diff options
Diffstat (limited to 'slides/2018-software-security')
80 files changed, 1713 insertions, 0 deletions
diff --git a/slides/2018-software-security/.gitignore b/slides/2018-software-security/.gitignore new file mode 100644 index 0000000..4a7f033 --- /dev/null +++ b/slides/2018-software-security/.gitignore @@ -0,0 +1,12 @@ +*.aux +*.fdb_latexmk +*.fls +*.fls +*.log +*.nav +*.out +main.pdf +*.snm +*.toc +*.nav +*.snm diff --git a/slides/2018-software-security/README b/slides/2018-software-security/README new file mode 100644 index 0000000..b236d9b --- /dev/null +++ b/slides/2018-software-security/README @@ -0,0 +1 @@ +~2x lectures on software security, used 2018-2019 at kau. diff --git a/slides/2018-software-security/beamercolorthemergd.sty b/slides/2018-software-security/beamercolorthemergd.sty new file mode 100644 index 0000000..74ced1c --- /dev/null +++ b/slides/2018-software-security/beamercolorthemergd.sty @@ -0,0 +1,24 @@ +\mode<presentation> + +%%% +% Color definitions +%%% +\RequirePackage{xcolor} +\definecolor{rgdGreen}{RGB}{33,114,106} +\definecolor{rgdYellow}{RGB}{255,210,4} +\definecolor{rgdOrange}{RGB}{232,114,12} +\colorlet{rgdGray}{gray!33} +\colorlet{rgdBlack}{black} + +%%% +% Beamer colors +%%% +\setbeamercolor*{titlepage}{fg=rgdBlack} +\setbeamercolor*{author}{fg=rgdGreen} +\setbeamercolor*{date}{fg=black} +\setbeamercolor*{header}{bg=rgdYellow,fg=black} +\setbeamercolor*{trailer}{bg=rgdGray,fg=black} +\setbeamercolor*{item}{fg=rgdGreen} +\setbeamercolor*{alerted text}{fg=rgdGreen} + +\mode<all> diff --git a/slides/2018-software-security/beamerfontthemergd.sty b/slides/2018-software-security/beamerfontthemergd.sty new file mode 100644 index 0000000..a6d212c --- /dev/null +++ b/slides/2018-software-security/beamerfontthemergd.sty @@ -0,0 +1,9 @@ +\mode<presentation> + +\setbeamerfont{title}{size=\large,shape=\bfseries} +\setbeamerfont{subtitle}{size=\normalsize,shape=\bfseries} +\setbeamerfont{frametitle}{size=\large,shape=\bfseries} +\setbeamerfont{institute}{size=\small} +\setbeamerfont{date}{size=\small} + +\mode<all> diff --git a/slides/2018-software-security/beamerinnerthemergd.sty b/slides/2018-software-security/beamerinnerthemergd.sty new file mode 100644 index 0000000..4dfd6cf --- /dev/null +++ b/slides/2018-software-security/beamerinnerthemergd.sty @@ -0,0 +1,49 @@ +\mode<presentation> + +%%% +% Title page +%%% +\defbeamertemplate*{title page}{rgd}[1][]{ + \begin{tikzpicture}[remember picture, overlay] + \usebeamercolor{titlepage} + % Add top-left triangle with university logo + \filldraw[draw=rgdGray,fill=rgdGray] + (current page.north west) -- + (current page.north) -- + node[draw=none,pos=0.5](Logo){\includegraphics[width=3cm]{img/logo}} + (current page.west) -- + (current page.north west); + % Add title + \node[ + text=fg, + text width=0.75\paperwidth, + ] (Title) at ([shift={(0,-0.5cm)}]current page){% + \centering\usebeamerfont{title}\inserttitle\\% + }; + % Add subtitle + \node[ + text=fg, + text width=0.75\paperwidth, + below=0pt of Title, + ] (Subtitle) {% + \centering\usebeamerfont{subtitle}\insertsubtitle\\% + }; + % Add authors + \usebeamercolor{author} + \node[ + text=fg, + text width=0.75\paperwidth, + below=12pt of Subtitle, + ] (Author) {% + \centering\usebeamerfont{author}\insertauthor\\% + }; + % Add date + \node[ + text=fg, + text width=0.75\paperwidth, + below right= 0.25cm and 4.5cm of current page.north, + ](Date) {\today}; + \end{tikzpicture} +} + +\mode<all> diff --git a/slides/2018-software-security/beamerouterthemergd.sty b/slides/2018-software-security/beamerouterthemergd.sty new file mode 100644 index 0000000..ba757c6 --- /dev/null +++ b/slides/2018-software-security/beamerouterthemergd.sty @@ -0,0 +1,66 @@ +\mode<presentation> + +%%% +% Frame header +%%% +\defbeamertemplate*{frametitle}{corporate}[1][]{% + \nointerlineskip + % Add frame title + \begin{beamercolorbox}[ + wd=\paperwidth, + ht=3ex, + dp=1.5ex, + left, + leftskip=2ex + ]{header} + \insertframetitle + \end{beamercolorbox} + % Add line after header + \nointerlineskip + \begin{beamercolorbox}[ + wd=\paperwidth, + ht=0.25ex + ]{trailer} + \end{beamercolorbox}% +} + +%%% +% Frame trailer +%%% +\defbeamertemplate*{footline}{corporate}{% + \hbox{% + % Add mail + \begin{beamercolorbox}[ + wd=0.22\paperwidth, + ht=2ex, + dp=0.5ex, + left, + leftskip=2ex + ]{trailer} + \texttt{rasmus.dahlberg@kau.se} + \end{beamercolorbox}% + % Add author + \begin{beamercolorbox}[ + wd=0.73\paperwidth, + ht=2ex, + dp=0.5ex, + left, + leftskip=2ex + ]{header} + %\insertauthor + \inserttitle + \end{beamercolorbox}% + % Add page counter + \begin{beamercolorbox}[ + wd=0.05\paperwidth, + ht=2ex, + dp=0.5ex, + right, + rightskip=1ex + ]{header} + \insertframenumber/\inserttotalframenumber + \end{beamercolorbox}% + } +} + +\mode<all> diff --git a/slides/2018-software-security/beamerthemergd.sty b/slides/2018-software-security/beamerthemergd.sty new file mode 100644 index 0000000..022ef2c --- /dev/null +++ b/slides/2018-software-security/beamerthemergd.sty @@ -0,0 +1,23 @@ +\mode<presentation> + +%%% +% Load beamer settings +%%% +\usecolortheme{rgd} +\usefonttheme{rgd} +\useinnertheme{rgd} +\useoutertheme{rgd} + +%%% +% Disable navigation tools on slides +%%% +\setbeamertemplate{navigation symbols}{} + +%%% +% Object styles +%%% +\setbeamertemplate{itemize item}[square] +\setbeamertemplate{itemize subitem}[default] +\setbeamertemplate{sections/subsections in toc}[square] + +\mode<all> diff --git a/slides/2018-software-security/demo/cmd_complex b/slides/2018-software-security/demo/cmd_complex new file mode 100644 index 0000000..b8bc8e4 --- /dev/null +++ b/slides/2018-software-security/demo/cmd_complex @@ -0,0 +1,17 @@ +# compile +gcc -Wall -Werror -std=c99 -ggdb -fno-stack-protector -m32 -o complex complex.c + +# want +ptr to "/bin/bash" <-- will becomes system's first args +dummy RA <-- will becomes sytem's RA +ptr to system <-- RA +... + +# find /bin/bash +x/500s $rsp + +# find system +p system + +# run with args +run `python -c 'print "some stuff"'` diff --git a/slides/2018-software-security/demo/cmd_simple b/slides/2018-software-security/demo/cmd_simple new file mode 100644 index 0000000..266535e --- /dev/null +++ b/slides/2018-software-security/demo/cmd_simple @@ -0,0 +1,28 @@ +# compile +gcc -std=c99 -fno-stack-protector -Wno-deprecated-declarations -ggdb -o simple simple.c + +# run +gdb ./simple + +# demo commands +list main +list greeter +list fun + +disassemble main +disassemble greeter +disassemble fun + +info register + +b main +b greeter +b fun + +run + +# show +- return address / register values +- 11a -> "8a" +- segfault +- jump fun diff --git a/slides/2018-software-security/demo/complex.c b/slides/2018-software-security/demo/complex.c new file mode 100644 index 0000000..ae91ac6 --- /dev/null +++ b/slides/2018-software-security/demo/complex.c @@ -0,0 +1,13 @@ +#include <stdio.h> +#include <string.h> + +void f(char *b) { + char buf[8]; + strcpy(buf, b); + printf("buf: %s\n", buf); +} + +int main(int argc, char *argv[]) { + f(argv[1]); + return 0; +} diff --git a/slides/2018-software-security/demo/simple.c b/slides/2018-software-security/demo/simple.c new file mode 100644 index 0000000..cd07c07 --- /dev/null +++ b/slides/2018-software-security/demo/simple.c @@ -0,0 +1,22 @@ +#include <stdio.h> +#include <stdbool.h> +#include <stdlib.h> + +void fun() { + printf("fun times!\n"); +} + +void mul(int first) { + int second = 0; + char buf[8] = {1,2,3,4,5,6,7,8}; + printf("Enter a number: "); + gets(buf); + second = atoi(buf); + printf("%d*%d = %d\n", first, second, first*second); +} + +int main() { + int first = 2; + mul(first); + return 0; +} diff --git a/slides/2018-software-security/handout.pdf b/slides/2018-software-security/handout.pdf Binary files differnew file mode 100644 index 0000000..00e1f42 --- /dev/null +++ b/slides/2018-software-security/handout.pdf diff --git a/slides/2018-software-security/img/afl.jpg b/slides/2018-software-security/img/afl.jpg Binary files differnew file mode 100644 index 0000000..42baef0 --- /dev/null +++ b/slides/2018-software-security/img/afl.jpg diff --git a/slides/2018-software-security/img/afl.png b/slides/2018-software-security/img/afl.png Binary files differnew file mode 100644 index 0000000..d259912 --- /dev/null +++ b/slides/2018-software-security/img/afl.png diff --git a/slides/2018-software-security/img/air-plane.pdf b/slides/2018-software-security/img/air-plane.pdf Binary files differnew file mode 100644 index 0000000..3b27910 --- /dev/null +++ b/slides/2018-software-security/img/air-plane.pdf diff --git a/slides/2018-software-security/img/attacker.pdf b/slides/2018-software-security/img/attacker.pdf Binary files differnew file mode 100644 index 0000000..bd8f863 --- /dev/null +++ b/slides/2018-software-security/img/attacker.pdf diff --git a/slides/2018-software-security/img/bad-encode.jpg b/slides/2018-software-security/img/bad-encode.jpg Binary files differnew file mode 100644 index 0000000..e9ea82e --- /dev/null +++ b/slides/2018-software-security/img/bad-encode.jpg diff --git a/slides/2018-software-security/img/bug.jpg b/slides/2018-software-security/img/bug.jpg Binary files differnew file mode 100644 index 0000000..3b86ec3 --- /dev/null +++ b/slides/2018-software-security/img/bug.jpg diff --git a/slides/2018-software-security/img/canary-after.png b/slides/2018-software-security/img/canary-after.png Binary files differnew file mode 100644 index 0000000..ad9965a --- /dev/null +++ b/slides/2018-software-security/img/canary-after.png diff --git a/slides/2018-software-security/img/canary-before.png b/slides/2018-software-security/img/canary-before.png Binary files differnew file mode 100644 index 0000000..0b7bebe --- /dev/null +++ b/slides/2018-software-security/img/canary-before.png diff --git a/slides/2018-software-security/img/canary-bird.jpg b/slides/2018-software-security/img/canary-bird.jpg Binary files differnew file mode 100644 index 0000000..c89b42c --- /dev/null +++ b/slides/2018-software-security/img/canary-bird.jpg diff --git a/slides/2018-software-security/img/checklist.pdf b/slides/2018-software-security/img/checklist.pdf Binary files differnew file mode 100644 index 0000000..ceeac09 --- /dev/null +++ b/slides/2018-software-security/img/checklist.pdf diff --git a/slides/2018-software-security/img/clang.png b/slides/2018-software-security/img/clang.png Binary files differnew file mode 100644 index 0000000..06dd0dd --- /dev/null +++ b/slides/2018-software-security/img/clang.png diff --git a/slides/2018-software-security/img/cwe.png b/slides/2018-software-security/img/cwe.png Binary files differnew file mode 100644 index 0000000..5d2fa27 --- /dev/null +++ b/slides/2018-software-security/img/cwe.png diff --git a/slides/2018-software-security/img/demo.png b/slides/2018-software-security/img/demo.png Binary files differnew file mode 100644 index 0000000..03a10fc --- /dev/null +++ b/slides/2018-software-security/img/demo.png diff --git a/slides/2018-software-security/img/google-rewards.png b/slides/2018-software-security/img/google-rewards.png Binary files differnew file mode 100644 index 0000000..34492fc --- /dev/null +++ b/slides/2018-software-security/img/google-rewards.png diff --git a/slides/2018-software-security/img/hb1.png b/slides/2018-software-security/img/hb1.png Binary files differnew file mode 100644 index 0000000..fe606c5 --- /dev/null +++ b/slides/2018-software-security/img/hb1.png diff --git a/slides/2018-software-security/img/hb2.png b/slides/2018-software-security/img/hb2.png Binary files differnew file mode 100644 index 0000000..b65179d --- /dev/null +++ b/slides/2018-software-security/img/hb2.png diff --git a/slides/2018-software-security/img/hb3.png b/slides/2018-software-security/img/hb3.png Binary files differnew file mode 100644 index 0000000..371b4c4 --- /dev/null +++ b/slides/2018-software-security/img/hb3.png diff --git a/slides/2018-software-security/img/hb4.png b/slides/2018-software-security/img/hb4.png Binary files differnew file mode 100644 index 0000000..8a52e7d --- /dev/null +++ b/slides/2018-software-security/img/hb4.png diff --git a/slides/2018-software-security/img/hb5.png b/slides/2018-software-security/img/hb5.png Binary files differnew file mode 100644 index 0000000..1df3291 --- /dev/null +++ b/slides/2018-software-security/img/hb5.png diff --git a/slides/2018-software-security/img/hb6.png b/slides/2018-software-security/img/hb6.png Binary files differnew file mode 100644 index 0000000..8cfb9b5 --- /dev/null +++ b/slides/2018-software-security/img/hb6.png diff --git a/slides/2018-software-security/img/heartbleed.png b/slides/2018-software-security/img/heartbleed.png Binary files differnew file mode 100644 index 0000000..27933db --- /dev/null +++ b/slides/2018-software-security/img/heartbleed.png diff --git a/slides/2018-software-security/img/icloud.tex b/slides/2018-software-security/img/icloud.tex new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/slides/2018-software-security/img/icloud.tex diff --git a/slides/2018-software-security/img/libc.jpg b/slides/2018-software-security/img/libc.jpg Binary files differnew file mode 100644 index 0000000..8dd2012 --- /dev/null +++ b/slides/2018-software-security/img/libc.jpg diff --git a/slides/2018-software-security/img/logo.png b/slides/2018-software-security/img/logo.png Binary files differnew file mode 100755 index 0000000..0c7c885 --- /dev/null +++ b/slides/2018-software-security/img/logo.png diff --git a/slides/2018-software-security/img/memlay.png b/slides/2018-software-security/img/memlay.png Binary files differnew file mode 100644 index 0000000..9c7aa52 --- /dev/null +++ b/slides/2018-software-security/img/memlay.png diff --git a/slides/2018-software-security/img/memory-safe/go.png b/slides/2018-software-security/img/memory-safe/go.png Binary files differnew file mode 100644 index 0000000..74266bb --- /dev/null +++ b/slides/2018-software-security/img/memory-safe/go.png diff --git a/slides/2018-software-security/img/memory-safe/java.png b/slides/2018-software-security/img/memory-safe/java.png Binary files differnew file mode 100644 index 0000000..b1fb238 --- /dev/null +++ b/slides/2018-software-security/img/memory-safe/java.png diff --git a/slides/2018-software-security/img/memory-safe/python.jpg b/slides/2018-software-security/img/memory-safe/python.jpg Binary files differnew file mode 100644 index 0000000..a1779d6 --- /dev/null +++ b/slides/2018-software-security/img/memory-safe/python.jpg diff --git a/slides/2018-software-security/img/memory-safe/rust.png b/slides/2018-software-security/img/memory-safe/rust.png Binary files differnew file mode 100644 index 0000000..0016983 --- /dev/null +++ b/slides/2018-software-security/img/memory-safe/rust.png diff --git a/slides/2018-software-security/img/mit1.png b/slides/2018-software-security/img/mit1.png Binary files differnew file mode 100644 index 0000000..bba6d7e --- /dev/null +++ b/slides/2018-software-security/img/mit1.png diff --git a/slides/2018-software-security/img/mit2.png b/slides/2018-software-security/img/mit2.png Binary files differnew file mode 100644 index 0000000..4d6a9ff --- /dev/null +++ b/slides/2018-software-security/img/mit2.png diff --git a/slides/2018-software-security/img/mit3.png b/slides/2018-software-security/img/mit3.png Binary files differnew file mode 100644 index 0000000..110c58e --- /dev/null +++ b/slides/2018-software-security/img/mit3.png diff --git a/slides/2018-software-security/img/qleft.pdf b/slides/2018-software-security/img/qleft.pdf Binary files differnew file mode 100644 index 0000000..f35a078 --- /dev/null +++ b/slides/2018-software-security/img/qleft.pdf diff --git a/slides/2018-software-security/img/qright.pdf b/slides/2018-software-security/img/qright.pdf Binary files differnew file mode 100644 index 0000000..da2e8e3 --- /dev/null +++ b/slides/2018-software-security/img/qright.pdf diff --git a/slides/2018-software-security/img/question.png b/slides/2018-software-security/img/question.png Binary files differnew file mode 100644 index 0000000..4e174a6 --- /dev/null +++ b/slides/2018-software-security/img/question.png diff --git a/slides/2018-software-security/img/real-bug.png b/slides/2018-software-security/img/real-bug.png Binary files differnew file mode 100644 index 0000000..05bb42d --- /dev/null +++ b/slides/2018-software-security/img/real-bug.png diff --git a/slides/2018-software-security/img/stack-smashing.png b/slides/2018-software-security/img/stack-smashing.png Binary files differnew file mode 100644 index 0000000..7d06eb2 --- /dev/null +++ b/slides/2018-software-security/img/stack-smashing.png diff --git a/slides/2018-software-security/img/summary.jpg b/slides/2018-software-security/img/summary.jpg Binary files differnew file mode 100644 index 0000000..3850ec7 --- /dev/null +++ b/slides/2018-software-security/img/summary.jpg diff --git a/slides/2018-software-security/img/take-away.pdf b/slides/2018-software-security/img/take-away.pdf new file mode 100644 index 0000000..7d3b190 --- /dev/null +++ b/slides/2018-software-security/img/take-away.pdf @@ -0,0 +1,68 @@ +%PDF-1.4 +%ตํฎ๛ +3 0 obj +<< /Length 4 0 R + /Filter /FlateDecode +>> +stream +xmAร0๏ผ
>กฆไๆR#$Eณ{rฮใืGyปเC \ลฦ`ืย;ดใปจ(d็Utะ่0fต-ษาTุ
ฌีA7๏่
Txย1fฏี;"ฃ* ค4{ศ~้M7ไ$ +endstream +endobj +4 0 obj + 118 +endobj +2 0 obj +<< + /ExtGState << + /a0 << /CA 1 /ca 1 >> + >> +>> +endobj +5 0 obj +<< /Type /Page + /Parent 1 0 R + /MediaBox [ 0 0 12.8 12.8 ] + /Contents 3 0 R + /Group << + /Type /Group + /S /Transparency + /I true + /CS /DeviceRGB + >> + /Resources 2 0 R +>> +endobj +1 0 obj +<< /Type /Pages + /Kids [ 5 0 R ] + /Count 1 +>> +endobj +6 0 obj +<< /Creator (cairo 1.14.0 (http://cairographics.org)) + /Producer (cairo 1.14.0 (http://cairographics.org)) +>> +endobj +7 0 obj +<< /Type /Catalog + /Pages 1 0 R +>> +endobj +xref +0 8 +0000000000 65535 f +0000000520 00000 n +0000000232 00000 n +0000000015 00000 n +0000000210 00000 n +0000000304 00000 n +0000000585 00000 n +0000000712 00000 n +trailer +<< /Size 8 + /Root 7 0 R + /Info 6 0 R +>> +startxref +764 +%%EOF diff --git a/slides/2018-software-security/img/ty.pdf b/slides/2018-software-security/img/ty.pdf Binary files differnew file mode 100644 index 0000000..9ad4dc8 --- /dev/null +++ b/slides/2018-software-security/img/ty.pdf diff --git a/slides/2018-software-security/img/weird-machine.png b/slides/2018-software-security/img/weird-machine.png Binary files differnew file mode 100644 index 0000000..cd0bddf --- /dev/null +++ b/slides/2018-software-security/img/weird-machine.png diff --git a/slides/2018-software-security/img/zerodium.png b/slides/2018-software-security/img/zerodium.png Binary files differnew file mode 100644 index 0000000..3caa73a --- /dev/null +++ b/slides/2018-software-security/img/zerodium.png diff --git a/slides/2018-software-security/main.tex b/slides/2018-software-security/main.tex new file mode 100644 index 0000000..f442493 --- /dev/null +++ b/slides/2018-software-security/main.tex @@ -0,0 +1,27 @@ +\pdfminorversion=4 +%\documentclass[handout,aspectratio=169]{beamer} +\documentclass[aspectratio=169]{beamer} +\usetheme{rgd} + +\input{src/preamble} + +\title{% + Software Security I\&II +} +%\subtitle{% +%} +\author{% + Rasmus Dahlberg +} +\institute{% + Karlstad University +} +\date{% + \today +} + +\begin{document} + \input{src/titlepage} + \input{src/body} + \input{src/questions} +\end{document} diff --git a/slides/2018-software-security/sample/._bo-stack.c.swp b/slides/2018-software-security/sample/._bo-stack.c.swp Binary files differnew file mode 100644 index 0000000..376288d --- /dev/null +++ b/slides/2018-software-security/sample/._bo-stack.c.swp diff --git a/slides/2018-software-security/sample/_bo-heap.c b/slides/2018-software-security/sample/_bo-heap.c new file mode 100644 index 0000000..a89959c --- /dev/null +++ b/slides/2018-software-security/sample/_bo-heap.c @@ -0,0 +1,19 @@ +void verify_heap() +{ + char *buf = malloc(8*sizeof(char)); + char *verified = malloc(sizeof(int)); + *verified = 0; + gets(buf); + /* <verification goes here> */ + if (*verified) { + printf("accept\n"); + } else { + printf("reject\n"); + } +} + +int main(int argc, char *argv[]) +{ + verify_heap(); + return 0; +} diff --git a/slides/2018-software-security/sample/_bo-stack.c b/slides/2018-software-security/sample/_bo-stack.c new file mode 100644 index 0000000..167496e --- /dev/null +++ b/slides/2018-software-security/sample/_bo-stack.c @@ -0,0 +1,21 @@ +#include <stdio.h> + +void verify_stack() +{ + int verified = 0; + char buf[8] = {4,4,4,4,8,8,8,8}; + gets(buf); + /* <verification goes here> */ + if (verified) { + printf("accept\n"); + } else { + printf("reject\n"); + } +} + +int main(int argc, char *argv[]) +{ + printf("Lucky number: %d\n", 1337); + verify_stack(); + return 0; +} diff --git a/slides/2018-software-security/sample/_stack-frame.c b/slides/2018-software-security/sample/_stack-frame.c new file mode 100644 index 0000000..32f4fe2 --- /dev/null +++ b/slides/2018-software-security/sample/_stack-frame.c @@ -0,0 +1,26 @@ +#include <stdio.h> + +int add(int a, int b) +{ + int result; + result = a+b; + return result; +} + +int sub(int a, int b) +{ + int result; + result = add(a,-b); + return result; +} + +int algorithm() +{ + printf("result: %d\n", sub(2,1)); +} + +int main(int argc, char *argv[]) +{ + algorithm(); + return 0; +} diff --git a/slides/2018-software-security/sample/assignment-buffer-overflow.c b/slides/2018-software-security/sample/assignment-buffer-overflow.c new file mode 100644 index 0000000..2fb0d58 --- /dev/null +++ b/slides/2018-software-security/sample/assignment-buffer-overflow.c @@ -0,0 +1,15 @@ +#include <stdio.h> +#include <limits.h> +#define SECRET UINT_MAX + +void gotcha() { printf("Gotcha!\n"); } + +int main() { + unsigned secret = 0; + char buf[8]; + scanf("%s", buf); + if (secret == SECRET) { + gotcha(); + } + return 0; +} diff --git a/slides/2018-software-security/sample/assignment-integer-overflow.c b/slides/2018-software-security/sample/assignment-integer-overflow.c new file mode 100644 index 0000000..58c59b1 --- /dev/null +++ b/slides/2018-software-security/sample/assignment-integer-overflow.c @@ -0,0 +1,15 @@ +#include <stdio.h> + +int get_int() { + int v; printf("Enter an integer: "); + scanf("%d", &v); + return v; +} + +int main() { + int a=get_int(), b=get_int(), max=10; + if (a+b > max) + printf("%d+%d > %d\n", a, b, max); + else + printf("%d+%d <= %d\n", a, b, max); +} diff --git a/slides/2018-software-security/sample/bad-add.c b/slides/2018-software-security/sample/bad-add.c new file mode 100644 index 0000000..42424de --- /dev/null +++ b/slides/2018-software-security/sample/bad-add.c @@ -0,0 +1,10 @@ +void cat(char *dst, size_t n, + char *src1, size_t n1, + char *src2, size_t n2) +{ + if (n1+n2 <= n) { + strncpy(dst, src1, n); + strncat(dst, src2, n-n1); + } +} +... diff --git a/slides/2018-software-security/sample/bad-call.c b/slides/2018-software-security/sample/bad-call.c new file mode 100644 index 0000000..9d6d57b --- /dev/null +++ b/slides/2018-software-security/sample/bad-call.c @@ -0,0 +1,10 @@ +void init(char v, char *buf, int n) +{ + char *b = buf; + while (b < buf+n) { + *b++ = val; + } +} +... +char *buf = malloc(2); +init('A', buf, sizeof(buf)); diff --git a/slides/2018-software-security/sample/bad-index.c b/slides/2018-software-security/sample/bad-index.c new file mode 100644 index 0000000..37d94b3 --- /dev/null +++ b/slides/2018-software-security/sample/bad-index.c @@ -0,0 +1,4 @@ +char b[4] = "abc"; +b[3] = 'd'; +printf("b: %s\n", b); +... diff --git a/slides/2018-software-security/sample/bad-index2.c b/slides/2018-software-security/sample/bad-index2.c new file mode 100644 index 0000000..b9f5be6 --- /dev/null +++ b/slides/2018-software-security/sample/bad-index2.c @@ -0,0 +1,4 @@ +char b[4] = "abc"; +b[4] = 'd'; +printf("b: %s\n", s); +... diff --git a/slides/2018-software-security/sample/bad-printf.c b/slides/2018-software-security/sample/bad-printf.c new file mode 100644 index 0000000..7026600 --- /dev/null +++ b/slides/2018-software-security/sample/bad-printf.c @@ -0,0 +1,4 @@ +char b[4]; +fgets(b, 4, stdin); +printf(b); +... diff --git a/slides/2018-software-security/sample/bo-heap.c b/slides/2018-software-security/sample/bo-heap.c new file mode 100644 index 0000000..60fd29e --- /dev/null +++ b/slides/2018-software-security/sample/bo-heap.c @@ -0,0 +1,13 @@ +void verify_heap() +{ + char *buf = malloc(8*sizeof(char)); + int *verified = malloc(sizeof(int)); + *verified = 0; + gets(buf); + /* <verification goes here> */ + if (*verified) { + printf("accept\n"); + } else { + printf("reject\n"); + } +} diff --git a/slides/2018-software-security/sample/bo-stack.c b/slides/2018-software-security/sample/bo-stack.c new file mode 100644 index 0000000..f8bcb55 --- /dev/null +++ b/slides/2018-software-security/sample/bo-stack.c @@ -0,0 +1,12 @@ +void verify_stack() +{ + int verified = 0; + char buf[8]; + gets(buf); + /* <verification goes here> */ + if (verified) { + printf("accept\n"); + } else { + printf("reject\n"); + } +} diff --git a/slides/2018-software-security/sample/build b/slides/2018-software-security/sample/build new file mode 100755 index 0000000..123db54 --- /dev/null +++ b/slides/2018-software-security/sample/build @@ -0,0 +1,10 @@ +#!/bin/bash + +echo "[Compile] bo-stack" +gcc -g -O0 -fno-stack-protector -o bo-stack _bo-stack.c &> /dev/null + +echo "[Compile] bo-heap" +gcc -g -O0 -fno-stack-protector -o bo-heap _bo-heap.c &> /dev/null + +echo "[Compile] stack-frame" +gcc -g -O0 -fno-stack-protector -o stack-frame _stack-frame.c diff --git a/slides/2018-software-security/sample/ldd b/slides/2018-software-security/sample/ldd new file mode 100644 index 0000000..dc2cc99 --- /dev/null +++ b/slides/2018-software-security/sample/ldd @@ -0,0 +1,7 @@ +$ cat main.c +int main() { return 0; } +$ gcc main.c +$ ldd ./a.out + linux-vdso.so.1 (0x00007fff3a9e4000) + libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fa5bfeda000) + /lib64/ld-linux-x86-64.so.2 (0x00007fa5c04cd000) diff --git a/slides/2018-software-security/sample/ldd2 b/slides/2018-software-security/sample/ldd2 new file mode 100644 index 0000000..ff87494 --- /dev/null +++ b/slides/2018-software-security/sample/ldd2 @@ -0,0 +1,8 @@ +$ ldd ./a.out + linux-vdso.so.1 (0x00007ffdda7ce000) + libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f7f307ba000) + /lib64/ld-linux-x86-64.so.2 (0x00007f7f30dad000) +$ ldd ./a.out + linux-vdso.so.1 (0x00007ffe387d4000) + libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fdd793ef000) + /lib64/ld-linux-x86-64.so.2 (0x00007fdd799e2000) diff --git a/slides/2018-software-security/sample/main.c b/slides/2018-software-security/sample/main.c new file mode 100644 index 0000000..f8b643a --- /dev/null +++ b/slides/2018-software-security/sample/main.c @@ -0,0 +1,4 @@ +int main() +{ + return 0; +} diff --git a/slides/2018-software-security/sample/splint b/slides/2018-software-security/sample/splint new file mode 100644 index 0000000..af8501e --- /dev/null +++ b/slides/2018-software-security/sample/splint @@ -0,0 +1,17 @@ +static-analysis.c: (in function main) +static-analysis.c:7:9: Possibly null storage buf passed as non-null param: + fgets (buf, ...) + A possibly null pointer is passed as a parameter corresponding to a formal + parameter with no /*@null@*/ annotation. If NULL may be used for this + parameter, add a /*@null@*/ annotation to the function parameter declaration. + (Use -nullpass to inhibit warning) + static-analysis.c:6:15: Storage buf may become null +static-analysis.c:7:3: Return value (type char *) ignored: fgets(buf, 8, stdin) + Result returned by function call is not used. If this is intended, can cast + result to (void) to eliminate message. (Use -retvalother to inhibit warning) +static-analysis.c:9:12: Fresh storage buf not released before return + A memory leak has been detected. Storage allocated locally is not released + before the last reference to it is lost. (Use -mustfreefresh to inhibit + warning) + static-analysis.c:6:25: Fresh storage buf created + diff --git a/slides/2018-software-security/sample/stack-frame.c b/slides/2018-software-security/sample/stack-frame.c new file mode 100644 index 0000000..b5c962f --- /dev/null +++ b/slides/2018-software-security/sample/stack-frame.c @@ -0,0 +1,18 @@ +int add(int a, int b) +{ + int result; + result = a+b; + return result; +} + +int sub(int a, int b) +{ + int result; + result = add(a,-b); + return result; +} + +int algorithm() +{ + printf("result: %d\n", sub(2,1)); +} diff --git a/slides/2018-software-security/sample/static-analysis.c b/slides/2018-software-security/sample/static-analysis.c new file mode 100644 index 0000000..3d89478 --- /dev/null +++ b/slides/2018-software-security/sample/static-analysis.c @@ -0,0 +1,10 @@ +#include <stdio.h> +#include <stdlib.h> + +int main() +{ + char *buf = malloc(8); + fgets(buf, 8, stdin); + printf("%s\n", buf); + return 0; +} diff --git a/slides/2018-software-security/slides.pdf b/slides/2018-software-security/slides.pdf Binary files differnew file mode 100644 index 0000000..b073cf6 --- /dev/null +++ b/slides/2018-software-security/slides.pdf diff --git a/slides/2018-software-security/src/body.tex b/slides/2018-software-security/src/body.tex new file mode 100644 index 0000000..0eb89e1 --- /dev/null +++ b/slides/2018-software-security/src/body.tex @@ -0,0 +1,1009 @@ +\begin{frame} +\frametitle{Learning outcomes} + \vfill\centering + \smartdiagramset{ + sequence item height=1.75cm, + sequence item width=2.5cm, + sequence item text width = 2.4cm, + } + \smartdiagram[sequence diagram]{% + What is software security,% + Software security gone wrong,% + Buffer overflows and + defenses% + } + \pause + \vfill\centering\textbf{Already covered here or elsewhere:} least privilege, + modern crypto, use secure APIs, pass strings to complex subsystems with + care, do unit testing, security audits, ... +\end{frame} + +\begin{frame} + \frametitle{Be aware of other common coding mistakes not covered here} + \centering\includegraphics[width=\textwidth]{img/cwe} + \burl{https://cwe.mitre.org/data/definitions/699.html} +\end{frame} + +\begin{frame} + \frametitle{Software vulnerabilities pay\titlefloatright{Zerodium's program}} + \centering\includegraphics[height=0.8\textheight]{img/zerodium}\\ + \burl{https://zerodium.com/program.html} +\end{frame} + +\begin{frame} + \frametitle{Software vulnerabilities pay\titlefloatright{Google's + program}} + \centering\includegraphics[height=0.8\textheight]{img/google-rewards}\\ + \burl{https://www.google.com/about/appsecurity/reward-program/index.html} +\end{frame} + + +\begin{frame} + \frametitle{% + What is software security about?% + \titlefloatright{% + Weird machines\footnote{\burl{https://en.wikipedia.org/wiki/Weird_machine}}% + }% + } + \centering + \includegraphics[height=0.4\textheight]{img/weird-machine} + \\\vfill + Security properties and threat model $\rightarrow$ + program should work as intended +\end{frame} + +\begin{frame} + \frametitle{Can you spell software vulnerability? \titlefloatright{BUG}} + \centering\includegraphics[height=0.5\textheight]{img/real-bug} + % REMEMBER@bug: bad composition, implementation error, logical error +\end{frame} + +\begin{frame} + %REMEMBER@bad comp: Mat Honan + \frametitle{Bad composition \titlefloatright{Gmail password + reset\footnote{% + \burl{https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/} + \titlefloatright{Credit: Nickolai Zeldovich and James Mickens} + }}} + \centering + \begin{tikzpicture} + \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm, + minimum height=2cm](gmail) at (0,0) {% + \begin{tabular}{c} + \textbf{Gmail reset}\\ + \begin{tabular}{l} + \textbf{-} use backup mail\\ + \textbf{-} \texttt{m****n@me.com}\\ + \\ + \end{tabular} + \end{tabular} + }; + \pause + + \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm, + minimum height=2cm, below=1cm of gmail](appleid) {% + \begin{tabular}{c} + \textbf{AppleID reset}\\ + \begin{tabular}{l} + \textbf{-} mail address\\ + \textbf{-} billing address\\ + \textbf{-} last four in CC\\ + \end{tabular} + \end{tabular} + }; + \pause + + \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm, + minimum height=2cm, right=3cm of gmail](amazon) {% + \begin{tabular}{c} + \textbf{Amazon reset}\\ + \begin{tabular}{l} + \textbf{-} name \\ + \textbf{-} billing address\\ + \textbf{-} CC number\\ + \end{tabular} + \end{tabular} + }; + \pause + + \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm, + minimum height=2cm, below=1cm of amazon](amazonadd) {% + \begin{tabular}{c} + \textbf{Amazon add CC}\\ + \begin{tabular}{l} + \textbf{-} name \\ + \textbf{-} mail address\\ + \textbf{-} billing address\\ + \end{tabular} + \end{tabular} + }; + + \pause + \path[draw,thick,-latex] + (amazonadd) -- + node[draw=none,right]{precaution\footnotemark} + (amazon); + \pause + \path[draw,thick,-latex] (amazon) -- (appleid); + \pause + \path[draw,thick,-latex] (appleid) -- (gmail); + \end{tikzpicture} + \footnotetext{\tiny{Obfuscate CC, s.t., only last last 4 CC digits are shown}} +\end{frame} + +\begin{frame} + \frametitle{Implementation error\titlefloatright{% + iCloud hack\footnote{% + \burl{https://github.com/hackappcom/ibrute} + \titlefloatright{Credit: Nickolai Zeldovich and James Mickens} + }}} + \centering + \begin{tikzpicture} + \node[draw=gray, thick, rounded rectangle, minimum width=4cm, minimum + height=2cm, fill=gray!25] (icloud) at (0,0) {iCloud}; + \node[draw=none, left=2cm of icloud](ifile) {Files}; + \node[draw=none, above=1cm of icloud](ifeature) {Other features}; + \coordinate(imid) at ($ (ifile.north) !.5! (ifeature) $); + \node[draw=none] (isharing) at ($ (imid) + (-.75,.5) $) {Sharing}; + \node[draw=none, right=2cm of icloud](ifind) {% + \begin{tabular}{c} + Find my\\ + iPhone + \end{tabular} + }; + \path[draw, -latex] (ifile) -- (icloud); + \path[draw, -latex] (isharing) -- (icloud); + \path[draw, -latex] (ifeature) -- (icloud); + \path[draw, -latex] (ifind) -- (icloud); + \end{tikzpicture} + \pause + \vfill + \begin{columns} + \begin{column}{0.49\textwidth} + \vbox to .2\textheight{ + \vfill + \begin{itemize} + \item User must login to use a feature + \pause + \item \textbf{Rate limited login attempts?} + \end{itemize} + \vfill + } + \end{column} + \begin{column}{0.49\textwidth} + \vbox to .2\textheight{ + \vfill + Files, sharing, other features? + \titlefloatright{\textcolor{darkGreen}{Yep}}\\ + \pause + Find my iPhone...? + \titlefloatright{\textcolor{darkRed}{Nop}} + \vfill + } + \end{column} + \end{columns} + \pause + \vfill + \alert{Lesson learned: the importance of testing against abnormal behaviour} +\end{frame} + +\begin{frame} + \frametitle{Implementation error\titlefloatright{Subject + names and TLS\footnote{% + \burl{https://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatSSL-PAPER1.pdf} + }}} + \begin{columns} + \begin{column}{0.59\textwidth} + \begin{itemize} + \item TLS certificate: identity-to-key binding + \pause + \item Subject name? Pascal string + \begin{itemize} + \item Length followed by characters + \end{itemize} + \pause + \item Many TLS implementations? C string + \begin{itemize} + \item Characters with null-termination + \end{itemize} + \end{itemize} + \end{column} + \pause + \begin{column}{0.39\textwidth} + \includegraphics[width=\textwidth]{img/bad-encode} + \end{column} + \end{columns} + \pause + \vfill\centering\alert{Lesson learned: only process data at uniform formats} +\end{frame} + +\begin{frame} + \frametitle{The bad news :/} + \begin{columns} + \begin{column}{0.59\textwidth} + \begin{itemize} + \item Much software is written in \texttt{C}/\texttt{C++} + \item Recipe for disaster: + \begin{itemize} + \item Exposure to raw memory addresses + \item No built-in bound checking and safety + \item Operate on untrusted user input + \end{itemize} + \item Why? + \end{itemize} + \end{column} + \begin{column}{0.39\textwidth} + \centering\includegraphics[height=0.6\textheight]{img/clang}\\ + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{It is easy to get wrong \titlefloatright{1/2}} + \vfill + \begin{columns} + \begin{column}{0.33\textwidth} + \vbox to .4\textheight{ + \centering + \lstinputlisting[style=CStyle]{sample/bad-index.c} + \vfill + Problem? \\ + \pause + \textbf{over-read} \\ + \pause + } + \end{column} + \begin{column}{0.33\textwidth} + \vbox to .4\textheight{ + \centering + \lstinputlisting[style=CStyle]{sample/bad-index2.c} + \vfill + Problem? \\ + \pause + \textbf{over-write} \\ + \pause + } + \end{column} + \begin{column}{0.33\textwidth} + \vbox to .4\textheight{ + \centering + \lstinputlisting[style=CStyle]{sample/bad-printf.c} + \vfill + Problem? \\ + \pause + \textbf{over-read} \\ + } + \end{column} + \end{columns} + \vfill +\end{frame} + +\begin{frame} + \frametitle{It is easy to get wrong \titlefloatright{2/2}} + \vfill + \begin{columns} + \begin{column}{0.49\textwidth} + \vbox to .6\textheight{ + \centering + \lstinputlisting[style=CStyle]{sample/bad-call.c} + \vfill + Problem? \\ + \pause + \textbf{over-write} + \pause + } + \end{column} + \begin{column}{0.49\textwidth} + \vbox to .6\textheight{ + \centering + \lstinputlisting[style=CStyle]{sample/bad-add.c} + \vfill + Problem? \\ + \pause + \textbf{over-write} + } + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{A famous over-read in OpenSSL\titlefloatright{% + Heartbleed bug% + \includegraphics[height=16pt]{img/heartbleed}% + }} + \begin{columns} + \begin{column}{0.49\textwidth} + \includegraphics[width=\textwidth]{img/hb1} + \includegraphics[width=\textwidth]{img/hb2} + \includegraphics[width=\textwidth]{img/hb3} + \end{column} + \begin{column}{0.49\textwidth} + \includegraphics[width=\textwidth]{img/hb4} + \includegraphics[width=\textwidth]{img/hb5} + \includegraphics[width=\textwidth]{img/hb6} + \end{column} + \end{columns} + \vfill\centering\burl{https://xkcd.com/1354/} + %REMEMBER@after heartbleed: transition -> easy bug, not the typical case. Usually, attckers exploit buffer overflows (i.e., write outside of buffer boundaries) to change the program flow, e.g., by changing the value of adjacent variables. In extreme cases, entirely new functionality can be inserted - hello world program with buf overflow -> delete files... This is what we will work towards now. +\end{frame} + +\begin{frame} + %REMEMBER: explain stack briefly, and paint everything on board - local vars + \frametitle{Buffer overflow \titlefloatright{Stack}} + \begin{columns} + \begin{column}{0.59\textwidth} + \lstinputlisting[style=CStyle]{sample/bo-stack.c} + \end{column} + \pause + \begin{column}{0.39\textwidth} + \begin{itemize} + \item Input 1: Neal \ding{224} \textcolor{darkRed}{reject} + \pause + \item Input 2: Caffrey \ding{224} \textcolor{darkRed}{reject} + \pause + \item Input 3: Overflow! \ding{224} \textcolor{darkGreen}{accept} + \pause + \end{itemize} + \end{column} + \end{columns} + \vfill\centering\alert{Buffer overflow occurs when writing outside of a buffer's boundaries} +\end{frame} + +\begin{frame} + %REMEMBER: explain heapy briefly, and paint everything on board - need var lifetime that is longer than function lifetime + \frametitle{Buffer overflow \titlefloatright{Heap}} + \begin{columns} + \begin{column}{0.59\textwidth} + \lstinputlisting[style=CStyle]{sample/bo-heap.c} + \end{column} + \pause + \begin{column}{0.39\textwidth} + \begin{itemize} + \item Input 1: Neal \ding{224} \textcolor{darkRed}{reject} + \pause + \item Input 2: Caffrey \ding{224} \textcolor{darkRed}{reject} + \pause + \item Input 3: aaa...aaa \ding{224} \textcolor{darkGreen}{accept} + \end{itemize} + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + % Just to make sure that everyone is on the same page now, and work towards stack frames + \frametitle{Memory layout} + \begin{columns} + \begin{column}{0.59\textwidth} + \begin{itemize} + \item Heap grows towards higher addresses + \begin{itemize} + \item Manual memory (de)allocation + \end{itemize} + \item Stack grows towards lower addresses + \begin{itemize} + \item Automatic memory (de)allocation + \item Each function has a `stack frame' + \end{itemize} + \item Data: e.g., global and static variables + \item Code: instructions that CPU can process + \end{itemize} + \end{column} + \begin{column}{0.39\textwidth} + \centering\includegraphics[height=0.6\textheight]{img/memlay} + \end{column} + \end{columns} + %\pause + %\vfill\centering\alert{Note: each process has its own virtual memory that + % is translated to physical memory} +\end{frame} + +\begin{frame} + \frametitle{Stack frames} + \begin{columns} + \begin{column}{0.49\textwidth} + \lstinputlisting[style=CStyle]{sample/stack-frame.c} + \end{column} + \begin{column}{0.49\textwidth} + Each function gets its own stack frame + \begin{itemize} + \item Local variables + \item Function parameters + \item Housekeeping such as: + \begin{itemize} + \item Return address + \item Register values + \end{itemize} + \end{itemize} + \vspace{12pt} + \alert{Push ordering} \ding{224} + \alert{see calling conventions} + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Pushing an popping stack frames} + \begin{columns} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \end{drawstack} + \end{column} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \cell{sub} + \end{drawstack} + \end{column} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \cell{sub} + \cell{add} + \end{drawstack} + \end{column} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \cell{sub} + \end{drawstack} + \end{column} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \end{drawstack} + \end{column} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \cell{printf} + \end{drawstack} + \end{column} + \end{columns} + \vfill\centering\alert{Return to caller's context using housekeeping + information} +\end{frame} + +\begin{frame} + \frametitle{Buffer overflow on the stack continued \titlefloatright{(1/2)}} + \begin{columns} + \begin{column}{0.59\textwidth} + \lstinputlisting[style=CStyle]{sample/bo-stack.c} + \end{column} + \begin{column}{0.39\textwidth} + \begin{itemize} + \item Input 4: aaa...aaa \ding{224} \textcolor{darkRed}{segfault} + \item Why not segfault on heap? + \item Why segfault on stack? + \end{itemize} + \end{column} + \end{columns} +\end{frame} + + +\begin{frame} + \frametitle{Buffer overflow on the stack continued \titlefloatright{(2/2)}} + \begin{columns} + \begin{column}{0.49\textwidth} + %\lstinputlisting[style=CStyle,firstline=3,lastline=4,numbers=none]{% + % sample/bo-stack.c + %} + \lstinputlisting[style=CStyle]{sample/bo-stack.c} + \end{column} + \begin{column}{0.49\textwidth} + \centering + \begin{drawstack}[scale=0.5] + \cell{RA} \cellcomL{\scriptsize{0x...\textcolor{darkRed}{32}}} + \cell{\texttt{verified}} + \cellcomL{\scriptsize{0x...\textcolor{darkRed}{28}}} + \padding{3}{% + \begin{tabular}{c} + \texttt{buf[7]} \\ + ... \\ + \texttt{buf[0]} \\ + \end{tabular} + } \cellcomL{\scriptsize{0x...\textcolor{darkRed}{20}}} + \end{drawstack} + \end{column} + \end{columns} + \pause + \centering\vfill\alert{% + Can we solve the problem by pushing \texttt{buf} first?% + } +\end{frame} + +\begin{frame} + \frametitle{Buffer overflow that leads to code execution} + \centering\includegraphics[height=0.6\textheight]{img/demo} +\end{frame} + +\begin{frame} + \frametitle{Summary of principles for stack smashing attacks} + \centering\includegraphics[height=0.6\textheight]{img/stack-smashing}\\ + \vfill + \alert{1.} Gain control of return address + \titlefloatright{\alert{2.} Point to some malicious code} +\end{frame} + +\begin{frame} + \frametitle{The hard part is jumping to malicious code \titlefloatright{`In the buffer'}} + \begin{columns} + \begin{column}{0.49\textwidth} + \begin{enumerate} + \item Add asm instructions in the buffer + \begin{itemize} + \item Usually to open a shell + \item `Shell-code' + \end{itemize} + \item Jump to the buffer's shell-code + \end{enumerate} + \vspace{1cm}\centering + Exact address of buffer?\\ + \rding\\ + Use a nop-sled + \end{column} + \begin{column}{0.49\textwidth} + \centering + \begin{tikzpicture}[scale=0.5] + \stacktop{} + % cells + \cell{RA} \coordinate (ra) at (currentcell.east); + \cell{shell code} \coordinate (sc) at (currentcell.west); + \bcell{\texttt{nop}} \coordinate(nopl) at (currentcell.west); + \bcell{...} \coordinate(nopm) at (currentcell.east); + \bcell{\texttt{nop}} \coordinate(nopf) at (currentcell.west); + \cellptr{\texttt{\&buf[0]}} + % air plane + \coordinate(mid) at ($ (nopl) !.5! (nopf) $); + \node(plane) at ($ (mid) + (-2,0) $){% + \includegraphics[width=45pt]{img/air-plane} + }; + % edges + \path[draw=darkRed,-latex,rounded corners,dashed,thick] + (ra) -- ($ (ra) + (2,0) $) |- (nopm); + \stackbottom{} + \end{tikzpicture} + \end{column} + \end{columns} + \pause + \centering\vfill\alert{% + Note: nop-sled + asm may also be injected to the heap---`heap spraying' + } +\end{frame} + +\begin{frame} + \frametitle{The hard part is jumping to malicious code \titlefloatright{% + `Return-to-libc'}} + \begin{columns} + \begin{column}{0.49\textwidth} + \begin{enumerate} + \item Point to an already loaded function + \begin{itemize} + \item \texttt{system()} + \end{itemize} + \item Prepare stack with arguments + \begin{itemize} + \item \texttt{"rm -rf /home/\$USER"} + \end{itemize} + \end{enumerate} + \vspace{12pt} + \ding{224}\texttt{system("rm -rf /home/\$USER")} + \end{column} + \pause + \begin{column}{0.49\textwidth} + \centering\includegraphics[height=0.45\textheight]{img/libc} + \end{column} + \end{columns} + \vfill + \lstinputlisting[style=CStyle,numbers=none]{sample/ldd} +\end{frame} + +\begin{frame} + \frametitle{Widely used stack smashing mitigation techniques} + \textbf{Idea:} try to prevent the two necessary stack smashing conditions from + meeting met + \vfill + \pause + \begin{itemize} + \item<2-> Address randomization \titlefloatright{Increases jump uncertainty} + \item<3-> Non-executable memory \titlefloatright{Stop if instruction pointer + gets here} + \item<4-> Stack canaries \titlefloatright{Stop if RA got tampered with} + \end{itemize} + \vfill + \lstinputlisting[style=CStyle,numbers=none]{sample/ldd2} +\end{frame} + +\begin{frame} + \frametitle{Canaries} + \begin{columns} + \begin{column}{0.49\textwidth} + \centering + \vbox to .8\textheight{ + \vfill + \begin{quote} + `` [...] miners would bring a caged canary into new coal seams. Canaries + are especially sensitive to methane and carbon monoxide [...], as long + as the bird kept singing, the miners knew their air supply was safe.'' + \end{quote} + \vfill + \begin{quote} + ``\textbf{Short but meaningful}'' + \end{quote} + \vfill + } + \end{column} + \begin{column}{0.49\textwidth} + \centering + \includegraphics[height=0.8\textheight]{img/canary-bird}\\ + \centering\burl{https://www.wisegeek.com/what-does-it-mean-to-be-a-canary-in-a-coal-mine.htm} + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Stack canaries \titlefloatright{Before overflow}} + \centering + \includegraphics[width=0.95\textwidth]{img/canary-before} + \vfill + \begin{columns} + \begin{column}{0.49\textwidth} + \begin{itemize} + \item Terminator canaries + \item Random canaries + \item ... + \end{itemize} + \end{column} + \begin{column}{0.49\textwidth} + \centering + \textbf{Require:}\\ + CY must be valid to use RA + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Stack canaries \titlefloatright{After overflow}} + \centering + \includegraphics[width=0.8\textwidth]{img/canary-after} + \vfill + \textbf{Stop running---invalid canary value!} + \pause + \vfill + \vfill\centering\alert{Can anyone think of examples where the two canary + types fail?} + % == stack == + % - local variable which is a function pointer gets overwritten; when + % called the attacker's function is used instead + % - somehow extract random canary value from memory or rewrite it + % - guess canary, e.g., due to bad randomness + % == terminator == + % - you have a double buffer overflow vulnerability: first you overwrite as + % normal to hit RA, then subsequently you `repair' the predictable canary +\end{frame} + +\begin{frame} + \frametitle{Great mitigation techniques, but we realize that...} + \centering\Huge{% + it is still imperfect + \vfill + What else can we do? + } + \pause + \vfill + \normalsize + \begin{columns} + \begin{column}{0.33\textwidth} + \begin{itemize} + \item Avoid bugs in C/C++ code + \end{itemize} + \end{column} + \begin{column}{0.33\textwidth} + \begin{itemize} + \item Build and use tools that help catching bugs + \end{itemize} + \end{column} + \begin{column}{0.33\textwidth} + \begin{itemize} + \item Use memory safe programming languages + \end{itemize} + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Avoid bugs in C/C\texttt{++} code} + \begin{columns} + \begin{column}{0.59\textwidth} + \begin{itemize} + \item Sanitize all untrusted user input + \item Manually verify all bounds \alert{correctly} + \item Be aware of integer underflow/overflow + \item Use safe(r) functions and learn caveats + \begin{itemize} + \item \texttt{fgets} vs.\ \texttt{gets} + \item \texttt{strncpy} vs.\ \texttt{strcpy} + \item \texttt{man strncpy} \ding{224} null-termination? + \end{itemize} + \item \textbf{Adopt a secure coding standard} + \begin{itemize} + \item CERT C\footnotemark + \item MISRA C\footnotemark (embedded systems) + \end{itemize} + \end{itemize} + \end{column} + \begin{column}{0.39\textwidth} + \centering\includegraphics[height=0.6\textheight]{img/checklist} + \end{column} + \end{columns} + \footnotetext[6]{\burl{https://resources.sei.cmu.edu/downloads/secure-coding/assets/sei-cert-c-coding-standard-2016-v01.pdf}} + \footnotetext{\burl{https://www.misra.org.uk/Activities/MISRAC/tabid/160/Default.aspx}} +\end{frame} + + +\begin{frame} + \frametitle{Build and use tools that help catching bugs \titlefloatright{% + Static analysis% + \footnote{\burl{https://www.perforce.com/blog/qac/what-static-code-analysis}} + }} + \begin{columns} + \begin{column}{0.69\textwidth} + \begin{itemize} + \item Automated source code analysis \alert{before} runtime + \item Output warnings if errors are suspected + \item Assess compliance with coding standards + \end{itemize} + \end{column} + \begin{column}{0.39\textwidth} + \vbox to .7\textheight{% + \centering + \lstinputlisting[style=CStyle]{sample/static-analysis.c} + \texttt{\$ splint main.c} \\ + \ding{224} 3 non-gcc warnings + \vfill + \tiny{\alert{Details:}} \burl{https://www.splint.org/} + } + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Build and use tools that help catching bugs \titlefloatright{Dynamic + analysis}} + \begin{columns} + \begin{column}{0.59\textwidth} + \begin{itemize} + \item Analyze what program does at \alert{runtime} + \item Valgrind---look for memory errors + \item Fuzzing\footnotemark---what happens on funky input? + \begin{itemize} + \item<2-> Random and mutation-based + \item<3-> Structure-aware + \item<4-> Program-aware + \item<5-> Automated feedback loops + \item<6-> ... + \end{itemize} + \end{itemize} + \end{column} + \begin{column}{0.39\textwidth} + \vbox to .8\textheight{ + \vfill\centering + \includegraphics[width=\textwidth]{img/afl.jpg} + \burl{https://upload.wikimedia.org/wikipedia/commons/0/08/Rabbit_american_fuzzy_lop_buck_white.jpg} + \vfill + } + \end{column} + \end{columns} + \footnotetext{\tiny{Brief introduction and a few demos:} + \burl{https://www.youtube.com/watch?v=dMmsPwkSqOc}} +\end{frame} + +\begin{frame} + \frametitle{Is fuzzing worth the effort? \titlefloatright{American Fuzzer Lop + (AFL)}} + \centering + \includegraphics[width=0.8\textwidth]{img/afl}\\ + \burl{http://lcamtuf.coredump.cx/afl/} + \vfill\normalsize\alert{And around 120 more projects!} +\end{frame} + +\begin{frame} + \frametitle{Use memory-safe programming languages} + \begin{columns} + \begin{column}{0.59\textwidth} + \vbox to 0.5\textheight{% + \textbf{Intuition:} \texttt{x[y] = z} should stop normal program + execution if \texttt{x} is non-array or \texttt{y} is out-of-range, + and you should not operate on raw memory addresses\footnotemark + \vfill + \only<2->{ + \textbf{Challenges:} + \begin{itemize} + \item You need low-level access to hardware + \item You inherit a large \texttt{C}/\texttt{C++} project + \item Someone must implement the core correctly + \end{itemize} + } + } + \end{column} + \begin{column}{0.39\textwidth} + \begin{tikzpicture} + \node[draw=none](first) at (0,0) {% + \includegraphics[height=2cm]{img/memory-safe/go} + \includegraphics[height=2cm]{img/memory-safe/rust} + }; + \node[draw=none, below =0pt of first] (second) {% + \includegraphics[height=1cm]{img/memory-safe/python} + }; + \node[draw=none, below =0pt of second] (third) {% + \includegraphics[height=1.5cm]{img/memory-safe/java} + }; + \coordinate(mycord) at ($ (first.east) !.5! (third.east) $); + \node[draw=none](fourth) at ($ (mycord) !.5! (third) $) {% + \hspace{2cm}\huge{\texttt{C\#}} + }; + \end{tikzpicture} + \end{column} + \end{columns} + \vfill + \centering + \begin{description} + \item<3->[\alert{What about performance?}] \alert{Is it a valid concern?} + \end{description} + \footnotetext{\tiny{If you want a more precise intuition:} + \burl{http://www.pl-enthusiast.net/2014/07/21/memory-safety/} + } +\end{frame} + +%\begin{frame} +% \frametitle{Take a deeper dive into buffer overflow vulnerabilities and +% defenses} +% \vfill +% \begin{columns} +% \begin{column}{0.33\textwidth} +% \centering +% \includegraphics[width=\textwidth]{img/mit1} +% \burl{https://www.youtube.com/watch?v=GqmQg-cszw4&list=PLUl4u3cNGP62K2DjQLRxDNRi0z2IRWnNh&index=1} +% \end{column} +% \begin{column}{0.33\textwidth} +% \centering +% \includegraphics[width=\textwidth]{img/mit2} +% \burl{https://www.youtube.com/watch?v=r4KjHEgg9Wg&index=2&list=PLUl4u3cNGP62K2DjQLRxDNRi0z2IRWnNh} +% \end{column} +% \begin{column}{0.33\textwidth} +% \centering +% \includegraphics[width=\textwidth]{img/mit3} +% \burl{https://www.youtube.com/watch?v=xSQxaie_h1o&index=3&list=PLUl4u3cNGP62K2DjQLRxDNRi0z2IRWnNh} +% \end{column} +% \end{columns} +% \vfill\centering\alert{Optional!} +%\end{frame} + +\begin{frame} + \frametitle{Summary} + \begin{columns} + \begin{column}{.59\textwidth} + \begin{itemize} + \item Weird machines + \item Over-read, over-write + \item Change program flow + \item Mitigation techniques + \item Tools and other options + \end{itemize} + \end{column} + \begin{column}{.49\textwidth} + \centering\includegraphics[width=\textwidth]{img/take-away} + \end{column} + \end{columns} + %\centering\includegraphics[height=0.8\textheight]{img/summary} +\end{frame} + +\begin{frame} + \frametitle{Assignment questions \titlefloatright{(1/3)}} + \alert{1.} Suppose that the code below is compiled as follows: + \texttt{gcc -Wall -Werror -std=c99 main.c}. Provide two \alert{integer + inputs} that will result in `unintended behaviour' and name what this + threat is called. Make assumptions if necessary. + % Assume int is 4 bytes. + % - Number 1: 1 + % - Number 2: 2147483647 // 2^31 - 1 + % => 1+2147483647 <= 10 + % (integer overflow) + \begin{columns} + \begin{column}{0.59\textwidth} + \lstinputlisting[style=CStyle]{sample/assignment-integer-overflow.c} + \end{column} + \begin{column}{0.39\textwidth} + \vbox to .65\textheight{ + \vfill + \alert{2.} Determine which compiler option could be used to ensure + that the program aborts if such unintended behaviour occurs. Does + this solution work for \texttt{unsigned int}s? Why (not)? \\ + % -ftrapv: abort if signed integer overflow. Does not work for + % unsigned since overflow is well-defined and in many cases intended. + \vfill + \alert{3.} What is the compliant way of adding two unsigned integers + according to CERT C standard? + % ยง5.1.1.2, page 133 (find link to CERT C pdf in the slides) + % unsigned int ui_b, ui_a, sum; + % if (UINT_MAX - ui_a < ui_b) { + % /* handle error condition */ + % } else { + % sum = ui_a + ui_b; + % } + \vfill + } + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Assignment questions \titlefloatright{(2/3)}} + \alert{4.} Suppose that the code below is compiled as follows: \texttt{gcc + -Wall -Werror -std=c99 -fno-stack-protector main.c}. Explain the steps + necessary to trigger the print statement. Make assumptions if necessary. + % Assume that secret is 4 bytes and on a higher address than buf. + % Exploit: python -c 'print "\xff"*12' | ./a.out + \begin{columns} + \begin{column}{0.59\textwidth} + \lstinputlisting[style=CStyle]{sample/assignment-buffer-overflow.c} + \end{column} + \begin{column}{0.39\textwidth} + \vbox to .65\textheight{ + \vfill + \alert{5.} How would you adapt your strategy if \texttt{SECRET} was set + to \texttt{0xff0a0dff}? Explain principles. + % If we try to enter this value gets() will stop since CRLF. Instead + % we would have to overwrite the return address so that the program + % jumps to gotcha(). + \vfill + \alert{6.} Which type of buffer overflow mitigation technique does the + new secret value remind you of? + % Terminator-based stack canary + \vfill + \alert{7.} Explain two other mitigation techniques that make it harder + to execute code in a buffer overflow. + % - Address randomization: every time program executes all addresses + % are changed based on a cryptographically secure PRNG + % - Non-executable memory: halt program if instruction pointer takes + % on a value that corresponds to memory that should not be executed + % + % In other words: both of these techniques try to make it hard for + % the attacker to specify a return address that does not cause a crash + } + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Assignment questions \titlefloatright{(3/3)}} + \vfill + \alert{8.} Attackers may use \texttt{nop}-sleds to increase the likelihood of + jumping to their shell-code. To defend against this a colleague of yours + suggested that all user input be filtered for repeated \texttt{nop} + instructions. How would you trivially bypass such a filtering mechanism? + % Use other dummy instructions that increment instruction pointer, e.g., + % add, sub, mul, and write results to dummy register (not important). + \vfill + \alert{9.} What is the difference between static and dynamic code analysis?\\ + % Static code analysis takes place _before_ a program is being executed. + % Conversely, dynamic code analysis examines what a program does at runtime. + \vfill + \alert{10.} Briefly explain the process of fuzzing a program: how does it work + and what is the goal? Name one fuzzer that found a buffer overflow + vulnerability in a TLS library. + % - How: supply lots and lots of funky input and see what happens; record + % errors % and examine in more detail later. + % - Goal: find untested cases that cause `unintended behaviour' + % - Example: American Fuzzy Lop (AFL) + \vfill + \alert{11.} Suppose that you are hired by a consultant company to work on a + brand new project. Explain the circumstances in which you would choose to + program in \texttt{C/C++}, and why you might choose a different programming + language in most other cases. + % C/C++: if low-level access to memory is _required_, i.e., there should + % be a very clear motivation why you must use C as opposed to Go,C#, ... + % Memory safe languages: would be chosen otherwise, since it is generally + % easier not to mess up the code. + \vfill +\end{frame} diff --git a/slides/2018-software-security/src/preamble.tex b/slides/2018-software-security/src/preamble.tex new file mode 100644 index 0000000..cd99ec4 --- /dev/null +++ b/slides/2018-software-security/src/preamble.tex @@ -0,0 +1,98 @@ +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +% Packages % +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +\usepackage[ + lambda, advantage, operators, sets, adversary, landau, probability, notions, + logic, ff, mm, primitives, events, complexity, asymptotics, keys +]{cryptocode} + +\usepackage{rotate} +\usepackage{graphicx} +\usepackage{mathtools} +\usepackage{amsmath} +\usepackage{amssymb} +\usepackage{flowchart} +\usepackage{smartdiagram} +\usepackage{pifont} +\usepackage{graphicx} +\usepackage{color} +\usepackage{drawstack} +\usepackage{tikz} +\usepackage{tikz-qtree} +\usetikzlibrary{ + arrows,% + decorations.markings,% + backgrounds,% + calc,% + fit,% + positioning,% + shapes.misc,% + shadows,% + shapes.arrows,% + shapes,% + snakes,% +} +\usepackage{booktabs} +\usepackage{smartdiagram} +%\usepackage{floatrow} +%\usepackage[position=bottom]{subfig} % environment for nested figures + +\usepackage{xcolor} +\definecolor{darkGreen}{HTML}{008000} +\definecolor{darkBlue}{HTML}{2809B2} +\definecolor{darkRed}{HTML}{CC0000} +\definecolor{darkGray}{HTML}{808080} +\definecolor{darkOrange}{HTML}{D77D00} +\definecolor{darkPurple}{HTML}{800080} +\colorlet{lightGray}{gray!33} +\colorlet{lightYellow}{yellow!50} +\definecolor{darkGreen}{HTML}{008000} +\definecolor{darkBlue}{HTML}{2809B2} +\definecolor{darkRed}{HTML}{CC0000} + +% Figures, tables and code +\usepackage{booktabs} +\usepackage{colortbl} +\usepackage{flowchart} +\usepackage{adjustbox} +\usepackage{listings} + +\lstdefinestyle{CStyle}{ + backgroundcolor=\color{lightGray!25}, + commentstyle=\color{darkGreen}, + keywordstyle=\color{darkBlue}, + numberstyle=\tiny\color{darkRed}, + stringstyle=\color{darkPurple}, + basicstyle=\footnotesize, + breakatwhitespace=false, + breaklines=false, + captionpos=b, + keepspaces=true, + numbers=left, + numbersep=5pt, + showspaces=false, + showstringspaces=false, + showtabs=false, + tabsize=2, + language=C, + morekeywords={size_t}, +} + +%\setbeamertemplate{itemize item}[circle] +%\setbeamertemplate{itemize subitem}[default] +%\setbeamertemplate{caption}[numbered] + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +% Defines % +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +\makeatletter +\let\@@magyar@captionfix\relax %needed for \titlefloatright +\makeatother + +\newcommand{\tyes}{\textcolor{darkGreen}{\ding{51}}} +\newcommand{\tno}{\textcolor{darkRed}{\ding{55}}} +\newcommand{\burl}[1]{\tiny{\url{#1}}} +\newcommand{\TODO}[1]{\textcolor{red}{TODO}: #1} +\newcommand{\titlefloatright}[1]{\hspace{0pt plus 1 filll}#1$\;$} + +\def\rding{\rotatebox[origin=c]{-90}{\ding{224}}} diff --git a/slides/2018-software-security/src/questions.tex b/slides/2018-software-security/src/questions.tex new file mode 100644 index 0000000..85cb2f3 --- /dev/null +++ b/slides/2018-software-security/src/questions.tex @@ -0,0 +1,17 @@ +\begin{frame} + \frametitle{Any questions?} \label{frm:que} + \begin{columns} + \begin{column}{0.49\textwidth} + \centering + \includegraphics[width=0.75\textwidth]{img/qleft} + \end{column} + \begin{column}{0.49\textwidth} + \centering + \includegraphics[width=0.75\textwidth]{img/qright} + \end{column} + \end{columns} + + \centering + \vspace{-1cm} + \includegraphics[width=0.20\textwidth]{img/ty} +\end{frame} diff --git a/slides/2018-software-security/src/titlepage.tex b/slides/2018-software-security/src/titlepage.tex new file mode 100644 index 0000000..9b18039 --- /dev/null +++ b/slides/2018-software-security/src/titlepage.tex @@ -0,0 +1,3 @@ +\begin{frame} + \titlepage +\end{frame} |
