From 76bae02bcd7d6b3ec9eea428e5e95da184a8dbfb Mon Sep 17 00:00:00 2001 From: Rasmus Dahlberg Date: Tue, 15 Oct 2024 15:35:20 +0200 Subject: Rescue some slides from old private mono repos --- slides/2018-software-security/.gitignore | 12 + slides/2018-software-security/README | 1 + .../2018-software-security/beamercolorthemergd.sty | 24 + .../2018-software-security/beamerfontthemergd.sty | 9 + .../2018-software-security/beamerinnerthemergd.sty | 49 + .../2018-software-security/beamerouterthemergd.sty | 66 ++ slides/2018-software-security/beamerthemergd.sty | 23 + slides/2018-software-security/demo/cmd_complex | 17 + slides/2018-software-security/demo/cmd_simple | 28 + slides/2018-software-security/demo/complex.c | 13 + slides/2018-software-security/demo/simple.c | 22 + slides/2018-software-security/handout.pdf | Bin 0 -> 2883792 bytes slides/2018-software-security/img/afl.jpg | Bin 0 -> 72066 bytes slides/2018-software-security/img/afl.png | Bin 0 -> 125021 bytes slides/2018-software-security/img/air-plane.pdf | Bin 0 -> 85623 bytes slides/2018-software-security/img/attacker.pdf | Bin 0 -> 18217 bytes slides/2018-software-security/img/bad-encode.jpg | Bin 0 -> 38869 bytes slides/2018-software-security/img/bug.jpg | Bin 0 -> 108875 bytes slides/2018-software-security/img/canary-after.png | Bin 0 -> 26788 bytes .../2018-software-security/img/canary-before.png | Bin 0 -> 25418 bytes slides/2018-software-security/img/canary-bird.jpg | Bin 0 -> 35554 bytes slides/2018-software-security/img/checklist.pdf | Bin 0 -> 3072 bytes slides/2018-software-security/img/clang.png | Bin 0 -> 32588 bytes slides/2018-software-security/img/cwe.png | Bin 0 -> 269488 bytes slides/2018-software-security/img/demo.png | Bin 0 -> 19989 bytes .../2018-software-security/img/google-rewards.png | Bin 0 -> 130803 bytes slides/2018-software-security/img/hb1.png | Bin 0 -> 185015 bytes slides/2018-software-security/img/hb2.png | Bin 0 -> 161801 bytes slides/2018-software-security/img/hb3.png | Bin 0 -> 188264 bytes slides/2018-software-security/img/hb4.png | Bin 0 -> 175161 bytes slides/2018-software-security/img/hb5.png | Bin 0 -> 202473 bytes slides/2018-software-security/img/hb6.png | Bin 0 -> 279847 bytes slides/2018-software-security/img/heartbleed.png | Bin 0 -> 14763 bytes slides/2018-software-security/img/icloud.tex | 0 slides/2018-software-security/img/libc.jpg | Bin 0 -> 14588 bytes slides/2018-software-security/img/logo.png | Bin 0 -> 66309 bytes slides/2018-software-security/img/memlay.png | Bin 0 -> 46100 bytes .../2018-software-security/img/memory-safe/go.png | Bin 0 -> 53655 bytes .../img/memory-safe/java.png | Bin 0 -> 41208 bytes .../img/memory-safe/python.jpg | Bin 0 -> 45683 bytes .../img/memory-safe/rust.png | Bin 0 -> 4461 bytes slides/2018-software-security/img/mit1.png | Bin 0 -> 246363 bytes slides/2018-software-security/img/mit2.png | Bin 0 -> 268538 bytes slides/2018-software-security/img/mit3.png | Bin 0 -> 252809 bytes slides/2018-software-security/img/qleft.pdf | Bin 0 -> 11388 bytes slides/2018-software-security/img/qright.pdf | Bin 0 -> 12895 bytes slides/2018-software-security/img/question.png | Bin 0 -> 219274 bytes slides/2018-software-security/img/real-bug.png | Bin 0 -> 183047 bytes .../2018-software-security/img/stack-smashing.png | Bin 0 -> 84738 bytes slides/2018-software-security/img/summary.jpg | Bin 0 -> 44483 bytes slides/2018-software-security/img/take-away.pdf | 68 ++ slides/2018-software-security/img/ty.pdf | Bin 0 -> 12497 bytes .../2018-software-security/img/weird-machine.png | Bin 0 -> 99870 bytes slides/2018-software-security/img/zerodium.png | Bin 0 -> 73000 bytes slides/2018-software-security/main.tex | 27 + .../2018-software-security/sample/._bo-stack.c.swp | Bin 0 -> 12288 bytes slides/2018-software-security/sample/_bo-heap.c | 19 + slides/2018-software-security/sample/_bo-stack.c | 21 + .../2018-software-security/sample/_stack-frame.c | 26 + .../sample/assignment-buffer-overflow.c | 15 + .../sample/assignment-integer-overflow.c | 15 + slides/2018-software-security/sample/bad-add.c | 10 + slides/2018-software-security/sample/bad-call.c | 10 + slides/2018-software-security/sample/bad-index.c | 4 + slides/2018-software-security/sample/bad-index2.c | 4 + slides/2018-software-security/sample/bad-printf.c | 4 + slides/2018-software-security/sample/bo-heap.c | 13 + slides/2018-software-security/sample/bo-stack.c | 12 + slides/2018-software-security/sample/build | 10 + slides/2018-software-security/sample/ldd | 7 + slides/2018-software-security/sample/ldd2 | 8 + slides/2018-software-security/sample/main.c | 4 + slides/2018-software-security/sample/splint | 17 + slides/2018-software-security/sample/stack-frame.c | 18 + .../sample/static-analysis.c | 10 + slides/2018-software-security/slides.pdf | Bin 0 -> 2997403 bytes slides/2018-software-security/src/body.tex | 1009 ++++++++++++++++++++ slides/2018-software-security/src/preamble.tex | 98 ++ slides/2018-software-security/src/questions.tex | 17 + slides/2018-software-security/src/titlepage.tex | 3 + 80 files changed, 1713 insertions(+) create mode 100644 slides/2018-software-security/.gitignore create mode 100644 slides/2018-software-security/README create mode 100644 slides/2018-software-security/beamercolorthemergd.sty create mode 100644 slides/2018-software-security/beamerfontthemergd.sty create mode 100644 slides/2018-software-security/beamerinnerthemergd.sty create mode 100644 slides/2018-software-security/beamerouterthemergd.sty create mode 100644 slides/2018-software-security/beamerthemergd.sty create mode 100644 slides/2018-software-security/demo/cmd_complex create mode 100644 slides/2018-software-security/demo/cmd_simple create mode 100644 slides/2018-software-security/demo/complex.c create mode 100644 slides/2018-software-security/demo/simple.c create mode 100644 slides/2018-software-security/handout.pdf create mode 100644 slides/2018-software-security/img/afl.jpg create mode 100644 slides/2018-software-security/img/afl.png create mode 100644 slides/2018-software-security/img/air-plane.pdf create mode 100644 slides/2018-software-security/img/attacker.pdf create mode 100644 slides/2018-software-security/img/bad-encode.jpg create mode 100644 slides/2018-software-security/img/bug.jpg create mode 100644 slides/2018-software-security/img/canary-after.png create mode 100644 slides/2018-software-security/img/canary-before.png create mode 100644 slides/2018-software-security/img/canary-bird.jpg create mode 100644 slides/2018-software-security/img/checklist.pdf create mode 100644 slides/2018-software-security/img/clang.png create mode 100644 slides/2018-software-security/img/cwe.png create mode 100644 slides/2018-software-security/img/demo.png create mode 100644 slides/2018-software-security/img/google-rewards.png create mode 100644 slides/2018-software-security/img/hb1.png create mode 100644 slides/2018-software-security/img/hb2.png create mode 100644 slides/2018-software-security/img/hb3.png create mode 100644 slides/2018-software-security/img/hb4.png create mode 100644 slides/2018-software-security/img/hb5.png create mode 100644 slides/2018-software-security/img/hb6.png create mode 100644 slides/2018-software-security/img/heartbleed.png create mode 100644 slides/2018-software-security/img/icloud.tex create mode 100644 slides/2018-software-security/img/libc.jpg create mode 100755 slides/2018-software-security/img/logo.png create mode 100644 slides/2018-software-security/img/memlay.png create mode 100644 slides/2018-software-security/img/memory-safe/go.png create mode 100644 slides/2018-software-security/img/memory-safe/java.png create mode 100644 slides/2018-software-security/img/memory-safe/python.jpg create mode 100644 slides/2018-software-security/img/memory-safe/rust.png create mode 100644 slides/2018-software-security/img/mit1.png create mode 100644 slides/2018-software-security/img/mit2.png create mode 100644 slides/2018-software-security/img/mit3.png create mode 100644 slides/2018-software-security/img/qleft.pdf create mode 100644 slides/2018-software-security/img/qright.pdf create mode 100644 slides/2018-software-security/img/question.png create mode 100644 slides/2018-software-security/img/real-bug.png create mode 100644 slides/2018-software-security/img/stack-smashing.png create mode 100644 slides/2018-software-security/img/summary.jpg create mode 100644 slides/2018-software-security/img/take-away.pdf create mode 100644 slides/2018-software-security/img/ty.pdf create mode 100644 slides/2018-software-security/img/weird-machine.png create mode 100644 slides/2018-software-security/img/zerodium.png create mode 100644 slides/2018-software-security/main.tex create mode 100644 slides/2018-software-security/sample/._bo-stack.c.swp create mode 100644 slides/2018-software-security/sample/_bo-heap.c create mode 100644 slides/2018-software-security/sample/_bo-stack.c create mode 100644 slides/2018-software-security/sample/_stack-frame.c create mode 100644 slides/2018-software-security/sample/assignment-buffer-overflow.c create mode 100644 slides/2018-software-security/sample/assignment-integer-overflow.c create mode 100644 slides/2018-software-security/sample/bad-add.c create mode 100644 slides/2018-software-security/sample/bad-call.c create mode 100644 slides/2018-software-security/sample/bad-index.c create mode 100644 slides/2018-software-security/sample/bad-index2.c create mode 100644 slides/2018-software-security/sample/bad-printf.c create mode 100644 slides/2018-software-security/sample/bo-heap.c create mode 100644 slides/2018-software-security/sample/bo-stack.c create mode 100755 slides/2018-software-security/sample/build create mode 100644 slides/2018-software-security/sample/ldd create mode 100644 slides/2018-software-security/sample/ldd2 create mode 100644 slides/2018-software-security/sample/main.c create mode 100644 slides/2018-software-security/sample/splint create mode 100644 slides/2018-software-security/sample/stack-frame.c create mode 100644 slides/2018-software-security/sample/static-analysis.c create mode 100644 slides/2018-software-security/slides.pdf create mode 100644 slides/2018-software-security/src/body.tex create mode 100644 slides/2018-software-security/src/preamble.tex create mode 100644 slides/2018-software-security/src/questions.tex create mode 100644 slides/2018-software-security/src/titlepage.tex (limited to 'slides/2018-software-security') diff --git a/slides/2018-software-security/.gitignore b/slides/2018-software-security/.gitignore new file mode 100644 index 0000000..4a7f033 --- /dev/null +++ b/slides/2018-software-security/.gitignore @@ -0,0 +1,12 @@ +*.aux +*.fdb_latexmk +*.fls +*.fls +*.log +*.nav +*.out +main.pdf +*.snm +*.toc +*.nav +*.snm diff --git a/slides/2018-software-security/README b/slides/2018-software-security/README new file mode 100644 index 0000000..b236d9b --- /dev/null +++ b/slides/2018-software-security/README @@ -0,0 +1 @@ +~2x lectures on software security, used 2018-2019 at kau. diff --git a/slides/2018-software-security/beamercolorthemergd.sty b/slides/2018-software-security/beamercolorthemergd.sty new file mode 100644 index 0000000..74ced1c --- /dev/null +++ b/slides/2018-software-security/beamercolorthemergd.sty @@ -0,0 +1,24 @@ +\mode + +%%% +% Color definitions +%%% +\RequirePackage{xcolor} +\definecolor{rgdGreen}{RGB}{33,114,106} +\definecolor{rgdYellow}{RGB}{255,210,4} +\definecolor{rgdOrange}{RGB}{232,114,12} +\colorlet{rgdGray}{gray!33} +\colorlet{rgdBlack}{black} + +%%% +% Beamer colors +%%% +\setbeamercolor*{titlepage}{fg=rgdBlack} +\setbeamercolor*{author}{fg=rgdGreen} +\setbeamercolor*{date}{fg=black} +\setbeamercolor*{header}{bg=rgdYellow,fg=black} +\setbeamercolor*{trailer}{bg=rgdGray,fg=black} +\setbeamercolor*{item}{fg=rgdGreen} +\setbeamercolor*{alerted text}{fg=rgdGreen} + +\mode diff --git a/slides/2018-software-security/beamerfontthemergd.sty b/slides/2018-software-security/beamerfontthemergd.sty new file mode 100644 index 0000000..a6d212c --- /dev/null +++ b/slides/2018-software-security/beamerfontthemergd.sty @@ -0,0 +1,9 @@ +\mode + +\setbeamerfont{title}{size=\large,shape=\bfseries} +\setbeamerfont{subtitle}{size=\normalsize,shape=\bfseries} +\setbeamerfont{frametitle}{size=\large,shape=\bfseries} +\setbeamerfont{institute}{size=\small} +\setbeamerfont{date}{size=\small} + +\mode diff --git a/slides/2018-software-security/beamerinnerthemergd.sty b/slides/2018-software-security/beamerinnerthemergd.sty new file mode 100644 index 0000000..4dfd6cf --- /dev/null +++ b/slides/2018-software-security/beamerinnerthemergd.sty @@ -0,0 +1,49 @@ +\mode + +%%% +% Title page +%%% +\defbeamertemplate*{title page}{rgd}[1][]{ + \begin{tikzpicture}[remember picture, overlay] + \usebeamercolor{titlepage} + % Add top-left triangle with university logo + \filldraw[draw=rgdGray,fill=rgdGray] + (current page.north west) -- + (current page.north) -- + node[draw=none,pos=0.5](Logo){\includegraphics[width=3cm]{img/logo}} + (current page.west) -- + (current page.north west); + % Add title + \node[ + text=fg, + text width=0.75\paperwidth, + ] (Title) at ([shift={(0,-0.5cm)}]current page){% + \centering\usebeamerfont{title}\inserttitle\\% + }; + % Add subtitle + \node[ + text=fg, + text width=0.75\paperwidth, + below=0pt of Title, + ] (Subtitle) {% + \centering\usebeamerfont{subtitle}\insertsubtitle\\% + }; + % Add authors + \usebeamercolor{author} + \node[ + text=fg, + text width=0.75\paperwidth, + below=12pt of Subtitle, + ] (Author) {% + \centering\usebeamerfont{author}\insertauthor\\% + }; + % Add date + \node[ + text=fg, + text width=0.75\paperwidth, + below right= 0.25cm and 4.5cm of current page.north, + ](Date) {\today}; + \end{tikzpicture} +} + +\mode diff --git a/slides/2018-software-security/beamerouterthemergd.sty b/slides/2018-software-security/beamerouterthemergd.sty new file mode 100644 index 0000000..ba757c6 --- /dev/null +++ b/slides/2018-software-security/beamerouterthemergd.sty @@ -0,0 +1,66 @@ +\mode + +%%% +% Frame header +%%% +\defbeamertemplate*{frametitle}{corporate}[1][]{% + \nointerlineskip + % Add frame title + \begin{beamercolorbox}[ + wd=\paperwidth, + ht=3ex, + dp=1.5ex, + left, + leftskip=2ex + ]{header} + \insertframetitle + \end{beamercolorbox} + % Add line after header + \nointerlineskip + \begin{beamercolorbox}[ + wd=\paperwidth, + ht=0.25ex + ]{trailer} + \end{beamercolorbox}% +} + +%%% +% Frame trailer +%%% +\defbeamertemplate*{footline}{corporate}{% + \hbox{% + % Add mail + \begin{beamercolorbox}[ + wd=0.22\paperwidth, + ht=2ex, + dp=0.5ex, + left, + leftskip=2ex + ]{trailer} + \texttt{rasmus.dahlberg@kau.se} + \end{beamercolorbox}% + % Add author + \begin{beamercolorbox}[ + wd=0.73\paperwidth, + ht=2ex, + dp=0.5ex, + left, + leftskip=2ex + ]{header} + %\insertauthor + \inserttitle + \end{beamercolorbox}% + % Add page counter + \begin{beamercolorbox}[ + wd=0.05\paperwidth, + ht=2ex, + dp=0.5ex, + right, + rightskip=1ex + ]{header} + \insertframenumber/\inserttotalframenumber + \end{beamercolorbox}% + } +} + +\mode diff --git a/slides/2018-software-security/beamerthemergd.sty b/slides/2018-software-security/beamerthemergd.sty new file mode 100644 index 0000000..022ef2c --- /dev/null +++ b/slides/2018-software-security/beamerthemergd.sty @@ -0,0 +1,23 @@ +\mode + +%%% +% Load beamer settings +%%% +\usecolortheme{rgd} +\usefonttheme{rgd} +\useinnertheme{rgd} +\useoutertheme{rgd} + +%%% +% Disable navigation tools on slides +%%% +\setbeamertemplate{navigation symbols}{} + +%%% +% Object styles +%%% +\setbeamertemplate{itemize item}[square] +\setbeamertemplate{itemize subitem}[default] +\setbeamertemplate{sections/subsections in toc}[square] + +\mode diff --git a/slides/2018-software-security/demo/cmd_complex b/slides/2018-software-security/demo/cmd_complex new file mode 100644 index 0000000..b8bc8e4 --- /dev/null +++ b/slides/2018-software-security/demo/cmd_complex @@ -0,0 +1,17 @@ +# compile +gcc -Wall -Werror -std=c99 -ggdb -fno-stack-protector -m32 -o complex complex.c + +# want +ptr to "/bin/bash" <-- will becomes system's first args +dummy RA <-- will becomes sytem's RA +ptr to system <-- RA +... + +# find /bin/bash +x/500s $rsp + +# find system +p system + +# run with args +run `python -c 'print "some stuff"'` diff --git a/slides/2018-software-security/demo/cmd_simple b/slides/2018-software-security/demo/cmd_simple new file mode 100644 index 0000000..266535e --- /dev/null +++ b/slides/2018-software-security/demo/cmd_simple @@ -0,0 +1,28 @@ +# compile +gcc -std=c99 -fno-stack-protector -Wno-deprecated-declarations -ggdb -o simple simple.c + +# run +gdb ./simple + +# demo commands +list main +list greeter +list fun + +disassemble main +disassemble greeter +disassemble fun + +info register + +b main +b greeter +b fun + +run + +# show +- return address / register values +- 11a -> "8a" +- segfault +- jump fun diff --git a/slides/2018-software-security/demo/complex.c b/slides/2018-software-security/demo/complex.c new file mode 100644 index 0000000..ae91ac6 --- /dev/null +++ b/slides/2018-software-security/demo/complex.c @@ -0,0 +1,13 @@ +#include +#include + +void f(char *b) { + char buf[8]; + strcpy(buf, b); + printf("buf: %s\n", buf); +} + +int main(int argc, char *argv[]) { + f(argv[1]); + return 0; +} diff --git a/slides/2018-software-security/demo/simple.c b/slides/2018-software-security/demo/simple.c new file mode 100644 index 0000000..cd07c07 --- /dev/null +++ b/slides/2018-software-security/demo/simple.c @@ -0,0 +1,22 @@ +#include +#include +#include + +void fun() { + printf("fun times!\n"); +} + +void mul(int first) { + int second = 0; + char buf[8] = {1,2,3,4,5,6,7,8}; + printf("Enter a number: "); + gets(buf); + second = atoi(buf); + printf("%d*%d = %d\n", first, second, first*second); +} + +int main() { + int first = 2; + mul(first); + return 0; +} diff --git a/slides/2018-software-security/handout.pdf b/slides/2018-software-security/handout.pdf new file mode 100644 index 0000000..00e1f42 Binary files /dev/null and b/slides/2018-software-security/handout.pdf differ diff --git a/slides/2018-software-security/img/afl.jpg b/slides/2018-software-security/img/afl.jpg new file mode 100644 index 0000000..42baef0 Binary files /dev/null and b/slides/2018-software-security/img/afl.jpg differ diff --git a/slides/2018-software-security/img/afl.png b/slides/2018-software-security/img/afl.png new file mode 100644 index 0000000..d259912 Binary files /dev/null and b/slides/2018-software-security/img/afl.png differ diff --git a/slides/2018-software-security/img/air-plane.pdf b/slides/2018-software-security/img/air-plane.pdf new file mode 100644 index 0000000..3b27910 Binary files /dev/null and b/slides/2018-software-security/img/air-plane.pdf differ diff --git a/slides/2018-software-security/img/attacker.pdf b/slides/2018-software-security/img/attacker.pdf new file mode 100644 index 0000000..bd8f863 Binary files /dev/null and b/slides/2018-software-security/img/attacker.pdf differ diff --git a/slides/2018-software-security/img/bad-encode.jpg b/slides/2018-software-security/img/bad-encode.jpg new file mode 100644 index 0000000..e9ea82e Binary files /dev/null and b/slides/2018-software-security/img/bad-encode.jpg differ diff --git a/slides/2018-software-security/img/bug.jpg b/slides/2018-software-security/img/bug.jpg new file mode 100644 index 0000000..3b86ec3 Binary files /dev/null and b/slides/2018-software-security/img/bug.jpg differ diff --git a/slides/2018-software-security/img/canary-after.png b/slides/2018-software-security/img/canary-after.png new file mode 100644 index 0000000..ad9965a Binary files /dev/null and b/slides/2018-software-security/img/canary-after.png differ diff --git a/slides/2018-software-security/img/canary-before.png b/slides/2018-software-security/img/canary-before.png new file mode 100644 index 0000000..0b7bebe Binary files /dev/null and b/slides/2018-software-security/img/canary-before.png differ diff --git a/slides/2018-software-security/img/canary-bird.jpg b/slides/2018-software-security/img/canary-bird.jpg new file mode 100644 index 0000000..c89b42c Binary files /dev/null and b/slides/2018-software-security/img/canary-bird.jpg differ diff --git a/slides/2018-software-security/img/checklist.pdf b/slides/2018-software-security/img/checklist.pdf new file mode 100644 index 0000000..ceeac09 Binary files /dev/null and b/slides/2018-software-security/img/checklist.pdf differ diff --git a/slides/2018-software-security/img/clang.png b/slides/2018-software-security/img/clang.png new file mode 100644 index 0000000..06dd0dd Binary files /dev/null and b/slides/2018-software-security/img/clang.png differ diff --git a/slides/2018-software-security/img/cwe.png b/slides/2018-software-security/img/cwe.png new file mode 100644 index 0000000..5d2fa27 Binary files /dev/null and b/slides/2018-software-security/img/cwe.png differ diff --git a/slides/2018-software-security/img/demo.png b/slides/2018-software-security/img/demo.png new file mode 100644 index 0000000..03a10fc Binary files /dev/null and b/slides/2018-software-security/img/demo.png differ diff --git a/slides/2018-software-security/img/google-rewards.png b/slides/2018-software-security/img/google-rewards.png new file mode 100644 index 0000000..34492fc Binary files /dev/null and b/slides/2018-software-security/img/google-rewards.png differ diff --git a/slides/2018-software-security/img/hb1.png b/slides/2018-software-security/img/hb1.png new file mode 100644 index 0000000..fe606c5 Binary files /dev/null and b/slides/2018-software-security/img/hb1.png differ diff --git a/slides/2018-software-security/img/hb2.png b/slides/2018-software-security/img/hb2.png new file mode 100644 index 0000000..b65179d Binary files /dev/null and b/slides/2018-software-security/img/hb2.png differ diff --git a/slides/2018-software-security/img/hb3.png b/slides/2018-software-security/img/hb3.png new file mode 100644 index 0000000..371b4c4 Binary files /dev/null and b/slides/2018-software-security/img/hb3.png differ diff --git a/slides/2018-software-security/img/hb4.png b/slides/2018-software-security/img/hb4.png new file mode 100644 index 0000000..8a52e7d Binary files /dev/null and b/slides/2018-software-security/img/hb4.png differ diff --git a/slides/2018-software-security/img/hb5.png b/slides/2018-software-security/img/hb5.png new file mode 100644 index 0000000..1df3291 Binary files /dev/null and b/slides/2018-software-security/img/hb5.png differ diff --git a/slides/2018-software-security/img/hb6.png b/slides/2018-software-security/img/hb6.png new file mode 100644 index 0000000..8cfb9b5 Binary files /dev/null and b/slides/2018-software-security/img/hb6.png differ diff --git a/slides/2018-software-security/img/heartbleed.png b/slides/2018-software-security/img/heartbleed.png new file mode 100644 index 0000000..27933db Binary files /dev/null and b/slides/2018-software-security/img/heartbleed.png differ diff --git a/slides/2018-software-security/img/icloud.tex b/slides/2018-software-security/img/icloud.tex new file mode 100644 index 0000000..e69de29 diff --git a/slides/2018-software-security/img/libc.jpg b/slides/2018-software-security/img/libc.jpg new file mode 100644 index 0000000..8dd2012 Binary files /dev/null and b/slides/2018-software-security/img/libc.jpg differ diff --git a/slides/2018-software-security/img/logo.png b/slides/2018-software-security/img/logo.png new file mode 100755 index 0000000..0c7c885 Binary files /dev/null and b/slides/2018-software-security/img/logo.png differ diff --git a/slides/2018-software-security/img/memlay.png b/slides/2018-software-security/img/memlay.png new file mode 100644 index 0000000..9c7aa52 Binary files /dev/null and b/slides/2018-software-security/img/memlay.png differ diff --git a/slides/2018-software-security/img/memory-safe/go.png b/slides/2018-software-security/img/memory-safe/go.png new file mode 100644 index 0000000..74266bb Binary files /dev/null and b/slides/2018-software-security/img/memory-safe/go.png differ diff --git a/slides/2018-software-security/img/memory-safe/java.png b/slides/2018-software-security/img/memory-safe/java.png new file mode 100644 index 0000000..b1fb238 Binary files /dev/null and b/slides/2018-software-security/img/memory-safe/java.png differ diff --git a/slides/2018-software-security/img/memory-safe/python.jpg b/slides/2018-software-security/img/memory-safe/python.jpg new file mode 100644 index 0000000..a1779d6 Binary files /dev/null and b/slides/2018-software-security/img/memory-safe/python.jpg differ diff --git a/slides/2018-software-security/img/memory-safe/rust.png b/slides/2018-software-security/img/memory-safe/rust.png new file mode 100644 index 0000000..0016983 Binary files /dev/null and b/slides/2018-software-security/img/memory-safe/rust.png differ diff --git a/slides/2018-software-security/img/mit1.png b/slides/2018-software-security/img/mit1.png new file mode 100644 index 0000000..bba6d7e Binary files /dev/null and b/slides/2018-software-security/img/mit1.png differ diff --git a/slides/2018-software-security/img/mit2.png b/slides/2018-software-security/img/mit2.png new file mode 100644 index 0000000..4d6a9ff Binary files /dev/null and b/slides/2018-software-security/img/mit2.png differ diff --git a/slides/2018-software-security/img/mit3.png b/slides/2018-software-security/img/mit3.png new file mode 100644 index 0000000..110c58e Binary files /dev/null and b/slides/2018-software-security/img/mit3.png differ diff --git a/slides/2018-software-security/img/qleft.pdf b/slides/2018-software-security/img/qleft.pdf new file mode 100644 index 0000000..f35a078 Binary files /dev/null and b/slides/2018-software-security/img/qleft.pdf differ diff --git a/slides/2018-software-security/img/qright.pdf b/slides/2018-software-security/img/qright.pdf new file mode 100644 index 0000000..da2e8e3 Binary files /dev/null and b/slides/2018-software-security/img/qright.pdf differ diff --git a/slides/2018-software-security/img/question.png b/slides/2018-software-security/img/question.png new file mode 100644 index 0000000..4e174a6 Binary files /dev/null and b/slides/2018-software-security/img/question.png differ diff --git a/slides/2018-software-security/img/real-bug.png b/slides/2018-software-security/img/real-bug.png new file mode 100644 index 0000000..05bb42d Binary files /dev/null and b/slides/2018-software-security/img/real-bug.png differ diff --git a/slides/2018-software-security/img/stack-smashing.png b/slides/2018-software-security/img/stack-smashing.png new file mode 100644 index 0000000..7d06eb2 Binary files /dev/null and b/slides/2018-software-security/img/stack-smashing.png differ diff --git a/slides/2018-software-security/img/summary.jpg b/slides/2018-software-security/img/summary.jpg new file mode 100644 index 0000000..3850ec7 Binary files /dev/null and b/slides/2018-software-security/img/summary.jpg differ diff --git a/slides/2018-software-security/img/take-away.pdf b/slides/2018-software-security/img/take-away.pdf new file mode 100644 index 0000000..7d3b190 --- /dev/null +++ b/slides/2018-software-security/img/take-away.pdf @@ -0,0 +1,68 @@ +%PDF-1.4 +% +3 0 obj +<< /Length 4 0 R + /Filter /FlateDecode +>> +stream +xmA0＂ >R#$E{rGyC\`;㻨(dUt0f-TA7 Tx1f՚;"*4{~M7$ +endstream +endobj +4 0 obj + 118 +endobj +2 0 obj +<< + /ExtGState << + /a0 << /CA 1 /ca 1 >> + >> +>> +endobj +5 0 obj +<< /Type /Page + /Parent 1 0 R + /MediaBox [ 0 0 12.8 12.8 ] + /Contents 3 0 R + /Group << + /Type /Group + /S /Transparency + /I true + /CS /DeviceRGB + >> + /Resources 2 0 R +>> +endobj +1 0 obj +<< /Type /Pages + /Kids [ 5 0 R ] + /Count 1 +>> +endobj +6 0 obj +<< /Creator (cairo 1.14.0 (http://cairographics.org)) + /Producer (cairo 1.14.0 (http://cairographics.org)) +>> +endobj +7 0 obj +<< /Type /Catalog + /Pages 1 0 R +>> +endobj +xref +0 8 +0000000000 65535 f +0000000520 00000 n +0000000232 00000 n +0000000015 00000 n +0000000210 00000 n +0000000304 00000 n +0000000585 00000 n +0000000712 00000 n +trailer +<< /Size 8 + /Root 7 0 R + /Info 6 0 R +>> +startxref +764 +%%EOF diff --git a/slides/2018-software-security/img/ty.pdf b/slides/2018-software-security/img/ty.pdf new file mode 100644 index 0000000..9ad4dc8 Binary files /dev/null and b/slides/2018-software-security/img/ty.pdf differ diff --git a/slides/2018-software-security/img/weird-machine.png b/slides/2018-software-security/img/weird-machine.png new file mode 100644 index 0000000..cd0bddf Binary files /dev/null and b/slides/2018-software-security/img/weird-machine.png differ diff --git a/slides/2018-software-security/img/zerodium.png b/slides/2018-software-security/img/zerodium.png new file mode 100644 index 0000000..3caa73a Binary files /dev/null and b/slides/2018-software-security/img/zerodium.png differ diff --git a/slides/2018-software-security/main.tex b/slides/2018-software-security/main.tex new file mode 100644 index 0000000..f442493 --- /dev/null +++ b/slides/2018-software-security/main.tex @@ -0,0 +1,27 @@ +\pdfminorversion=4 +%\documentclass[handout,aspectratio=169]{beamer} +\documentclass[aspectratio=169]{beamer} +\usetheme{rgd} + +\input{src/preamble} + +\title{% + Software Security I\&II +} +%\subtitle{% +%} +\author{% + Rasmus Dahlberg +} +\institute{% + Karlstad University +} +\date{% + \today +} + +\begin{document} + \input{src/titlepage} + \input{src/body} + \input{src/questions} +\end{document} diff --git a/slides/2018-software-security/sample/._bo-stack.c.swp b/slides/2018-software-security/sample/._bo-stack.c.swp new file mode 100644 index 0000000..376288d Binary files /dev/null and b/slides/2018-software-security/sample/._bo-stack.c.swp differ diff --git a/slides/2018-software-security/sample/_bo-heap.c b/slides/2018-software-security/sample/_bo-heap.c new file mode 100644 index 0000000..a89959c --- /dev/null +++ b/slides/2018-software-security/sample/_bo-heap.c @@ -0,0 +1,19 @@ +void verify_heap() +{ + char *buf = malloc(8*sizeof(char)); + char *verified = malloc(sizeof(int)); + *verified = 0; + gets(buf); + /* */ + if (*verified) { + printf("accept\n"); + } else { + printf("reject\n"); + } +} + +int main(int argc, char *argv[]) +{ + verify_heap(); + return 0; +} diff --git a/slides/2018-software-security/sample/_bo-stack.c b/slides/2018-software-security/sample/_bo-stack.c new file mode 100644 index 0000000..167496e --- /dev/null +++ b/slides/2018-software-security/sample/_bo-stack.c @@ -0,0 +1,21 @@ +#include + +void verify_stack() +{ + int verified = 0; + char buf[8] = {4,4,4,4,8,8,8,8}; + gets(buf); + /* */ + if (verified) { + printf("accept\n"); + } else { + printf("reject\n"); + } +} + +int main(int argc, char *argv[]) +{ + printf("Lucky number: %d\n", 1337); + verify_stack(); + return 0; +} diff --git a/slides/2018-software-security/sample/_stack-frame.c b/slides/2018-software-security/sample/_stack-frame.c new file mode 100644 index 0000000..32f4fe2 --- /dev/null +++ b/slides/2018-software-security/sample/_stack-frame.c @@ -0,0 +1,26 @@ +#include + +int add(int a, int b) +{ + int result; + result = a+b; + return result; +} + +int sub(int a, int b) +{ + int result; + result = add(a,-b); + return result; +} + +int algorithm() +{ + printf("result: %d\n", sub(2,1)); +} + +int main(int argc, char *argv[]) +{ + algorithm(); + return 0; +} diff --git a/slides/2018-software-security/sample/assignment-buffer-overflow.c b/slides/2018-software-security/sample/assignment-buffer-overflow.c new file mode 100644 index 0000000..2fb0d58 --- /dev/null +++ b/slides/2018-software-security/sample/assignment-buffer-overflow.c @@ -0,0 +1,15 @@ +#include +#include +#define SECRET UINT_MAX + +void gotcha() { printf("Gotcha!\n"); } + +int main() { + unsigned secret = 0; + char buf[8]; + scanf("%s", buf); + if (secret == SECRET) { + gotcha(); + } + return 0; +} diff --git a/slides/2018-software-security/sample/assignment-integer-overflow.c b/slides/2018-software-security/sample/assignment-integer-overflow.c new file mode 100644 index 0000000..58c59b1 --- /dev/null +++ b/slides/2018-software-security/sample/assignment-integer-overflow.c @@ -0,0 +1,15 @@ +#include + +int get_int() { + int v; printf("Enter an integer: "); + scanf("%d", &v); + return v; +} + +int main() { + int a=get_int(), b=get_int(), max=10; + if (a+b > max) + printf("%d+%d > %d\n", a, b, max); + else + printf("%d+%d <= %d\n", a, b, max); +} diff --git a/slides/2018-software-security/sample/bad-add.c b/slides/2018-software-security/sample/bad-add.c new file mode 100644 index 0000000..42424de --- /dev/null +++ b/slides/2018-software-security/sample/bad-add.c @@ -0,0 +1,10 @@ +void cat(char *dst, size_t n, + char *src1, size_t n1, + char *src2, size_t n2) +{ + if (n1+n2 <= n) { + strncpy(dst, src1, n); + strncat(dst, src2, n-n1); + } +} +... diff --git a/slides/2018-software-security/sample/bad-call.c b/slides/2018-software-security/sample/bad-call.c new file mode 100644 index 0000000..9d6d57b --- /dev/null +++ b/slides/2018-software-security/sample/bad-call.c @@ -0,0 +1,10 @@ +void init(char v, char *buf, int n) +{ + char *b = buf; + while (b < buf+n) { + *b++ = val; + } +} +... +char *buf = malloc(2); +init('A', buf, sizeof(buf)); diff --git a/slides/2018-software-security/sample/bad-index.c b/slides/2018-software-security/sample/bad-index.c new file mode 100644 index 0000000..37d94b3 --- /dev/null +++ b/slides/2018-software-security/sample/bad-index.c @@ -0,0 +1,4 @@ +char b[4] = "abc"; +b[3] = 'd'; +printf("b: %s\n", b); +... diff --git a/slides/2018-software-security/sample/bad-index2.c b/slides/2018-software-security/sample/bad-index2.c new file mode 100644 index 0000000..b9f5be6 --- /dev/null +++ b/slides/2018-software-security/sample/bad-index2.c @@ -0,0 +1,4 @@ +char b[4] = "abc"; +b[4] = 'd'; +printf("b: %s\n", s); +... diff --git a/slides/2018-software-security/sample/bad-printf.c b/slides/2018-software-security/sample/bad-printf.c new file mode 100644 index 0000000..7026600 --- /dev/null +++ b/slides/2018-software-security/sample/bad-printf.c @@ -0,0 +1,4 @@ +char b[4]; +fgets(b, 4, stdin); +printf(b); +... diff --git a/slides/2018-software-security/sample/bo-heap.c b/slides/2018-software-security/sample/bo-heap.c new file mode 100644 index 0000000..60fd29e --- /dev/null +++ b/slides/2018-software-security/sample/bo-heap.c @@ -0,0 +1,13 @@ +void verify_heap() +{ + char *buf = malloc(8*sizeof(char)); + int *verified = malloc(sizeof(int)); + *verified = 0; + gets(buf); + /* */ + if (*verified) { + printf("accept\n"); + } else { + printf("reject\n"); + } +} diff --git a/slides/2018-software-security/sample/bo-stack.c b/slides/2018-software-security/sample/bo-stack.c new file mode 100644 index 0000000..f8bcb55 --- /dev/null +++ b/slides/2018-software-security/sample/bo-stack.c @@ -0,0 +1,12 @@ +void verify_stack() +{ + int verified = 0; + char buf[8]; + gets(buf); + /* */ + if (verified) { + printf("accept\n"); + } else { + printf("reject\n"); + } +} diff --git a/slides/2018-software-security/sample/build b/slides/2018-software-security/sample/build new file mode 100755 index 0000000..123db54 --- /dev/null +++ b/slides/2018-software-security/sample/build @@ -0,0 +1,10 @@ +#!/bin/bash + +echo "[Compile] bo-stack" +gcc -g -O0 -fno-stack-protector -o bo-stack _bo-stack.c &> /dev/null + +echo "[Compile] bo-heap" +gcc -g -O0 -fno-stack-protector -o bo-heap _bo-heap.c &> /dev/null + +echo "[Compile] stack-frame" +gcc -g -O0 -fno-stack-protector -o stack-frame _stack-frame.c diff --git a/slides/2018-software-security/sample/ldd b/slides/2018-software-security/sample/ldd new file mode 100644 index 0000000..dc2cc99 --- /dev/null +++ b/slides/2018-software-security/sample/ldd @@ -0,0 +1,7 @@ +$ cat main.c +int main() { return 0; } +$ gcc main.c +$ ldd ./a.out + linux-vdso.so.1 (0x00007fff3a9e4000) + libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fa5bfeda000) + /lib64/ld-linux-x86-64.so.2 (0x00007fa5c04cd000) diff --git a/slides/2018-software-security/sample/ldd2 b/slides/2018-software-security/sample/ldd2 new file mode 100644 index 0000000..ff87494 --- /dev/null +++ b/slides/2018-software-security/sample/ldd2 @@ -0,0 +1,8 @@ +$ ldd ./a.out + linux-vdso.so.1 (0x00007ffdda7ce000) + libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f7f307ba000) + /lib64/ld-linux-x86-64.so.2 (0x00007f7f30dad000) +$ ldd ./a.out + linux-vdso.so.1 (0x00007ffe387d4000) + libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fdd793ef000) + /lib64/ld-linux-x86-64.so.2 (0x00007fdd799e2000) diff --git a/slides/2018-software-security/sample/main.c b/slides/2018-software-security/sample/main.c new file mode 100644 index 0000000..f8b643a --- /dev/null +++ b/slides/2018-software-security/sample/main.c @@ -0,0 +1,4 @@ +int main() +{ + return 0; +} diff --git a/slides/2018-software-security/sample/splint b/slides/2018-software-security/sample/splint new file mode 100644 index 0000000..af8501e --- /dev/null +++ b/slides/2018-software-security/sample/splint @@ -0,0 +1,17 @@ +static-analysis.c: (in function main) +static-analysis.c:7:9: Possibly null storage buf passed as non-null param: + fgets (buf, ...) + A possibly null pointer is passed as a parameter corresponding to a formal + parameter with no /*@null@*/ annotation. If NULL may be used for this + parameter, add a /*@null@*/ annotation to the function parameter declaration. + (Use -nullpass to inhibit warning) + static-analysis.c:6:15: Storage buf may become null +static-analysis.c:7:3: Return value (type char *) ignored: fgets(buf, 8, stdin) + Result returned by function call is not used. If this is intended, can cast + result to (void) to eliminate message. (Use -retvalother to inhibit warning) +static-analysis.c:9:12: Fresh storage buf not released before return + A memory leak has been detected. Storage allocated locally is not released + before the last reference to it is lost. (Use -mustfreefresh to inhibit + warning) + static-analysis.c:6:25: Fresh storage buf created + diff --git a/slides/2018-software-security/sample/stack-frame.c b/slides/2018-software-security/sample/stack-frame.c new file mode 100644 index 0000000..b5c962f --- /dev/null +++ b/slides/2018-software-security/sample/stack-frame.c @@ -0,0 +1,18 @@ +int add(int a, int b) +{ + int result; + result = a+b; + return result; +} + +int sub(int a, int b) +{ + int result; + result = add(a,-b); + return result; +} + +int algorithm() +{ + printf("result: %d\n", sub(2,1)); +} diff --git a/slides/2018-software-security/sample/static-analysis.c b/slides/2018-software-security/sample/static-analysis.c new file mode 100644 index 0000000..3d89478 --- /dev/null +++ b/slides/2018-software-security/sample/static-analysis.c @@ -0,0 +1,10 @@ +#include +#include + +int main() +{ + char *buf = malloc(8); + fgets(buf, 8, stdin); + printf("%s\n", buf); + return 0; +} diff --git a/slides/2018-software-security/slides.pdf b/slides/2018-software-security/slides.pdf new file mode 100644 index 0000000..b073cf6 Binary files /dev/null and b/slides/2018-software-security/slides.pdf differ diff --git a/slides/2018-software-security/src/body.tex b/slides/2018-software-security/src/body.tex new file mode 100644 index 0000000..0eb89e1 --- /dev/null +++ b/slides/2018-software-security/src/body.tex @@ -0,0 +1,1009 @@ +\begin{frame} +\frametitle{Learning outcomes} + \vfill\centering + \smartdiagramset{ + sequence item height=1.75cm, + sequence item width=2.5cm, + sequence item text width = 2.4cm, + } + \smartdiagram[sequence diagram]{% + What is software security,% + Software security gone wrong,% + Buffer overflows and + defenses% + } + \pause + \vfill\centering\textbf{Already covered here or elsewhere:} least privilege, + modern crypto, use secure APIs, pass strings to complex subsystems with + care, do unit testing, security audits, ... +\end{frame} + +\begin{frame} + \frametitle{Be aware of other common coding mistakes not covered here} + \centering\includegraphics[width=\textwidth]{img/cwe} + \burl{https://cwe.mitre.org/data/definitions/699.html} +\end{frame} + +\begin{frame} + \frametitle{Software vulnerabilities pay\titlefloatright{Zerodium's program}} + \centering\includegraphics[height=0.8\textheight]{img/zerodium}\\ + \burl{https://zerodium.com/program.html} +\end{frame} + +\begin{frame} + \frametitle{Software vulnerabilities pay\titlefloatright{Google's + program}} + \centering\includegraphics[height=0.8\textheight]{img/google-rewards}\\ + \burl{https://www.google.com/about/appsecurity/reward-program/index.html} +\end{frame} + + +\begin{frame} + \frametitle{% + What is software security about?% + \titlefloatright{% + Weird machines\footnote{\burl{https://en.wikipedia.org/wiki/Weird_machine}}% + }% + } + \centering + \includegraphics[height=0.4\textheight]{img/weird-machine} + \\\vfill + Security properties and threat model $\rightarrow$ + program should work as intended +\end{frame} + +\begin{frame} + \frametitle{Can you spell software vulnerability? \titlefloatright{BUG}} + \centering\includegraphics[height=0.5\textheight]{img/real-bug} + % REMEMBER@bug: bad composition, implementation error, logical error +\end{frame} + +\begin{frame} + %REMEMBER@bad comp: Mat Honan + \frametitle{Bad composition \titlefloatright{Gmail password + reset\footnote{% + \burl{https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/} + \titlefloatright{Credit: Nickolai Zeldovich and James Mickens} + }}} + \centering + \begin{tikzpicture} + \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm, + minimum height=2cm](gmail) at (0,0) {% + \begin{tabular}{c} + \textbf{Gmail reset}\\ + \begin{tabular}{l} + \textbf{-} use backup mail\\ + \textbf{-} \texttt{m****n@me.com}\\ + \\ + \end{tabular} + \end{tabular} + }; + \pause + + \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm, + minimum height=2cm, below=1cm of gmail](appleid) {% + \begin{tabular}{c} + \textbf{AppleID reset}\\ + \begin{tabular}{l} + \textbf{-} mail address\\ + \textbf{-} billing address\\ + \textbf{-} last four in CC\\ + \end{tabular} + \end{tabular} + }; + \pause + + \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm, + minimum height=2cm, right=3cm of gmail](amazon) {% + \begin{tabular}{c} + \textbf{Amazon reset}\\ + \begin{tabular}{l} + \textbf{-} name \\ + \textbf{-} billing address\\ + \textbf{-} CC number\\ + \end{tabular} + \end{tabular} + }; + \pause + + \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm, + minimum height=2cm, below=1cm of amazon](amazonadd) {% + \begin{tabular}{c} + \textbf{Amazon add CC}\\ + \begin{tabular}{l} + \textbf{-} name \\ + \textbf{-} mail address\\ + \textbf{-} billing address\\ + \end{tabular} + \end{tabular} + }; + + \pause + \path[draw,thick,-latex] + (amazonadd) -- + node[draw=none,right]{precaution\footnotemark} + (amazon); + \pause + \path[draw,thick,-latex] (amazon) -- (appleid); + \pause + \path[draw,thick,-latex] (appleid) -- (gmail); + \end{tikzpicture} + \footnotetext{\tiny{Obfuscate CC, s.t., only last last 4 CC digits are shown}} +\end{frame} + +\begin{frame} + \frametitle{Implementation error\titlefloatright{% + iCloud hack\footnote{% + \burl{https://github.com/hackappcom/ibrute} + \titlefloatright{Credit: Nickolai Zeldovich and James Mickens} + }}} + \centering + \begin{tikzpicture} + \node[draw=gray, thick, rounded rectangle, minimum width=4cm, minimum + height=2cm, fill=gray!25] (icloud) at (0,0) {iCloud}; + \node[draw=none, left=2cm of icloud](ifile) {Files}; + \node[draw=none, above=1cm of icloud](ifeature) {Other features}; + \coordinate(imid) at ($ (ifile.north) !.5! (ifeature) $); + \node[draw=none] (isharing) at ($ (imid) + (-.75,.5) $) {Sharing}; + \node[draw=none, right=2cm of icloud](ifind) {% + \begin{tabular}{c} + Find my\\ + iPhone + \end{tabular} + }; + \path[draw, -latex] (ifile) -- (icloud); + \path[draw, -latex] (isharing) -- (icloud); + \path[draw, -latex] (ifeature) -- (icloud); + \path[draw, -latex] (ifind) -- (icloud); + \end{tikzpicture} + \pause + \vfill + \begin{columns} + \begin{column}{0.49\textwidth} + \vbox to .2\textheight{ + \vfill + \begin{itemize} + \item User must login to use a feature + \pause + \item \textbf{Rate limited login attempts?} + \end{itemize} + \vfill + } + \end{column} + \begin{column}{0.49\textwidth} + \vbox to .2\textheight{ + \vfill + Files, sharing, other features? + \titlefloatright{\textcolor{darkGreen}{Yep}}\\ + \pause + Find my iPhone...? + \titlefloatright{\textcolor{darkRed}{Nop}} + \vfill + } + \end{column} + \end{columns} + \pause + \vfill + \alert{Lesson learned: the importance of testing against abnormal behaviour} +\end{frame} + +\begin{frame} + \frametitle{Implementation error\titlefloatright{Subject + names and TLS\footnote{% + \burl{https://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatSSL-PAPER1.pdf} + }}} + \begin{columns} + \begin{column}{0.59\textwidth} + \begin{itemize} + \item TLS certificate: identity-to-key binding + \pause + \item Subject name? Pascal string + \begin{itemize} + \item Length followed by characters + \end{itemize} + \pause + \item Many TLS implementations? C string + \begin{itemize} + \item Characters with null-termination + \end{itemize} + \end{itemize} + \end{column} + \pause + \begin{column}{0.39\textwidth} + \includegraphics[width=\textwidth]{img/bad-encode} + \end{column} + \end{columns} + \pause + \vfill\centering\alert{Lesson learned: only process data at uniform formats} +\end{frame} + +\begin{frame} + \frametitle{The bad news :/} + \begin{columns} + \begin{column}{0.59\textwidth} + \begin{itemize} + \item Much software is written in \texttt{C}/\texttt{C++} + \item Recipe for disaster: + \begin{itemize} + \item Exposure to raw memory addresses + \item No built-in bound checking and safety + \item Operate on untrusted user input + \end{itemize} + \item Why? + \end{itemize} + \end{column} + \begin{column}{0.39\textwidth} + \centering\includegraphics[height=0.6\textheight]{img/clang}\\ + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{It is easy to get wrong \titlefloatright{1/2}} + \vfill + \begin{columns} + \begin{column}{0.33\textwidth} + \vbox to .4\textheight{ + \centering + \lstinputlisting[style=CStyle]{sample/bad-index.c} + \vfill + Problem? \\ + \pause + \textbf{over-read} \\ + \pause + } + \end{column} + \begin{column}{0.33\textwidth} + \vbox to .4\textheight{ + \centering + \lstinputlisting[style=CStyle]{sample/bad-index2.c} + \vfill + Problem? \\ + \pause + \textbf{over-write} \\ + \pause + } + \end{column} + \begin{column}{0.33\textwidth} + \vbox to .4\textheight{ + \centering + \lstinputlisting[style=CStyle]{sample/bad-printf.c} + \vfill + Problem? \\ + \pause + \textbf{over-read} \\ + } + \end{column} + \end{columns} + \vfill +\end{frame} + +\begin{frame} + \frametitle{It is easy to get wrong \titlefloatright{2/2}} + \vfill + \begin{columns} + \begin{column}{0.49\textwidth} + \vbox to .6\textheight{ + \centering + \lstinputlisting[style=CStyle]{sample/bad-call.c} + \vfill + Problem? \\ + \pause + \textbf{over-write} + \pause + } + \end{column} + \begin{column}{0.49\textwidth} + \vbox to .6\textheight{ + \centering + \lstinputlisting[style=CStyle]{sample/bad-add.c} + \vfill + Problem? \\ + \pause + \textbf{over-write} + } + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{A famous over-read in OpenSSL\titlefloatright{% + Heartbleed bug% + \includegraphics[height=16pt]{img/heartbleed}% + }} + \begin{columns} + \begin{column}{0.49\textwidth} + \includegraphics[width=\textwidth]{img/hb1} + \includegraphics[width=\textwidth]{img/hb2} + \includegraphics[width=\textwidth]{img/hb3} + \end{column} + \begin{column}{0.49\textwidth} + \includegraphics[width=\textwidth]{img/hb4} + \includegraphics[width=\textwidth]{img/hb5} + \includegraphics[width=\textwidth]{img/hb6} + \end{column} + \end{columns} + \vfill\centering\burl{https://xkcd.com/1354/} + %REMEMBER@after heartbleed: transition -> easy bug, not the typical case. Usually, attckers exploit buffer overflows (i.e., write outside of buffer boundaries) to change the program flow, e.g., by changing the value of adjacent variables. In extreme cases, entirely new functionality can be inserted - hello world program with buf overflow -> delete files... This is what we will work towards now. +\end{frame} + +\begin{frame} + %REMEMBER: explain stack briefly, and paint everything on board - local vars + \frametitle{Buffer overflow \titlefloatright{Stack}} + \begin{columns} + \begin{column}{0.59\textwidth} + \lstinputlisting[style=CStyle]{sample/bo-stack.c} + \end{column} + \pause + \begin{column}{0.39\textwidth} + \begin{itemize} + \item Input 1: Neal \ding{224} \textcolor{darkRed}{reject} + \pause + \item Input 2: Caffrey \ding{224} \textcolor{darkRed}{reject} + \pause + \item Input 3: Overflow! \ding{224} \textcolor{darkGreen}{accept} + \pause + \end{itemize} + \end{column} + \end{columns} + \vfill\centering\alert{Buffer overflow occurs when writing outside of a buffer's boundaries} +\end{frame} + +\begin{frame} + %REMEMBER: explain heapy briefly, and paint everything on board - need var lifetime that is longer than function lifetime + \frametitle{Buffer overflow \titlefloatright{Heap}} + \begin{columns} + \begin{column}{0.59\textwidth} + \lstinputlisting[style=CStyle]{sample/bo-heap.c} + \end{column} + \pause + \begin{column}{0.39\textwidth} + \begin{itemize} + \item Input 1: Neal \ding{224} \textcolor{darkRed}{reject} + \pause + \item Input 2: Caffrey \ding{224} \textcolor{darkRed}{reject} + \pause + \item Input 3: aaa...aaa \ding{224} \textcolor{darkGreen}{accept} + \end{itemize} + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + % Just to make sure that everyone is on the same page now, and work towards stack frames + \frametitle{Memory layout} + \begin{columns} + \begin{column}{0.59\textwidth} + \begin{itemize} + \item Heap grows towards higher addresses + \begin{itemize} + \item Manual memory (de)allocation + \end{itemize} + \item Stack grows towards lower addresses + \begin{itemize} + \item Automatic memory (de)allocation + \item Each function has a `stack frame' + \end{itemize} + \item Data: e.g., global and static variables + \item Code: instructions that CPU can process + \end{itemize} + \end{column} + \begin{column}{0.39\textwidth} + \centering\includegraphics[height=0.6\textheight]{img/memlay} + \end{column} + \end{columns} + %\pause + %\vfill\centering\alert{Note: each process has its own virtual memory that + % is translated to physical memory} +\end{frame} + +\begin{frame} + \frametitle{Stack frames} + \begin{columns} + \begin{column}{0.49\textwidth} + \lstinputlisting[style=CStyle]{sample/stack-frame.c} + \end{column} + \begin{column}{0.49\textwidth} + Each function gets its own stack frame + \begin{itemize} + \item Local variables + \item Function parameters + \item Housekeeping such as: + \begin{itemize} + \item Return address + \item Register values + \end{itemize} + \end{itemize} + \vspace{12pt} + \alert{Push ordering} \ding{224} + \alert{see calling conventions} + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Pushing an popping stack frames} + \begin{columns} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \end{drawstack} + \end{column} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \cell{sub} + \end{drawstack} + \end{column} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \cell{sub} + \cell{add} + \end{drawstack} + \end{column} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \cell{sub} + \end{drawstack} + \end{column} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \end{drawstack} + \end{column} + \begin{column}{0.166\textwidth} + \begin{drawstack}[scale=0.5] + \cell{algorithm} + \cell{printf} + \end{drawstack} + \end{column} + \end{columns} + \vfill\centering\alert{Return to caller's context using housekeeping + information} +\end{frame} + +\begin{frame} + \frametitle{Buffer overflow on the stack continued \titlefloatright{(1/2)}} + \begin{columns} + \begin{column}{0.59\textwidth} + \lstinputlisting[style=CStyle]{sample/bo-stack.c} + \end{column} + \begin{column}{0.39\textwidth} + \begin{itemize} + \item Input 4: aaa...aaa \ding{224} \textcolor{darkRed}{segfault} + \item Why not segfault on heap? + \item Why segfault on stack? + \end{itemize} + \end{column} + \end{columns} +\end{frame} + + +\begin{frame} + \frametitle{Buffer overflow on the stack continued \titlefloatright{(2/2)}} + \begin{columns} + \begin{column}{0.49\textwidth} + %\lstinputlisting[style=CStyle,firstline=3,lastline=4,numbers=none]{% + % sample/bo-stack.c + %} + \lstinputlisting[style=CStyle]{sample/bo-stack.c} + \end{column} + \begin{column}{0.49\textwidth} + \centering + \begin{drawstack}[scale=0.5] + \cell{RA} \cellcomL{\scriptsize{0x...\textcolor{darkRed}{32}}} + \cell{\texttt{verified}} + \cellcomL{\scriptsize{0x...\textcolor{darkRed}{28}}} + \padding{3}{% + \begin{tabular}{c} + \texttt{buf[7]} \\ + ... \\ + \texttt{buf[0]} \\ + \end{tabular} + } \cellcomL{\scriptsize{0x...\textcolor{darkRed}{20}}} + \end{drawstack} + \end{column} + \end{columns} + \pause + \centering\vfill\alert{% + Can we solve the problem by pushing \texttt{buf} first?% + } +\end{frame} + +\begin{frame} + \frametitle{Buffer overflow that leads to code execution} + \centering\includegraphics[height=0.6\textheight]{img/demo} +\end{frame} + +\begin{frame} + \frametitle{Summary of principles for stack smashing attacks} + \centering\includegraphics[height=0.6\textheight]{img/stack-smashing}\\ + \vfill + \alert{1.} Gain control of return address + \titlefloatright{\alert{2.} Point to some malicious code} +\end{frame} + +\begin{frame} + \frametitle{The hard part is jumping to malicious code \titlefloatright{`In the buffer'}} + \begin{columns} + \begin{column}{0.49\textwidth} + \begin{enumerate} + \item Add asm instructions in the buffer + \begin{itemize} + \item Usually to open a shell + \item `Shell-code' + \end{itemize} + \item Jump to the buffer's shell-code + \end{enumerate} + \vspace{1cm}\centering + Exact address of buffer?\\ + \rding\\ + Use a nop-sled + \end{column} + \begin{column}{0.49\textwidth} + \centering + \begin{tikzpicture}[scale=0.5] + \stacktop{} + % cells + \cell{RA} \coordinate (ra) at (currentcell.east); + \cell{shell code} \coordinate (sc) at (currentcell.west); + \bcell{\texttt{nop}} \coordinate(nopl) at (currentcell.west); + \bcell{...} \coordinate(nopm) at (currentcell.east); + \bcell{\texttt{nop}} \coordinate(nopf) at (currentcell.west); + \cellptr{\texttt{\&buf[0]}} + % air plane + \coordinate(mid) at ($ (nopl) !.5! (nopf) $); + \node(plane) at ($ (mid) + (-2,0) $){% + \includegraphics[width=45pt]{img/air-plane} + }; + % edges + \path[draw=darkRed,-latex,rounded corners,dashed,thick] + (ra) -- ($ (ra) + (2,0) $) |- (nopm); + \stackbottom{} + \end{tikzpicture} + \end{column} + \end{columns} + \pause + \centering\vfill\alert{% + Note: nop-sled + asm may also be injected to the heap---`heap spraying' + } +\end{frame} + +\begin{frame} + \frametitle{The hard part is jumping to malicious code \titlefloatright{% + `Return-to-libc'}} + \begin{columns} + \begin{column}{0.49\textwidth} + \begin{enumerate} + \item Point to an already loaded function + \begin{itemize} + \item \texttt{system()} + \end{itemize} + \item Prepare stack with arguments + \begin{itemize} + \item \texttt{"rm -rf /home/\$USER"} + \end{itemize} + \end{enumerate} + \vspace{12pt} + \ding{224}\texttt{system("rm -rf /home/\$USER")} + \end{column} + \pause + \begin{column}{0.49\textwidth} + \centering\includegraphics[height=0.45\textheight]{img/libc} + \end{column} + \end{columns} + \vfill + \lstinputlisting[style=CStyle,numbers=none]{sample/ldd} +\end{frame} + +\begin{frame} + \frametitle{Widely used stack smashing mitigation techniques} + \textbf{Idea:} try to prevent the two necessary stack smashing conditions from + meeting met + \vfill + \pause + \begin{itemize} + \item<2-> Address randomization \titlefloatright{Increases jump uncertainty} + \item<3-> Non-executable memory \titlefloatright{Stop if instruction pointer + gets here} + \item<4-> Stack canaries \titlefloatright{Stop if RA got tampered with} + \end{itemize} + \vfill + \lstinputlisting[style=CStyle,numbers=none]{sample/ldd2} +\end{frame} + +\begin{frame} + \frametitle{Canaries} + \begin{columns} + \begin{column}{0.49\textwidth} + \centering + \vbox to .8\textheight{ + \vfill + \begin{quote} + `` [...] miners would bring a caged canary into new coal seams. Canaries + are especially sensitive to methane and carbon monoxide [...], as long + as the bird kept singing, the miners knew their air supply was safe.'' + \end{quote} + \vfill + \begin{quote} + ``\textbf{Short but meaningful}'' + \end{quote} + \vfill + } + \end{column} + \begin{column}{0.49\textwidth} + \centering + \includegraphics[height=0.8\textheight]{img/canary-bird}\\ + \centering\burl{https://www.wisegeek.com/what-does-it-mean-to-be-a-canary-in-a-coal-mine.htm} + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Stack canaries \titlefloatright{Before overflow}} + \centering + \includegraphics[width=0.95\textwidth]{img/canary-before} + \vfill + \begin{columns} + \begin{column}{0.49\textwidth} + \begin{itemize} + \item Terminator canaries + \item Random canaries + \item ... + \end{itemize} + \end{column} + \begin{column}{0.49\textwidth} + \centering + \textbf{Require:}\\ + CY must be valid to use RA + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Stack canaries \titlefloatright{After overflow}} + \centering + \includegraphics[width=0.8\textwidth]{img/canary-after} + \vfill + \textbf{Stop running---invalid canary value!} + \pause + \vfill + \vfill\centering\alert{Can anyone think of examples where the two canary + types fail?} + % == stack == + % - local variable which is a function pointer gets overwritten; when + % called the attacker's function is used instead + % - somehow extract random canary value from memory or rewrite it + % - guess canary, e.g., due to bad randomness + % == terminator == + % - you have a double buffer overflow vulnerability: first you overwrite as + % normal to hit RA, then subsequently you `repair' the predictable canary +\end{frame} + +\begin{frame} + \frametitle{Great mitigation techniques, but we realize that...} + \centering\Huge{% + it is still imperfect + \vfill + What else can we do? + } + \pause + \vfill + \normalsize + \begin{columns} + \begin{column}{0.33\textwidth} + \begin{itemize} + \item Avoid bugs in C/C++ code + \end{itemize} + \end{column} + \begin{column}{0.33\textwidth} + \begin{itemize} + \item Build and use tools that help catching bugs + \end{itemize} + \end{column} + \begin{column}{0.33\textwidth} + \begin{itemize} + \item Use memory safe programming languages + \end{itemize} + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Avoid bugs in C/C\texttt{++} code} + \begin{columns} + \begin{column}{0.59\textwidth} + \begin{itemize} + \item Sanitize all untrusted user input + \item Manually verify all bounds \alert{correctly} + \item Be aware of integer underflow/overflow + \item Use safe(r) functions and learn caveats + \begin{itemize} + \item \texttt{fgets} vs.\ \texttt{gets} + \item \texttt{strncpy} vs.\ \texttt{strcpy} + \item \texttt{man strncpy} \ding{224} null-termination? + \end{itemize} + \item \textbf{Adopt a secure coding standard} + \begin{itemize} + \item CERT C\footnotemark + \item MISRA C\footnotemark (embedded systems) + \end{itemize} + \end{itemize} + \end{column} + \begin{column}{0.39\textwidth} + \centering\includegraphics[height=0.6\textheight]{img/checklist} + \end{column} + \end{columns} + \footnotetext[6]{\burl{https://resources.sei.cmu.edu/downloads/secure-coding/assets/sei-cert-c-coding-standard-2016-v01.pdf}} + \footnotetext{\burl{https://www.misra.org.uk/Activities/MISRAC/tabid/160/Default.aspx}} +\end{frame} + + +\begin{frame} + \frametitle{Build and use tools that help catching bugs \titlefloatright{% + Static analysis% + \footnote{\burl{https://www.perforce.com/blog/qac/what-static-code-analysis}} + }} + \begin{columns} + \begin{column}{0.69\textwidth} + \begin{itemize} + \item Automated source code analysis \alert{before} runtime + \item Output warnings if errors are suspected + \item Assess compliance with coding standards + \end{itemize} + \end{column} + \begin{column}{0.39\textwidth} + \vbox to .7\textheight{% + \centering + \lstinputlisting[style=CStyle]{sample/static-analysis.c} + \texttt{\$ splint main.c} \\ + \ding{224} 3 non-gcc warnings + \vfill + \tiny{\alert{Details:}} \burl{https://www.splint.org/} + } + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Build and use tools that help catching bugs \titlefloatright{Dynamic + analysis}} + \begin{columns} + \begin{column}{0.59\textwidth} + \begin{itemize} + \item Analyze what program does at \alert{runtime} + \item Valgrind---look for memory errors + \item Fuzzing\footnotemark---what happens on funky input? + \begin{itemize} + \item<2-> Random and mutation-based + \item<3-> Structure-aware + \item<4-> Program-aware + \item<5-> Automated feedback loops + \item<6-> ... + \end{itemize} + \end{itemize} + \end{column} + \begin{column}{0.39\textwidth} + \vbox to .8\textheight{ + \vfill\centering + \includegraphics[width=\textwidth]{img/afl.jpg} + \burl{https://upload.wikimedia.org/wikipedia/commons/0/08/Rabbit_american_fuzzy_lop_buck_white.jpg} + \vfill + } + \end{column} + \end{columns} + \footnotetext{\tiny{Brief introduction and a few demos:} + \burl{https://www.youtube.com/watch?v=dMmsPwkSqOc}} +\end{frame} + +\begin{frame} + \frametitle{Is fuzzing worth the effort? \titlefloatright{American Fuzzer Lop + (AFL)}} + \centering + \includegraphics[width=0.8\textwidth]{img/afl}\\ + \burl{http://lcamtuf.coredump.cx/afl/} + \vfill\normalsize\alert{And around 120 more projects!} +\end{frame} + +\begin{frame} + \frametitle{Use memory-safe programming languages} + \begin{columns} + \begin{column}{0.59\textwidth} + \vbox to 0.5\textheight{% + \textbf{Intuition:} \texttt{x[y] = z} should stop normal program + execution if \texttt{x} is non-array or \texttt{y} is out-of-range, + and you should not operate on raw memory addresses\footnotemark + \vfill + \only<2->{ + \textbf{Challenges:} + \begin{itemize} + \item You need low-level access to hardware + \item You inherit a large \texttt{C}/\texttt{C++} project + \item Someone must implement the core correctly + \end{itemize} + } + } + \end{column} + \begin{column}{0.39\textwidth} + \begin{tikzpicture} + \node[draw=none](first) at (0,0) {% + \includegraphics[height=2cm]{img/memory-safe/go} + \includegraphics[height=2cm]{img/memory-safe/rust} + }; + \node[draw=none, below =0pt of first] (second) {% + \includegraphics[height=1cm]{img/memory-safe/python} + }; + \node[draw=none, below =0pt of second] (third) {% + \includegraphics[height=1.5cm]{img/memory-safe/java} + }; + \coordinate(mycord) at ($ (first.east) !.5! (third.east) $); + \node[draw=none](fourth) at ($ (mycord) !.5! (third) $) {% + \hspace{2cm}\huge{\texttt{C\#}} + }; + \end{tikzpicture} + \end{column} + \end{columns} + \vfill + \centering + \begin{description} + \item<3->[\alert{What about performance?}] \alert{Is it a valid concern?} + \end{description} + \footnotetext{\tiny{If you want a more precise intuition:} + \burl{http://www.pl-enthusiast.net/2014/07/21/memory-safety/} + } +\end{frame} + +%\begin{frame} +% \frametitle{Take a deeper dive into buffer overflow vulnerabilities and +% defenses} +% \vfill +% \begin{columns} +% \begin{column}{0.33\textwidth} +% \centering +% \includegraphics[width=\textwidth]{img/mit1} +% \burl{https://www.youtube.com/watch?v=GqmQg-cszw4&list=PLUl4u3cNGP62K2DjQLRxDNRi0z2IRWnNh&index=1} +% \end{column} +% \begin{column}{0.33\textwidth} +% \centering +% \includegraphics[width=\textwidth]{img/mit2} +% \burl{https://www.youtube.com/watch?v=r4KjHEgg9Wg&index=2&list=PLUl4u3cNGP62K2DjQLRxDNRi0z2IRWnNh} +% \end{column} +% \begin{column}{0.33\textwidth} +% \centering +% \includegraphics[width=\textwidth]{img/mit3} +% \burl{https://www.youtube.com/watch?v=xSQxaie_h1o&index=3&list=PLUl4u3cNGP62K2DjQLRxDNRi0z2IRWnNh} +% \end{column} +% \end{columns} +% \vfill\centering\alert{Optional!} +%\end{frame} + +\begin{frame} + \frametitle{Summary} + \begin{columns} + \begin{column}{.59\textwidth} + \begin{itemize} + \item Weird machines + \item Over-read, over-write + \item Change program flow + \item Mitigation techniques + \item Tools and other options + \end{itemize} + \end{column} + \begin{column}{.49\textwidth} + \centering\includegraphics[width=\textwidth]{img/take-away} + \end{column} + \end{columns} + %\centering\includegraphics[height=0.8\textheight]{img/summary} +\end{frame} + +\begin{frame} + \frametitle{Assignment questions \titlefloatright{(1/3)}} + \alert{1.} Suppose that the code below is compiled as follows: + \texttt{gcc -Wall -Werror -std=c99 main.c}. Provide two \alert{integer + inputs} that will result in `unintended behaviour' and name what this + threat is called. Make assumptions if necessary. + % Assume int is 4 bytes. + % - Number 1: 1 + % - Number 2: 2147483647 // 2^31 - 1 + % => 1+2147483647 <= 10 + % (integer overflow) + \begin{columns} + \begin{column}{0.59\textwidth} + \lstinputlisting[style=CStyle]{sample/assignment-integer-overflow.c} + \end{column} + \begin{column}{0.39\textwidth} + \vbox to .65\textheight{ + \vfill + \alert{2.} Determine which compiler option could be used to ensure + that the program aborts if such unintended behaviour occurs. Does + this solution work for \texttt{unsigned int}s? Why (not)? \\ + % -ftrapv: abort if signed integer overflow. Does not work for + % unsigned since overflow is well-defined and in many cases intended. + \vfill + \alert{3.} What is the compliant way of adding two unsigned integers + according to CERT C standard? + % §5.1.1.2, page 133 (find link to CERT C pdf in the slides) + % unsigned int ui_b, ui_a, sum; + % if (UINT_MAX - ui_a < ui_b) { + % /* handle error condition */ + % } else { + % sum = ui_a + ui_b; + % } + \vfill + } + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Assignment questions \titlefloatright{(2/3)}} + \alert{4.} Suppose that the code below is compiled as follows: \texttt{gcc + -Wall -Werror -std=c99 -fno-stack-protector main.c}. Explain the steps + necessary to trigger the print statement. Make assumptions if necessary. + % Assume that secret is 4 bytes and on a higher address than buf. + % Exploit: python -c 'print "\xff"*12' | ./a.out + \begin{columns} + \begin{column}{0.59\textwidth} + \lstinputlisting[style=CStyle]{sample/assignment-buffer-overflow.c} + \end{column} + \begin{column}{0.39\textwidth} + \vbox to .65\textheight{ + \vfill + \alert{5.} How would you adapt your strategy if \texttt{SECRET} was set + to \texttt{0xff0a0dff}? Explain principles. + % If we try to enter this value gets() will stop since CRLF. Instead + % we would have to overwrite the return address so that the program + % jumps to gotcha(). + \vfill + \alert{6.} Which type of buffer overflow mitigation technique does the + new secret value remind you of? + % Terminator-based stack canary + \vfill + \alert{7.} Explain two other mitigation techniques that make it harder + to execute code in a buffer overflow. + % - Address randomization: every time program executes all addresses + % are changed based on a cryptographically secure PRNG + % - Non-executable memory: halt program if instruction pointer takes + % on a value that corresponds to memory that should not be executed + % + % In other words: both of these techniques try to make it hard for + % the attacker to specify a return address that does not cause a crash + } + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \frametitle{Assignment questions \titlefloatright{(3/3)}} + \vfill + \alert{8.} Attackers may use \texttt{nop}-sleds to increase the likelihood of + jumping to their shell-code. To defend against this a colleague of yours + suggested that all user input be filtered for repeated \texttt{nop} + instructions. How would you trivially bypass such a filtering mechanism? + % Use other dummy instructions that increment instruction pointer, e.g., + % add, sub, mul, and write results to dummy register (not important). + \vfill + \alert{9.} What is the difference between static and dynamic code analysis?\\ + % Static code analysis takes place _before_ a program is being executed. + % Conversely, dynamic code analysis examines what a program does at runtime. + \vfill + \alert{10.} Briefly explain the process of fuzzing a program: how does it work + and what is the goal? Name one fuzzer that found a buffer overflow + vulnerability in a TLS library. + % - How: supply lots and lots of funky input and see what happens; record + % errors % and examine in more detail later. + % - Goal: find untested cases that cause `unintended behaviour' + % - Example: American Fuzzy Lop (AFL) + \vfill + \alert{11.} Suppose that you are hired by a consultant company to work on a + brand new project. Explain the circumstances in which you would choose to + program in \texttt{C/C++}, and why you might choose a different programming + language in most other cases. + % C/C++: if low-level access to memory is _required_, i.e., there should + % be a very clear motivation why you must use C as opposed to Go,C#, ... + % Memory safe languages: would be chosen otherwise, since it is generally + % easier not to mess up the code. + \vfill +\end{frame} diff --git a/slides/2018-software-security/src/preamble.tex b/slides/2018-software-security/src/preamble.tex new file mode 100644 index 0000000..cd99ec4 --- /dev/null +++ b/slides/2018-software-security/src/preamble.tex @@ -0,0 +1,98 @@ +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +% Packages % +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +\usepackage[ + lambda, advantage, operators, sets, adversary, landau, probability, notions, + logic, ff, mm, primitives, events, complexity, asymptotics, keys +]{cryptocode} + +\usepackage{rotate} +\usepackage{graphicx} +\usepackage{mathtools} +\usepackage{amsmath} +\usepackage{amssymb} +\usepackage{flowchart} +\usepackage{smartdiagram} +\usepackage{pifont} +\usepackage{graphicx} +\usepackage{color} +\usepackage{drawstack} +\usepackage{tikz} +\usepackage{tikz-qtree} +\usetikzlibrary{ + arrows,% + decorations.markings,% + backgrounds,% + calc,% + fit,% + positioning,% + shapes.misc,% + shadows,% + shapes.arrows,% + shapes,% + snakes,% +} +\usepackage{booktabs} +\usepackage{smartdiagram} +%\usepackage{floatrow} +%\usepackage[position=bottom]{subfig} % environment for nested figures + +\usepackage{xcolor} +\definecolor{darkGreen}{HTML}{008000} +\definecolor{darkBlue}{HTML}{2809B2} +\definecolor{darkRed}{HTML}{CC0000} +\definecolor{darkGray}{HTML}{808080} +\definecolor{darkOrange}{HTML}{D77D00} +\definecolor{darkPurple}{HTML}{800080} +\colorlet{lightGray}{gray!33} +\colorlet{lightYellow}{yellow!50} +\definecolor{darkGreen}{HTML}{008000} +\definecolor{darkBlue}{HTML}{2809B2} +\definecolor{darkRed}{HTML}{CC0000} + +% Figures, tables and code +\usepackage{booktabs} +\usepackage{colortbl} +\usepackage{flowchart} +\usepackage{adjustbox} +\usepackage{listings} + +\lstdefinestyle{CStyle}{ + backgroundcolor=\color{lightGray!25}, + commentstyle=\color{darkGreen}, + keywordstyle=\color{darkBlue}, + numberstyle=\tiny\color{darkRed}, + stringstyle=\color{darkPurple}, + basicstyle=\footnotesize, + breakatwhitespace=false, + breaklines=false, + captionpos=b, + keepspaces=true, + numbers=left, + numbersep=5pt, + showspaces=false, + showstringspaces=false, + showtabs=false, + tabsize=2, + language=C, + morekeywords={size_t}, +} + +%\setbeamertemplate{itemize item}[circle] +%\setbeamertemplate{itemize subitem}[default] +%\setbeamertemplate{caption}[numbered] + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +% Defines % +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +\makeatletter +\let\@@magyar@captionfix\relax %needed for \titlefloatright +\makeatother + +\newcommand{\tyes}{\textcolor{darkGreen}{\ding{51}}} +\newcommand{\tno}{\textcolor{darkRed}{\ding{55}}} +\newcommand{\burl}[1]{\tiny{\url{#1}}} +\newcommand{\TODO}[1]{\textcolor{red}{TODO}: #1} +\newcommand{\titlefloatright}[1]{\hspace{0pt plus 1 filll}#1$\;$} + +\def\rding{\rotatebox[origin=c]{-90}{\ding{224}}} diff --git a/slides/2018-software-security/src/questions.tex b/slides/2018-software-security/src/questions.tex new file mode 100644 index 0000000..85cb2f3 --- /dev/null +++ b/slides/2018-software-security/src/questions.tex @@ -0,0 +1,17 @@ +\begin{frame} + \frametitle{Any questions?} \label{frm:que} + \begin{columns} + \begin{column}{0.49\textwidth} + \centering + \includegraphics[width=0.75\textwidth]{img/qleft} + \end{column} + \begin{column}{0.49\textwidth} + \centering + \includegraphics[width=0.75\textwidth]{img/qright} + \end{column} + \end{columns} + + \centering + \vspace{-1cm} + \includegraphics[width=0.20\textwidth]{img/ty} +\end{frame} diff --git a/slides/2018-software-security/src/titlepage.tex b/slides/2018-software-security/src/titlepage.tex new file mode 100644 index 0000000..9b18039 --- /dev/null +++ b/slides/2018-software-security/src/titlepage.tex @@ -0,0 +1,3 @@ +\begin{frame} + \titlepage +\end{frame} -- cgit v1.2.3