$\backslash$x90})} |
|
388 |
|
389 \end{frame} |
|
390 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
391 |
461 |
392 |
462 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
393 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
463 \begin{frame}[c] |
394 \begin{frame}[c] |
464 \frametitle{Variants} |
395 \frametitle{Variants} |
465 |
396 |
537 |
466 |
538 |
467 |
539 \end{frame} |
468 \end{frame} |
540 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
469 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
541 |
470 |
542 |
471 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
543 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
472 \begin{frame}[c] |
544 \begin{frame}[c] |
473 \frametitle{NIST Statistics about BOA} |
545 \frametitle{\begin{tabular}{c}Network Applications:\\[-1mm] Privilege Separation\end{tabular}} |
|
546 |
|
547 |
474 |
548 \begin{center} |
475 \begin{center} |
549 \begin{tikzpicture}[scale=1] |
476 \begin{tikzpicture} |
550 |
477 \begin{axis}[ |
551 \draw[line width=1mm] (-.3, 0) rectangle (1.5,2); |
478 xlabel={year}, |
552 \draw (4.7,1) node {Internet}; |
479 ylabel={\% of total attacks}, |
553 \draw (-2.7,1.7) node {\footnotesize Application}; |
480 ylabel style={yshift=0em}, |
554 \draw (0.6,1.7) node {\footnotesize Interface}; |
481 enlargelimits=false, |
555 \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] process\end{tabular}}; |
482 xtick={1997,1999,2001,...,2015}, |
556 \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}}; |
483 xmin=1996.5, |
557 |
484 xmax=2016, |
558 \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2); |
485 ymax=21, |
559 |
486 ytick={0,5,...,20}, |
560 \draw[white] (1.7,1) node (X) {}; |
487 scaled ticks=false, |
561 \draw[white] (3.7,1) node (Y) {}; |
488 axis lines=left, |
562 \draw[red, <->, line width = 2mm] (X) -- (Y); |
489 width=11cm, |
563 |
490 height=5cm, |
564 \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1); |
491 ybar, |
565 \end{tikzpicture} |
492 nodes near coords= |
|
493 {\footnotesize |
|
494 $\pgfmathprintnumber[fixed,fixed zerofill,precision=1,use comma]{\pgfkeysvalueof{/data point/y}}$}, |
|
495 x tick label style={font=\footnotesize,/pgf/number format/1000 sep={}}] |
|
496 \addplot |
|
497 table [x=Year,y=Percentage] {../handouts/bufferoverflows.data}; |
|
498 \end{axis} |
|
499 \end{tikzpicture} |
566 \end{center} |
500 \end{center} |
567 |
501 |
568 \begin{itemize} |
502 from the US National Vulnerability Database\\ |
569 \item the idea is make the attack surface smaller and mitigate the |
503 \small\url{http://web.nvd.nist.gov/view/vuln/statistics} |
570 consequences of an attack |
504 |
571 \end{itemize} |
505 \end{frame} |
572 \end{frame} |
506 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
573 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
507 |
574 |
508 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
575 |
509 \begin{frame}[fragile] |
576 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
510 \frametitle{D-Link Wifi Router, BOA} |
577 \mode<presentation>{ |
511 \small |
578 \begin{frame}[c] |
512 |
579 \frametitle{\begin{tabular}{@ {}c@ {}}Infamous Security Flaws\\[-1mm] in Unix\end{tabular}} |
513 As a proof-of-concept, the following URL allows |
580 |
514 attackers to control the return value saved on |
581 |
515 the stack (the vulnerability is triggered when |
582 \begin{itemize} |
516 executing \pcode{"/usr/sbin/widget"}): |
583 \item \texttt{lpr} unfortunately runs with root privileges; you had the option to delete files after printing \ldots\pause\pause |
517 |
584 \item for debugging purposes (FreeBSD) Unix provides a ``core dump'', but allowed to follow links \ldots\pause |
518 \begin{center}\footnotesize |
585 \item \texttt{mkdir foo} is owned by root\medskip |
519 \pcode{curl http://<target ip>/post_login.xml?hash=AAA...AAABBBB} |
586 \begin{center} |
520 \end{center} |
587 \texttt{-rwxr-xr-x 1 root wheel /bin/mkdir} |
521 |
588 \end{center}\medskip |
522 The value of the "hash" HTTP GET parameter consists of |
589 it first creates an i-node as root and then changes to ownership to the user's id\\ \textcolor{gray}{\small (race condition -- can be automated with a shell script)} |
523 292 occurrences of the \pcode{'A'} character, followed by four |
590 \end{itemize} |
524 occurrences of character \pcode{'B'}. In our lab setup, characters |
591 |
525 \pcode{'B'} overwrite the saved program counter (\pcode{\%ra}).\bigskip |
592 \only<5->{ |
526 |
593 \begin{textblock}{1}(3,7) |
527 |
594 \begin{tikzpicture} |
528 \begin{tabular}{@{}ll} |
595 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
529 Discovery date: & 06/03/2013\\ |
596 {\begin{minipage}{8cm} |
530 Release date: & 02/08/2013 |
597 Only failure makes us experts. |
531 \end{tabular}\bigskip |
598 -- Theo de Raadt (OpenBSD, OpenSSH) |
532 |
599 \end{minipage}}; |
533 |
600 \end{tikzpicture} |
534 \footnotesize |
601 \end{textblock}} |
535 \hfill\url{http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt} |
602 |
536 \end{frame} |
603 \end{frame}} |
537 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
538 |
|
539 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
540 \begin{frame}[fragile] |
|
541 \frametitle{GHOST in Glibc} |
|
542 |
|
543 \small The GHOST vulnerability is a buffer overflow condition |
|
544 that can be easily exploited locally and remotely. This |
|
545 vulnerability is named after the GetHOSTbyname function |
|
546 involved in the exploit.\medskip |
|
547 |
|
548 The attack allows the attacker to execute arbitrary code and |
|
549 take control of the victim’s vulnerable machine. |
|
550 Unfortunately, the vulnerability exists in the GNU C Library |
|
551 (glibc), a code library originally released in 2000, meaning |
|
552 it has been widely distributed. Although an update released by |
|
553 Linux in 2013 mitigated this vulnerability, most systems and |
|
554 products have not installed the patch.\medskip |
|
555 |
|
556 |
|
557 \begin{tabular}{@{}ll} |
|
558 Release date: & 01/28/2015 |
|
559 \end{tabular}\smallskip |
|
560 |
|
561 |
|
562 \footnotesize |
|
563 \hfill\url{https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability} |
|
564 \end{frame} |
604 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
565 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
605 |
566 |
606 |
567 |
607 |
568 |
608 \end{document} |
569 \end{document} |