--- a/slides/slides05.tex Wed Oct 21 22:07:46 2015 +0100
+++ b/slides/slides05.tex Thu Oct 22 02:11:23 2015 +0100
@@ -1,9 +1,10 @@
\PassOptionsToPackage{bookmarks=false}{hyperref}
\documentclass[dvipsnames,14pt,t,hyperref={bookmarks=false}]{beamer}
+\usepackage{../style}
\usepackage{../slides}
\usepackage{../graphics}
\usepackage{../langs}
-\usepackage{../style}
+\usepackage{../data}
\usetikzlibrary{arrows}
\usetikzlibrary{shapes}
@@ -294,6 +295,7 @@
\item CA: ``I, the CA, have verified that public key
\bl{$P^{pub}_{Bob}$} belongs to Bob''\bigskip
\item CA must be trusted by everybody\medskip
+\item certificates are time limited, and can be revoked
\item What happens if CA issues a false certificate? Who pays in case of loss? (VeriSign
explicitly limits liability to \$100.)
@@ -302,79 +304,276 @@
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[c]
+\frametitle{PKI: Chains of Trust}
+
+\begin{center}
+ \begin{tikzpicture}[scale=1,
+ node/.style={
+ rectangle,rounded corners=3mm,
+ very thick,draw=black!50,minimum height=18mm, minimum width=23mm,
+ top color=white,bottom color=black!20}]
+
+ \node (A) at (0,0) [node] {};
+ \node [below right] at (A.north west)
+ {\small\begin{tabular}{@{}l}CA\\Root Cert.\end{tabular}};
+
+ \node (B) at (4,0) [node] {};
+ \node [below right=1mm] at (B.north west)
+ {\mbox{}\hspace{-1mm}\small
+ \begin{tabular}{@{}l}Subordinate\\ CA\end{tabular}};
+
+ \node (C) at (8,0) [node] {};
+ \node [below right] at (C.north west)
+ {\small\begin{tabular}{@{}l}Server\\ Bank.com\end{tabular}};
+
+ \draw [->,line width=4mm] (A) -- (B);
+ \draw [->,line width=4mm] (B) -- (C);
+
+ \node (D) at (6,-3) [node] {};
+ \node [below right] at (D.north west)
+ {\small\begin{tabular}{@{}l}Browser\\ Root Store\end{tabular}};
+
+ \node (E) at (2,-3) [node] {};
+ \node [below right] at (E.north west)
+ {\small\begin{tabular}{@{}l}Browser\\ Company\end{tabular}};
+
+ \draw [->,line width=4mm] (E) -- (D);
+ \end{tikzpicture}
+\end{center}
+
+\begin{itemize}
+\item CAs make almost no money anymore, because of competition
+\item browser companies are not really interested in security,
+rather than market share
+\end{itemize}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
-\frametitle{Best Practices}
+\frametitle{PKI: Weaknesses}
+
+CAs just cannot win (make any profit):\medskip
+
+\begin{itemize}
+\item there are hundreds of CAs, which issue million of
+ certificates and the error rate is small
+
+\item users (servers) do not want to pay or pay as little as
+ possible\bigskip
+
+\item a CA can issue a certificate for any domain not needing
+ any permission (CAs are meant to be undergo audits,
+ but\ldots DigiNotar); if they have issued many
+ certificates, they ``become too big to fail''
+
+\item Can we be sure CAs are not just front-ends of some
+ government organisation?
+
+\end{itemize}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[c]
+\frametitle{PKI: Weaknesses}
+
+\begin{itemize}
+
+\item many certificates are issued via whois\ldots if you
+ hijacked a domain, it is easy to obtain
+ certificates\medskip
+
+\item revocation does not work (Chrome has given up on
+ revocation lists)\medskip
-{\bf Principle 1:} Every message should say what it means: the
-interpretation of a message should not depend on the
-context.\bigskip\pause
+\item lax approach to validation of certificates
+ (Have you bypassed certification warnings?)\medskip
+
+\item sometimes you want to install invalid certificates
+ (self-signed)
+
+\end{itemize}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[c]
+\frametitle{PKI: Attacks}
+
+\begin{itemize}
-{\bf Principle 2:} If the identity of a principal is essential
-to the meaning of a message, it is prudent to mention the
-principal’s name explicitly in the message (though
-difficult).\bigskip
+\item Go directly after root certificates
+ \begin{itemize}
+ \item governments can demand private keys\smallskip
+ \item 10 years ago it was estimated to break a 1024 bit key
+ in one year using 10 -30 Mio \$; this is now reduced to 1 Mio \$
+ \end{itemize}
+
+\item Go after buggy implementations of certificate
+ validation\smallskip
+
+\item Social Engineering
+ \begin{itemize}
+ \item in 2001 somebody pretended to be
+ from Microsoft and asked for two code-signing
+ certificates
+ \end{itemize}\bigskip
+\end{itemize}
+
+\small The eco-system is completely broken (it relies on
+thousands of entities doing the right thing). Maybe DNSSEC
+where keys can be attached to domain names is a way out.
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
-\frametitle{Best Practices}
-
-{\bf Principle 3:} Be clear about why encryption is being
-done. Encryption is not wholly cheap, and not asking precisely
-why it is being done can lead to redundancy. Encryption is not
-synonymous with security.
-
-\small
-\begin{center}
-Possible Uses of Encryption
+\frametitle{Real Attacks}
\begin{itemize}
-\item Preservation of confidentiality: \bl{$\{X\}_K$} only those that have \bl{$K$} may recover \bl{$X$}.
\item Guarantee authenticity: The partner is indeed some particular principal.
\item Guarantee confidentiality and authenticity: binds two parts of a message ---
-\bl{$\{X,Y\}_K$} is not the same as \bl{$\{X\}_K$} and \bl{$\{Y\}_K$}.
+
+\item In 2011, DigiNotar (Dutch) was the first CA which got
+ compromised completely, and where many fraudulent
+ certificates were issued. It included approximately
+ 300,000 IP addresses, mostly located in Iran. The
+ attackers (in Iran?) were likely interested only in
+ collecting gmail passwords.\medskip
+
+\item The Flame malware piggy-bagged on this attack by
+ advertising malicious Windows updates to some targeted
+ systems (mostly in Iran, Israel, Sudan).
+
\end{itemize}
-\end{center}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[c]
+\frametitle{PKI is Broken}
+
+\begin{itemize}
+
+\item PKI and certificates are meant to protect you against
+ MITM attacks, but if the attack occurs your are
+ presented with a warning and you need to decide whether
+ you are under attack.\medskip
+
+\item Webcontent gets often loaded from 3rd-party servers,
+ which might not be secured\medskip
+
+\item Misaligned incentives: browser vendors are not
+ interested in breaking webpages with invalid
+ certificates
+
+\end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
-\frametitle{Best Practices}
+
+Why are there so many invalid certificates?\bigskip
+
+\begin{itemize}
+
+\item insufficient name coverage (www.example.com should
+include example.com)
-{\bf Principle 4:} The protocol designers should know which
-trust relations their protocol depends on, and why the
-dependence is necessary. The reasons for particular trust
-relations being acceptable should be explicit though they will
-be founded on judgment and policy rather than on
-logic.\bigskip
+\item IoT: manny appliances have web-based admin interfaces;
+ the manufacturer cannot know under which IP and domain name
+ the appliances are run (so cannot install a valid certificate)
-
Example Certification Authorities: CAs are trusted to certify
-a key only after proper steps have been taken to identify the
-principal that owns it.
+\item expired certificates, or incomplete chains of trust
+ (servers are supposed to supply them)
+
+\end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-\begin{frame}[c]
-\frametitle{Formal Methods}
-
-Ross Anderson about the use of Logic:\bigskip
-
-\begin{quote}
-Formal methods can be an excellent way of finding
-bugs in security protocol designs as they force the designer
-to make everything explicit and thus confront difficult design
-choices that might otherwise be fudged.
-\end{quote}
-
-\end{frame}
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-
+%
+%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%\begin{frame}[c]
+%\frametitle{Best Practices}
+%
+%{\bf Principle 1:} Every message should say what it means: the
+%interpretation of a message should not depend on the
+%context.\bigskip\pause
+%
+%{\bf Principle 2:} If the identity of a principal is essential
+%to the meaning of a message, it is prudent to mention the
+%principal’s name explicitly in the message (though
+%difficult).\bigskip
+%
+%\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%\begin{frame}[c]
+%\frametitle{Best Practices}
+%
+%{\bf Principle 3:} Be clear about why encryption is being
+%done. Encryption is not wholly cheap, and not asking precisely
+%why it is being done can lead to redundancy. Encryption is not
+%synonymous with security.
%
+%
+%\small
+%\begin{center}
+%Possible Uses of Encryption
%
+%
+%\begin{itemize}
+%\item Preservation of confidentiality: \bl{$\{X\}_K$} only those that have \bl{$K$} may recover \bl{$X$}.
%\item Guarantee authenticity: The partner is indeed some particular principal.
%\item Guarantee confidentiality and authenticity: binds two parts of a message ---
+%\bl{$\{X,Y\}_K$} is not the same as \bl{$\{X\}_K$} and \bl{$\{Y\}_K$}.
+%\end{itemize}
+%\end{center}
+%
+%\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%\begin{frame}[c]
+%\frametitle{Best Practices}
+%
+%{\bf Principle 4:} The protocol designers should know which
+%trust relations their protocol depends on, and why the
+%dependence is necessary. The reasons for particular trust
+%relations being acceptable should be explicit though they will
+%be founded on judgment and policy rather than on
+%logic.\bigskip
+%
+%
%Example Certification Authorities: CAs are trusted to certify
+%a key only after proper steps have been taken to identify the
+%principal that owns it.
+%
+%\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%\begin{frame}[c]
+%\frametitle{Formal Methods}
+%
+%Ross Anderson about the use of Logic:\bigskip
+%
+%\begin{quote}
+%Formal methods can be an excellent way of finding
+%bugs in security protocol designs as they force the designer
+%to make everything explicit and thus confront difficult design
+%choices that might otherwise be fudged.
+%\end{quote}
+%
+%\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Mid-Term}
@@ -390,6 +589,384 @@
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[c]
+\frametitle{Security Engineering}
+
+ \begin{center}
+ \begin{tabular}{cc}
+ \raisebox{-0.8mm}{\includegraphics[scale=0.28]{../pics/flight.jpg}} &
+ \includegraphics[scale=0.31]{../pics/airbus.jpg}\\
+ \small Wright brothers, 1901 & \small Airbus, 2005 \\
+ \end{tabular}
+ \end{center}
+
+ \end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[c]
+\frametitle{1st Lecture}
+
+\begin{itemize}
+\item chip-and-pin, banks vs.~customers
+\begin{quote}\small\rm
+ the one who can improve security should also be
+ liable for the losses
+\end{quote}\pause\bigskip
+
+\item hashes and salts to guarantee data integrity\medskip
+\item storing passwords (you should know the difference between
+brute force attacks and dictionary attacks; how do salts help?)
+\end{itemize}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[c]
+\frametitle{1st Lecture: Cookies}
+
+\begin{itemize}
+\item good uses of cookies?\medskip
+
+\item bad uses of cookies: snooping, tracking, profiling\ldots
+ the ``disadvantage'' is that the user is in
+ \alert{control}, because you can delete them
+
+ \begin{center} ``Please track me using cookies.''
+ \end{center}\bigskip\pause
+
+\item fingerprinting beyond browser cookies
+ \begin{quote}\small\rm
+ Pixel Perfect: Fingerprinting Canvas in HTML5\\
+ (a research paper from 2012)\\
+ \footnotesize
+ \url{http://cseweb.ucsd.edu/~hovav/papers/ms12.html}
+ \end{quote}
+\end{itemize}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[c]
+\frametitle{1st Lecture: Cookies}
+
+\begin{itemize}
+\item a bit of JavaScript and HTML5 + canvas\medskip
+\begin{center}
+\begin{tabular}{cc}
+Firefox & Safari\\
+\includegraphics[scale=0.31]{../pics/firefox1.png} &
+\includegraphics[scale=0.31]{../pics/safari1.png} \\
+\tiny
+\pcode{55b2257ad0f20ecbf927fb66a15c61981f7ed8fc} &
+\tiny
+\pcode{17bc79f8111e345f572a4f87d6cd780b445625d3}
+\end{tabular}
+\end{center}\bigskip
+
+\item\small no actual drawing needed\pause
+\item\small in May 2014 a crawl of 100,000 popular
+webpages revealed 5.5\% already use canvas
+fingerprinting\smallskip
+\begin{center}\scriptsize
+\url{https://securehomes.esat.kuleuven.be/~gacar/persistent/the_web_never_forgets.pdf}
+\end{center}
+\end{itemize}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[c]
+\frametitle{1st Lecture: Cookies}
+
+Remember the small web-app I showed where a cookie
+protected a counter\bigskip
+
+\begin{itemize}
+\item NYT, the cookie looks the ``resource'' - harm\medskip
+\item imaginary discount unlocked by cookie - no harm
+\end{itemize}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[t]
+\frametitle{2nd Lecture: E-Voting}
+
+Where are paper ballots better than voice voting?\bigskip
+
+\begin{itemize}
+\item Integrity
+\item \alert{Ballot Secrecy}
+\item Voter Authentication
+\item Enfranchisement
+\item Availability
+\end{itemize}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[t]
+\frametitle{2nd Lecture: E-Voting}
+
+\begin{itemize}
+\item (two weeks ago) an Australian parliamentary committee
+found: e-voting is highly vulnerable to hacking and Australia
+will not use it any time soon\bigskip\pause
+\item Alex Halderman, Washington D.C.~hack
+\begin{center}
+\scriptsize
+\url{https://jhalderm.com/pub/papers/dcvoting-fc12.pdf}
+\end{center}\medskip
+
+\item PDF-ballot tampering at the wireless router (the modification
+is nearly undetectable and leaves no traces; MITM attack with firmware
+updating)
+\begin{center}
+\scriptsize
+\url{http://galois.com/wp-content/uploads/2014/11/technical-hack-a-pdf.pdf}
+\end{center}
+
+\end{itemize}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\tikzset{alt/.code args={<#1>#2#3#4}{%
+ \alt<#1>{\pgfkeysalso{#2}}{\pgfkeysalso{#3}} % \pgfkeysalso doesn't change the path
+}}
+
+\begin{frame}[t]
+\frametitle{\begin{tabular}{c}3rd Lecture:\\ Buffer Overflow Attacks\end{tabular}}
+
+\begin{itemize}
+\item the problem arises from the way C/C++ organises its function calls\\[-8mm]\mbox{}
+\end{itemize}
+
+\begin{center}
+\begin{tikzpicture}[scale=1]
+%\draw[black!10,step=2mm] (0,0) grid (9,4);
+%\draw[black!10,thick,step=10mm] (0,0) grid (9,4);
+
+\node at (0.5,4.5) {\small\begin{tabular}{l}main\\[-2mm] prog.\end{tabular}};
+\draw[line width=0mm, white, alt=<2->{fill=red}{fill=blue}] (0,2.5) rectangle (1,3.8);
+\draw[line width=0mm, white, alt=<9->{fill=red}{fill=blue}] (0,0.2) rectangle (1,0.5);
+\draw[line width=1mm, alt=<3->{fill=yellow}{fill=blue}] (0,2.0) rectangle (1,2.5);
+\draw[line width=1mm, alt=<6->{fill=red}{fill=blue}] (0,1.0) rectangle (1,2.0);
+\draw[line width=1mm, alt=<7->{fill=yellow}{fill=blue}] (0,0.5) rectangle (1,1.0);
+\draw[line width=1mm] (0,0) -- (0,4);
+\draw[line width=1mm] (1,0) -- (1,4);
+
+\node at (3.5,3.5) {\small\begin{tabular}{l}fact(n)\end{tabular}};
+\draw[line width=1mm, alt=<{4-5,8}>{fill=red}{fill=blue}] (3,1.0) rectangle (4,3.0);
+
+\onslide<3-4>{\draw[->, line width=1mm,red] (1,2.3) to node [above,sloped,midway] {n=4} (3,3);}
+\onslide<5>{\draw[<-, line width=1mm,red] (1,2.3) to node [above,sloped,midway] {res=24} (3,1);}
+
+\onslide<7-8>{\draw[->, line width=1mm,red] (1,0.8) to node [above,sloped,midway] {n=3} (3,3);}
+\onslide<9>{\draw[<-, line width=1mm,red] (1,0.8) to node [above,sloped,midway] {res=6} (3,1);}
+
+
+\node at (7.75,3.9) {\small\begin{tabular}{l}stack\end{tabular}};
+\draw[line width=1mm] (7,3.5) -- (7,0.5) -- (8.5,0.5) -- (8.5,3.5);
+
+\onslide<3,4,7,8>{
+\node at (7.75, 1.4) {ret};
+\draw[line width=1mm] (7,1.1) -- (8.5,1.1);
+\node at (7.75, 2.0) {sp};
+\draw[line width=1mm] (7,2.3) -- (8.5,2.3);
+}
+\onslide<3,4>{
+\node at (7.75, 0.8) {4};
+\draw[line width=1mm] (7,1.7) -- (8.5,1.7);
+}
+\onslide<7,8>{
+\node at (7.75, 0.8) {3};
+\draw[line width=1mm] (7,1.7) -- (8.5,1.7);
+}
+
+
+\end{tikzpicture}
+\end{center}
+
+\end{frame}
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[t]
+
+\begin{center}
+\begin{tikzpicture}[scale=1]
+%\draw[black!10,step=2mm] (0,0) grid (9,4);
+%\draw[black!10,thick,step=10mm] (0,0) grid (9,4);
+
+\node at (0.5,4.5) {\small\begin{tabular}{l}main\\[-2mm] prog.\end{tabular}};
+\draw[line width=0mm, white, alt=<2->{fill=red}{fill=blue}] (0,2.5) rectangle (1,3.8);
+\draw[line width=1mm, white, fill=blue] (0,1.0) rectangle (1,2.0);
+\draw[line width=1mm, alt=<3->{fill=yellow}{fill=blue}] (0,2.0) rectangle (1,2.5);
+\draw[line width=1mm] (0,0) -- (0,4);
+\draw[line width=1mm] (1,0) -- (1,4);
+
+\node at (3.5,3.5) {\small\begin{tabular}{l}fact(n)\end{tabular}};
+\draw[line width=0mm, alt=<{4-}>{red, fill=red}{blue, fill=blue}] (3,2.8) rectangle (4,3.0);
+\draw[line width=0mm, alt=<{5-}>{red, fill=red}{blue, fill=blue}] (3,2.8) rectangle (4,2.0);
+\draw[line width=0mm, alt=<{7-}>{red, fill=red}{blue, fill=blue}] (3,2.0) rectangle (4,1.0);
+\draw[line width=1mm] (3,1.0) rectangle (4,3.0);
+
+\onslide<3->{\draw[->, line width=1mm,red] (1,2.3) to node [above,sloped,midway] {n=4} (3,3);}
+\onslide<5->{\draw[<-, line width=2mm,red] (4,2) to node [above,sloped,midway]
+{\begin{tabular}{l}user\\[-1mm] input\end{tabular}} (6,2);}
+\onslide<8->{\draw[<-, line width=1mm,red] (1,-2) to (3,1);}
+
+\node at (7.75,3.9) {\small\begin{tabular}{l}stack\end{tabular}};
+\draw[line width=1mm] (7,3.5) -- (7,-0.1) -- (8.5,-0.1) -- (8.5,3.5);
+
+\onslide<3->{
+\node at (7.75, 0.2) {4};
+\draw[line width=1mm,alt=<6->{fill=red}{fill=white}] (7,0.5) rectangle (8.5,1.1);
+\node at (7.75, 0.8) {\alt<6->{@a\#}{ret}};
+\draw[line width=1mm,alt=<6->{fill=red}{fill=white}] (7,1.1) rectangle (8.5,1.7);
+\node at (7.75, 1.4) {\alt<6->{!?w;}sp};
+}
+
+\onslide<4->{
+\draw[line width=1mm,fill=red] (7,1.7) rectangle (8.5,3.0);
+\node[white] at (7.75, 2.4) {buffer};
+}
+
+\end{tikzpicture}
+\end{center}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[t]
+\frametitle{\begin{tabular}{c}3rd Lecture:\\[-3mm]
+Buffer Overflow Attacks\end{tabular}}
+
+US National Vulnerability Database\\
+\small(636 out of 6675 in 2014)
+
+\begin{center}
+\begin{tikzpicture}
+\begin{axis}[
+ xlabel={year},
+ ylabel={\% of total attacks},
+ ylabel style={yshift=0em},
+ enlargelimits=false,
+ xtick={1997,1998,2000,...,2014},
+ xmin=1996.5,
+ xmax=2015,
+ ymax=21,
+ ytick={0,5,...,20},
+ scaled ticks=false,
+ axis lines=left,
+ width=11cm,
+ height=5cm,
+ ybar,
+ nodes near coords=
+ {\footnotesize
+ $\pgfmathprintnumber[fixed,fixed zerofill,precision=1,use comma]{\pgfkeysvalueof{/data point/y}}$},
+ x tick label style={font=\scriptsize,/pgf/number format/1000 sep={}}]
+\addplot
+ table [x=Year,y=Percentage] {bufferoverflows.data};
+\end{axis}
+\end{tikzpicture}
+\end{center}
+
+\scriptsize
+\url{http://web.nvd.nist.gov/view/vuln/statistics}
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[t]
+\frametitle{\begin{tabular}{c}4th Lecture:\\ Unix Access Control\end{tabular}}
+
+\begin{itemize}
+\item privileges are specified by file access permissions (``everything is a file'')
+\end{itemize}\medskip
+
+\begin{center}
+ \begin{tikzpicture}[scale=1]
+
+ \draw[line width=1mm] (-.3, 0) rectangle (1.5,2);
+ \draw (4.7,1) node {Internet};
+ \draw (-2.7,1.7) node {\footnotesize Application};
+ \draw (0.6,1.7) node {\footnotesize Interface};
+ \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] process\end{tabular}};
+ \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}};
+
+ \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);
+
+ \draw[white] (1.7,1) node (X) {};
+ \draw[white] (3.7,1) node (Y) {};
+ \draw[red, <->, line width = 2mm] (X) -- (Y);
+
+ \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1);
+ \end{tikzpicture}
+\end{center}
+
+\begin{itemize}
+\item the idea is to make the attack surface smaller and
+mitigate the consequences of an attack
+\end{itemize}
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[fragile,t]
+\frametitle{\begin{tabular}{c}4th Lecture:\\ Unix Access Control\end{tabular}}
+
+\begin{itemize}
+\item when a file with setuid is executed, the resulting process will assume the
+UID given to the owner of the file
+\end{itemize}
+
+\footnotesize\tt
+\begin{center}
+\begin{verbatim}
+$ ls -ld . * */*
+drwxr-xr-x 1 ping staff 32768 Apr 2 2010 .
+-rw----r-- 1 ping students 31359 Jul 24 2011 manual.txt
+-r--rw--w- 1 bob students 4359 Jul 24 2011 report.txt
+-rwsr--r-x 1 bob students 141359 Jun 1 2013 microedit
+dr--r-xr-x 1 bob staff 32768 Jul 23 2011 src
+-rw-r--r-- 1 bob staff 81359 Feb 28 2012 src/code.c
+-r--rw---- 1 emma students 959 Jan 23 2012 src/code.h
+\end{verbatim}
+\end{center}
+
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\begin{frame}[t]
+\frametitle{\begin{tabular}{c}4th Lecture:\\ Unix Access Control\end{tabular}}
+
+\begin{itemize}
+\item Alice wants to have her files readable,
+\alert{except} for her office mates.
+\end{itemize}
+
+
+\end{frame}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+
\end{document}
%%% Local Variables: