path: root/slides/2018-software-security/src/body.tex

\begin{frame}
\frametitle{Learning outcomes}
  \vfill\centering
  \smartdiagramset{
    sequence item height=1.75cm,
    sequence item width=2.5cm,
    sequence item text width = 2.4cm,
  }
  \smartdiagram[sequence diagram]{%
    What is software security,%
    Software security gone wrong,%
    Buffer overflows and
    defenses%
  }
  \pause
  \vfill\centering\textbf{Already covered here or elsewhere:} least privilege,
    modern crypto, use secure APIs, pass strings to complex subsystems with
    care, do unit testing, security audits, ...
\end{frame}

\begin{frame}
  \frametitle{Be aware of other common coding mistakes not covered here}
  \centering\includegraphics[width=\textwidth]{img/cwe}
  \burl{https://cwe.mitre.org/data/definitions/699.html}
\end{frame}

\begin{frame}
  \frametitle{Software vulnerabilities pay\titlefloatright{Zerodium's program}}
  \centering\includegraphics[height=0.8\textheight]{img/zerodium}\\
  \burl{https://zerodium.com/program.html}
\end{frame}

\begin{frame}
  \frametitle{Software vulnerabilities pay\titlefloatright{Google's 
    program}}
  \centering\includegraphics[height=0.8\textheight]{img/google-rewards}\\
  \burl{https://www.google.com/about/appsecurity/reward-program/index.html}
\end{frame}


\begin{frame}
  \frametitle{%
    What is software security about?%
    \titlefloatright{%
      Weird machines\footnote{\burl{https://en.wikipedia.org/wiki/Weird_machine}}%
    }%
  }
  \centering
  \includegraphics[height=0.4\textheight]{img/weird-machine}
  \\\vfill
  Security properties and threat model $\rightarrow$
  program should work as intended
\end{frame}

\begin{frame}
  \frametitle{Can you spell software vulnerability? \titlefloatright{BUG}}
  \centering\includegraphics[height=0.5\textheight]{img/real-bug}
  % REMEMBER@bug: bad composition, implementation error, logical error
\end{frame}

\begin{frame}
  %REMEMBER@bad comp: Mat Honan
  \frametitle{Bad composition \titlefloatright{Gmail password
    reset\footnote{%
      \burl{https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/}
      \titlefloatright{Credit: Nickolai Zeldovich and James Mickens}
    }}}
  \centering
  \begin{tikzpicture}
    \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm,
      minimum height=2cm](gmail) at (0,0) {%
        \begin{tabular}{c}
          \textbf{Gmail reset}\\
          \begin{tabular}{l}
            \textbf{-} use backup mail\\
            \textbf{-} \texttt{m****n@me.com}\\
            \\
          \end{tabular}
        \end{tabular}
      };
    \pause

    \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm,
      minimum height=2cm, below=1cm of gmail](appleid) {%
        \begin{tabular}{c}
          \textbf{AppleID reset}\\
          \begin{tabular}{l}
            \textbf{-} mail address\\
            \textbf{-} billing address\\
            \textbf{-} last four in CC\\
          \end{tabular}
        \end{tabular}
      };
    \pause

    \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm,
      minimum height=2cm, right=3cm of gmail](amazon) {%
        \begin{tabular}{c}
          \textbf{Amazon reset}\\
          \begin{tabular}{l}
            \textbf{-} name \\
            \textbf{-} billing address\\
            \textbf{-} CC number\\
          \end{tabular}
        \end{tabular}
      };
    \pause

    \node[draw=gray, rounded rectangle, fill=gray!25, minimum width=4cm,
      minimum height=2cm, below=1cm of amazon](amazonadd) {%
        \begin{tabular}{c}
          \textbf{Amazon add CC}\\
          \begin{tabular}{l}
            \textbf{-} name \\
            \textbf{-} mail address\\
            \textbf{-} billing address\\
          \end{tabular}
        \end{tabular}
      };
      
    \pause
    \path[draw,thick,-latex]
      (amazonadd) --
        node[draw=none,right]{precaution\footnotemark}
      (amazon);
    \pause
    \path[draw,thick,-latex] (amazon) -- (appleid);
    \pause
    \path[draw,thick,-latex] (appleid) -- (gmail);
  \end{tikzpicture}
  \footnotetext{\tiny{Obfuscate CC, s.t., only last last 4 CC digits are shown}}
\end{frame}

\begin{frame}
  \frametitle{Implementation error\titlefloatright{%
    iCloud hack\footnote{%
      \burl{https://github.com/hackappcom/ibrute}
      \titlefloatright{Credit: Nickolai Zeldovich and James Mickens}
  }}}
  \centering
  \begin{tikzpicture}
    \node[draw=gray, thick, rounded rectangle, minimum width=4cm, minimum 
      height=2cm, fill=gray!25] (icloud) at (0,0) {iCloud};
    \node[draw=none, left=2cm of icloud](ifile) {Files};
    \node[draw=none, above=1cm of icloud](ifeature) {Other features};
    \coordinate(imid) at ($ (ifile.north) !.5! (ifeature) $);
    \node[draw=none] (isharing) at ($ (imid) + (-.75,.5) $) {Sharing};
    \node[draw=none, right=2cm of icloud](ifind) {%
      \begin{tabular}{c}
        Find my\\
        iPhone
      \end{tabular}
    };
    \path[draw, -latex] (ifile) -- (icloud);
    \path[draw, -latex] (isharing) -- (icloud);
    \path[draw, -latex] (ifeature) -- (icloud);
    \path[draw, -latex] (ifind) -- (icloud);
  \end{tikzpicture}
  \pause
  \vfill
  \begin{columns}
    \begin{column}{0.49\textwidth}
      \vbox to .2\textheight{
        \vfill
        \begin{itemize}
          \item User must login to use a feature
          \pause
          \item \textbf{Rate limited login attempts?}
        \end{itemize}
        \vfill
      }
    \end{column}
    \begin{column}{0.49\textwidth}
      \vbox to .2\textheight{
        \vfill
        Files, sharing, other features?
          \titlefloatright{\textcolor{darkGreen}{Yep}}\\
        \pause
        Find my iPhone...?
          \titlefloatright{\textcolor{darkRed}{Nop}}
        \vfill
      }
    \end{column}
  \end{columns}
  \pause
  \vfill
  \alert{Lesson learned: the importance of testing against abnormal behaviour}
\end{frame}

\begin{frame}
  \frametitle{Implementation error\titlefloatright{Subject
    names and TLS\footnote{%
      \burl{https://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatSSL-PAPER1.pdf}
    }}}
  \begin{columns}
    \begin{column}{0.59\textwidth}
      \begin{itemize}
        \item TLS certificate: identity-to-key binding
        \pause
        \item Subject name? Pascal string
          \begin{itemize}
            \item Length followed by characters
          \end{itemize}
        \pause
        \item Many TLS implementations? C string
          \begin{itemize}
            \item Characters with null-termination
          \end{itemize}
      \end{itemize}
    \end{column}
    \pause
    \begin{column}{0.39\textwidth}
      \includegraphics[width=\textwidth]{img/bad-encode}
    \end{column}
  \end{columns}
  \pause
  \vfill\centering\alert{Lesson learned: only process data at uniform formats}
\end{frame}

\begin{frame}
  \frametitle{The bad news :/}
  \begin{columns}
    \begin{column}{0.59\textwidth}
      \begin{itemize}
        \item Much software is written in \texttt{C}/\texttt{C++}
        \item Recipe for disaster:
          \begin{itemize}
            \item Exposure to raw memory addresses
            \item No built-in bound checking and safety
            \item Operate on untrusted user input
          \end{itemize}
        \item Why?
      \end{itemize}
    \end{column}
    \begin{column}{0.39\textwidth}
      \centering\includegraphics[height=0.6\textheight]{img/clang}\\
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}
  \frametitle{It is easy to get wrong \titlefloatright{1/2}}
  \vfill
  \begin{columns}
    \begin{column}{0.33\textwidth}
      \vbox to .4\textheight{
        \centering
        \lstinputlisting[style=CStyle]{sample/bad-index.c}
        \vfill
        Problem? \\
        \pause
        \textbf{over-read} \\
        \pause
      }
    \end{column}
    \begin{column}{0.33\textwidth}
      \vbox to .4\textheight{
        \centering
        \lstinputlisting[style=CStyle]{sample/bad-index2.c}
        \vfill
        Problem? \\
        \pause
        \textbf{over-write} \\
        \pause
      }
    \end{column}
    \begin{column}{0.33\textwidth}
      \vbox to .4\textheight{
        \centering
        \lstinputlisting[style=CStyle]{sample/bad-printf.c}
        \vfill
        Problem? \\
        \pause
        \textbf{over-read} \\
      }
    \end{column}
  \end{columns}
  \vfill
\end{frame}

\begin{frame}
  \frametitle{It is easy to get wrong \titlefloatright{2/2}}
  \vfill
  \begin{columns}
    \begin{column}{0.49\textwidth}
      \vbox to .6\textheight{
        \centering
        \lstinputlisting[style=CStyle]{sample/bad-call.c}
        \vfill
        Problem? \\
        \pause
        \textbf{over-write}
        \pause
      }
    \end{column}
    \begin{column}{0.49\textwidth}
      \vbox to .6\textheight{
        \centering
        \lstinputlisting[style=CStyle]{sample/bad-add.c}
        \vfill
        Problem? \\
        \pause
        \textbf{over-write}
      }
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}
  \frametitle{A famous over-read in OpenSSL\titlefloatright{%
    Heartbleed bug%
    \includegraphics[height=16pt]{img/heartbleed}%
  }}
  \begin{columns}
    \begin{column}{0.49\textwidth}
      \includegraphics[width=\textwidth]{img/hb1}
      \includegraphics[width=\textwidth]{img/hb2}
      \includegraphics[width=\textwidth]{img/hb3}
    \end{column}
    \begin{column}{0.49\textwidth}
      \includegraphics[width=\textwidth]{img/hb4}
      \includegraphics[width=\textwidth]{img/hb5}
      \includegraphics[width=\textwidth]{img/hb6}
    \end{column}
  \end{columns}
  \vfill\centering\burl{https://xkcd.com/1354/}
  %REMEMBER@after heartbleed: transition -> easy bug, not the typical case.  Usually, attckers exploit buffer overflows (i.e., write outside of buffer boundaries) to change the program flow, e.g., by changing the value of adjacent variables. In extreme cases, entirely new functionality can be inserted - hello world program with buf overflow -> delete files...  This is what we will work towards now.
\end{frame}

\begin{frame}
  %REMEMBER: explain stack briefly, and paint everything on board - local vars
  \frametitle{Buffer overflow \titlefloatright{Stack}}
  \begin{columns}
    \begin{column}{0.59\textwidth}
      \lstinputlisting[style=CStyle]{sample/bo-stack.c}
    \end{column}
    \pause
    \begin{column}{0.39\textwidth}
      \begin{itemize}
        \item Input 1: Neal \ding{224} \textcolor{darkRed}{reject}
        \pause
        \item Input 2: Caffrey \ding{224} \textcolor{darkRed}{reject}
        \pause
        \item Input 3: Overflow! \ding{224} \textcolor{darkGreen}{accept}
        \pause
      \end{itemize}
    \end{column}
  \end{columns}
  \vfill\centering\alert{Buffer overflow occurs when writing outside of a buffer's boundaries}
\end{frame}

\begin{frame}
  %REMEMBER: explain heapy briefly, and paint everything on board - need var lifetime that is longer than function lifetime
  \frametitle{Buffer overflow \titlefloatright{Heap}}
  \begin{columns}
    \begin{column}{0.59\textwidth}
      \lstinputlisting[style=CStyle]{sample/bo-heap.c}
    \end{column}
    \pause
    \begin{column}{0.39\textwidth}
      \begin{itemize}
        \item Input 1: Neal \ding{224} \textcolor{darkRed}{reject}
        \pause
        \item Input 2: Caffrey \ding{224} \textcolor{darkRed}{reject}
        \pause
        \item Input 3: aaa...aaa \ding{224} \textcolor{darkGreen}{accept}
      \end{itemize}
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}
  % Just to make sure that everyone is on the same page now, and work towards stack frames
  \frametitle{Memory layout}
  \begin{columns}
    \begin{column}{0.59\textwidth}
      \begin{itemize}
        \item Heap grows towards higher addresses
          \begin{itemize}
            \item Manual memory (de)allocation
          \end{itemize}
        \item Stack grows towards lower addresses
          \begin{itemize}
            \item Automatic memory (de)allocation
            \item Each function has a `stack frame'
          \end{itemize}
        \item Data: e.g., global and static variables
        \item Code: instructions that CPU can process
      \end{itemize}
    \end{column}
    \begin{column}{0.39\textwidth}
      \centering\includegraphics[height=0.6\textheight]{img/memlay}
    \end{column}
  \end{columns}
  %\pause
  %\vfill\centering\alert{Note: each process has its own virtual memory that
  %  is translated to physical memory}
\end{frame}

\begin{frame}
  \frametitle{Stack frames}
  \begin{columns}
    \begin{column}{0.49\textwidth}
      \lstinputlisting[style=CStyle]{sample/stack-frame.c}
    \end{column}
    \begin{column}{0.49\textwidth}
        Each function gets its own stack frame
        \begin{itemize}
          \item Local variables
          \item Function parameters
          \item Housekeeping such as:
            \begin{itemize}
              \item Return address
              \item Register values
            \end{itemize}
        \end{itemize}
        \vspace{12pt}
        \alert{Push ordering} \ding{224}
        \alert{see calling conventions}
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}
  \frametitle{Pushing an popping stack frames}
  \begin{columns}
    \begin{column}{0.166\textwidth}
      \begin{drawstack}[scale=0.5]
        \cell{algorithm}
      \end{drawstack}
    \end{column}
    \begin{column}{0.166\textwidth}
      \begin{drawstack}[scale=0.5]
        \cell{algorithm}
        \cell{sub}
      \end{drawstack}
    \end{column}
    \begin{column}{0.166\textwidth}
      \begin{drawstack}[scale=0.5]
        \cell{algorithm}
        \cell{sub}
        \cell{add}
      \end{drawstack}
    \end{column}
    \begin{column}{0.166\textwidth}
      \begin{drawstack}[scale=0.5]
        \cell{algorithm}
        \cell{sub}
      \end{drawstack}
    \end{column}
    \begin{column}{0.166\textwidth}
      \begin{drawstack}[scale=0.5]
        \cell{algorithm}
      \end{drawstack}
    \end{column}
    \begin{column}{0.166\textwidth}
      \begin{drawstack}[scale=0.5]
        \cell{algorithm}
        \cell{printf}
      \end{drawstack}
    \end{column}
  \end{columns}
  \vfill\centering\alert{Return to caller's context using housekeeping
    information}
\end{frame}

\begin{frame}
  \frametitle{Buffer overflow on the stack continued \titlefloatright{(1/2)}}
  \begin{columns}
    \begin{column}{0.59\textwidth}
      \lstinputlisting[style=CStyle]{sample/bo-stack.c}
    \end{column}
    \begin{column}{0.39\textwidth}
      \begin{itemize}
        \item Input 4: aaa...aaa \ding{224} \textcolor{darkRed}{segfault}
        \item Why not segfault on heap?
        \item Why segfault on stack?
      \end{itemize}
    \end{column}
  \end{columns}
\end{frame}


\begin{frame}
  \frametitle{Buffer overflow on the stack continued \titlefloatright{(2/2)}}
  \begin{columns}
    \begin{column}{0.49\textwidth}
      %\lstinputlisting[style=CStyle,firstline=3,lastline=4,numbers=none]{%
      %  sample/bo-stack.c
      %}
      \lstinputlisting[style=CStyle]{sample/bo-stack.c}
    \end{column}
    \begin{column}{0.49\textwidth}
      \centering
      \begin{drawstack}[scale=0.5]
        \cell{RA} \cellcomL{\scriptsize{0x...\textcolor{darkRed}{32}}}
        \cell{\texttt{verified}}
          \cellcomL{\scriptsize{0x...\textcolor{darkRed}{28}}}
        \padding{3}{%
          \begin{tabular}{c}
            \texttt{buf[7]} \\
            ... \\
            \texttt{buf[0]} \\
            \end{tabular}
        } \cellcomL{\scriptsize{0x...\textcolor{darkRed}{20}}}
      \end{drawstack}
    \end{column}
  \end{columns}
  \pause
  \centering\vfill\alert{%
    Can we solve the problem by pushing \texttt{buf} first?%
  }
\end{frame}

\begin{frame}
  \frametitle{Buffer overflow that leads to code execution}
  \centering\includegraphics[height=0.6\textheight]{img/demo}
\end{frame}

\begin{frame}
  \frametitle{Summary of principles for stack smashing attacks}
  \centering\includegraphics[height=0.6\textheight]{img/stack-smashing}\\
  \vfill
  \alert{1.} Gain control of return address
  \titlefloatright{\alert{2.} Point to some malicious code}
\end{frame}

\begin{frame}
  \frametitle{The hard part is jumping to malicious code \titlefloatright{`In the buffer'}}
  \begin{columns}
    \begin{column}{0.49\textwidth}
      \begin{enumerate}
        \item Add asm instructions in the buffer
          \begin{itemize}
            \item Usually to open a shell
            \item `Shell-code'
          \end{itemize}
        \item Jump to the buffer's shell-code
      \end{enumerate}
      \vspace{1cm}\centering
      Exact address of buffer?\\
      \rding\\
      Use a nop-sled
    \end{column}
    \begin{column}{0.49\textwidth}
      \centering
      \begin{tikzpicture}[scale=0.5]
        \stacktop{}
          % cells
          \cell{RA} \coordinate (ra) at (currentcell.east);
          \cell{shell code} \coordinate (sc) at (currentcell.west);
          \bcell{\texttt{nop}} \coordinate(nopl) at (currentcell.west);
          \bcell{...} \coordinate(nopm) at (currentcell.east);
          \bcell{\texttt{nop}} \coordinate(nopf) at (currentcell.west);
            \cellptr{\texttt{\&buf[0]}}
          % air plane
          \coordinate(mid) at ($ (nopl) !.5! (nopf) $);
          \node(plane) at ($ (mid) + (-2,0) $){%
            \includegraphics[width=45pt]{img/air-plane}
          };
          % edges
          \path[draw=darkRed,-latex,rounded corners,dashed,thick]
            (ra) -- ($ (ra) + (2,0) $) |- (nopm);
        \stackbottom{}
      \end{tikzpicture}
    \end{column}
  \end{columns}
  \pause
  \centering\vfill\alert{%
    Note: nop-sled + asm may also be injected to the heap---`heap spraying'
  }
\end{frame}

\begin{frame}
  \frametitle{The hard part is jumping to malicious code \titlefloatright{%
    `Return-to-libc'}}
  \begin{columns}
    \begin{column}{0.49\textwidth}
      \begin{enumerate}
        \item Point to an already loaded function
          \begin{itemize}
            \item \texttt{system()}
          \end{itemize}
        \item Prepare stack with arguments
          \begin{itemize}
            \item \texttt{"rm -rf /home/\$USER"}
          \end{itemize}
      \end{enumerate}
      \vspace{12pt}
      \ding{224}\texttt{system("rm -rf /home/\$USER")}
    \end{column}
    \pause
    \begin{column}{0.49\textwidth}
      \centering\includegraphics[height=0.45\textheight]{img/libc}
    \end{column}
  \end{columns}
  \vfill
  \lstinputlisting[style=CStyle,numbers=none]{sample/ldd}
\end{frame}

\begin{frame}
  \frametitle{Widely used stack smashing mitigation techniques}
  \textbf{Idea:} try to prevent the two necessary stack smashing conditions from
    meeting met
  \vfill
  \pause
  \begin{itemize}
    \item<2-> Address randomization \titlefloatright{Increases jump uncertainty}
    \item<3-> Non-executable memory \titlefloatright{Stop if instruction pointer
      gets here}
    \item<4-> Stack canaries \titlefloatright{Stop if RA got tampered with}
  \end{itemize}
  \vfill
  \lstinputlisting[style=CStyle,numbers=none]{sample/ldd2}
\end{frame}

\begin{frame}
  \frametitle{Canaries}
  \begin{columns}
    \begin{column}{0.49\textwidth}
      \centering
      \vbox to .8\textheight{
        \vfill
        \begin{quote}
          `` [...] miners would bring a caged canary into new coal seams. Canaries
          are especially sensitive to methane and carbon monoxide [...], as long
          as the bird kept singing, the miners knew their air supply was safe.''
        \end{quote}
        \vfill
        \begin{quote}
          ``\textbf{Short but meaningful}''
        \end{quote}
        \vfill
      }
    \end{column}
    \begin{column}{0.49\textwidth}
      \centering
      \includegraphics[height=0.8\textheight]{img/canary-bird}\\
      \centering\burl{https://www.wisegeek.com/what-does-it-mean-to-be-a-canary-in-a-coal-mine.htm}
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}
  \frametitle{Stack canaries \titlefloatright{Before overflow}}
  \centering
  \includegraphics[width=0.95\textwidth]{img/canary-before}
  \vfill
  \begin{columns}
    \begin{column}{0.49\textwidth}
      \begin{itemize}
        \item Terminator canaries
        \item Random canaries
        \item ...
      \end{itemize}
    \end{column}
    \begin{column}{0.49\textwidth}
      \centering
      \textbf{Require:}\\
      CY must be valid to use RA
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}
  \frametitle{Stack canaries \titlefloatright{After overflow}}
  \centering
  \includegraphics[width=0.8\textwidth]{img/canary-after}
  \vfill
  \textbf{Stop running---invalid canary value!}
  \pause
  \vfill
  \vfill\centering\alert{Can anyone think of examples where the two canary
    types fail?}
  % == stack ==
  % - local variable which is a function pointer gets overwritten; when
  % called the attacker's function is used instead
  % - somehow extract random canary value from memory or rewrite it
  % - guess canary, e.g., due to bad randomness
  % == terminator ==
  % - you have a double buffer overflow vulnerability: first you overwrite as
  % normal to hit RA, then subsequently you `repair' the predictable canary
\end{frame}

\begin{frame}
  \frametitle{Great mitigation techniques, but we realize that...}
  \centering\Huge{%
    it is still imperfect
    \vfill
    What else can we do?
  }
  \pause
  \vfill
  \normalsize
  \begin{columns}
    \begin{column}{0.33\textwidth}
      \begin{itemize}
        \item Avoid bugs in C/C++ code
      \end{itemize}
    \end{column}
    \begin{column}{0.33\textwidth}
      \begin{itemize}
        \item Build and use tools that help catching bugs
      \end{itemize}
    \end{column}
    \begin{column}{0.33\textwidth}
      \begin{itemize}
        \item Use memory safe programming languages
      \end{itemize}
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}
  \frametitle{Avoid bugs in C/C\texttt{++} code}
  \begin{columns}
    \begin{column}{0.59\textwidth}
      \begin{itemize}
        \item Sanitize all untrusted user input
        \item Manually verify all bounds \alert{correctly}
        \item Be aware of integer underflow/overflow
        \item Use safe(r) functions and learn caveats
          \begin{itemize}
            \item \texttt{fgets} vs.\ \texttt{gets}
            \item \texttt{strncpy} vs.\ \texttt{strcpy}
            \item \texttt{man strncpy} \ding{224} null-termination?
          \end{itemize}
        \item \textbf{Adopt a secure coding standard}
          \begin{itemize}
            \item CERT C\footnotemark
            \item MISRA C\footnotemark  (embedded systems)
          \end{itemize}
      \end{itemize}
    \end{column}
    \begin{column}{0.39\textwidth}
      \centering\includegraphics[height=0.6\textheight]{img/checklist}
    \end{column}
  \end{columns}
  \footnotetext[6]{\burl{https://resources.sei.cmu.edu/downloads/secure-coding/assets/sei-cert-c-coding-standard-2016-v01.pdf}}
  \footnotetext{\burl{https://www.misra.org.uk/Activities/MISRAC/tabid/160/Default.aspx}}
\end{frame}


\begin{frame}
  \frametitle{Build and use tools that help catching bugs \titlefloatright{%
    Static analysis%
    \footnote{\burl{https://www.perforce.com/blog/qac/what-static-code-analysis}}
  }}
  \begin{columns}
    \begin{column}{0.69\textwidth}
      \begin{itemize}
        \item Automated source code analysis \alert{before} runtime
        \item Output warnings if errors are suspected
        \item Assess compliance with coding standards
      \end{itemize}
    \end{column}
    \begin{column}{0.39\textwidth}
      \vbox to .7\textheight{%
        \centering
        \lstinputlisting[style=CStyle]{sample/static-analysis.c}
        \texttt{\$ splint main.c} \\
        \ding{224} 3 non-gcc warnings
        \vfill
        \tiny{\alert{Details:}} \burl{https://www.splint.org/}
      }
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}
  \frametitle{Build and use tools that help catching bugs \titlefloatright{Dynamic
    analysis}}
  \begin{columns}
    \begin{column}{0.59\textwidth}
      \begin{itemize}
        \item Analyze what program does at \alert{runtime}
        \item Valgrind---look for memory errors
        \item Fuzzing\footnotemark---what happens on funky input?
          \begin{itemize}
            \item<2-> Random and mutation-based
            \item<3-> Structure-aware
            \item<4-> Program-aware
            \item<5-> Automated feedback loops
            \item<6-> ...
          \end{itemize}
      \end{itemize}
    \end{column}
    \begin{column}{0.39\textwidth}
      \vbox to .8\textheight{
        \vfill\centering
        \includegraphics[width=\textwidth]{img/afl.jpg}
        \burl{https://upload.wikimedia.org/wikipedia/commons/0/08/Rabbit_american_fuzzy_lop_buck_white.jpg}
        \vfill
      }
    \end{column}
  \end{columns}
  \footnotetext{\tiny{Brief introduction and a few demos:}
    \burl{https://www.youtube.com/watch?v=dMmsPwkSqOc}}
\end{frame}

\begin{frame}
  \frametitle{Is fuzzing worth the effort? \titlefloatright{American Fuzzer Lop
    (AFL)}}
  \centering
  \includegraphics[width=0.8\textwidth]{img/afl}\\
  \burl{http://lcamtuf.coredump.cx/afl/}
  \vfill\normalsize\alert{And around 120 more projects!}
\end{frame}

\begin{frame}
  \frametitle{Use memory-safe programming languages}
  \begin{columns}
    \begin{column}{0.59\textwidth}
      \vbox to 0.5\textheight{%
        \textbf{Intuition:} \texttt{x[y] = z} should stop normal program
          execution if \texttt{x} is non-array or \texttt{y} is out-of-range,
          and you should not operate on raw memory addresses\footnotemark
        \vfill
        \only<2->{
        \textbf{Challenges:}
        \begin{itemize}
          \item You need low-level access to hardware
          \item You inherit a large \texttt{C}/\texttt{C++} project
          \item Someone must implement the core correctly
        \end{itemize}
        }
      }
    \end{column}
    \begin{column}{0.39\textwidth}
      \begin{tikzpicture}
        \node[draw=none](first) at (0,0) {%
          \includegraphics[height=2cm]{img/memory-safe/go}
          \includegraphics[height=2cm]{img/memory-safe/rust}
        };
        \node[draw=none, below =0pt of first] (second) {%
          \includegraphics[height=1cm]{img/memory-safe/python}
        };
        \node[draw=none, below =0pt of second] (third) {%
          \includegraphics[height=1.5cm]{img/memory-safe/java}
        };
        \coordinate(mycord) at ($ (first.east) !.5! (third.east) $);
        \node[draw=none](fourth) at ($ (mycord) !.5! (third) $) {%
          \hspace{2cm}\huge{\texttt{C\#}}
        };
      \end{tikzpicture}
    \end{column}
  \end{columns}
  \vfill
  \centering
  \begin{description}
    \item<3->[\alert{What about performance?}] \alert{Is it a valid concern?}
  \end{description}
  \footnotetext{\tiny{If you want a more precise intuition:}
    \burl{http://www.pl-enthusiast.net/2014/07/21/memory-safety/}
  }
\end{frame}

%\begin{frame}
%  \frametitle{Take a deeper dive into buffer overflow vulnerabilities and
%    defenses}
%  \vfill
%  \begin{columns}
%    \begin{column}{0.33\textwidth}
%      \centering
%      \includegraphics[width=\textwidth]{img/mit1}
%      \burl{https://www.youtube.com/watch?v=GqmQg-cszw4&list=PLUl4u3cNGP62K2DjQLRxDNRi0z2IRWnNh&index=1}
%    \end{column}
%    \begin{column}{0.33\textwidth}
%      \centering
%      \includegraphics[width=\textwidth]{img/mit2}
%      \burl{https://www.youtube.com/watch?v=r4KjHEgg9Wg&index=2&list=PLUl4u3cNGP62K2DjQLRxDNRi0z2IRWnNh}
%    \end{column}
%    \begin{column}{0.33\textwidth}
%      \centering
%      \includegraphics[width=\textwidth]{img/mit3}
%      \burl{https://www.youtube.com/watch?v=xSQxaie_h1o&index=3&list=PLUl4u3cNGP62K2DjQLRxDNRi0z2IRWnNh}
%    \end{column}
%  \end{columns}
%  \vfill\centering\alert{Optional!}
%\end{frame}

\begin{frame}
  \frametitle{Summary}
  \begin{columns}
    \begin{column}{.59\textwidth}
      \begin{itemize}
        \item Weird machines
        \item Over-read, over-write
        \item Change program flow
        \item Mitigation techniques
        \item Tools and other options
      \end{itemize}
    \end{column}
    \begin{column}{.49\textwidth}
      \centering\includegraphics[width=\textwidth]{img/take-away}
    \end{column}
  \end{columns}
  %\centering\includegraphics[height=0.8\textheight]{img/summary}
\end{frame}

\begin{frame}
  \frametitle{Assignment questions \titlefloatright{(1/3)}}
  \alert{1.} Suppose that the code below is compiled as follows:
    \texttt{gcc -Wall -Werror -std=c99 main.c}. Provide two \alert{integer
  inputs} that will result in `unintended behaviour' and name what this
  threat is called. Make assumptions if necessary.
  % Assume int is 4 bytes.
  % - Number 1: 1
  % - Number 2: 2147483647        // 2^31 - 1
  % => 1+2147483647 <= 10
  % (integer overflow)
  \begin{columns}
    \begin{column}{0.59\textwidth}
      \lstinputlisting[style=CStyle]{sample/assignment-integer-overflow.c}
    \end{column}
    \begin{column}{0.39\textwidth}
      \vbox to .65\textheight{
        \vfill
        \alert{2.} Determine which compiler option could be used to ensure
          that the program aborts if such unintended behaviour occurs. Does
          this solution work for \texttt{unsigned int}s? Why (not)? \\
          % -ftrapv: abort if signed integer overflow. Does not work for
          % unsigned since overflow is well-defined and in many cases intended.
        \vfill
        \alert{3.} What is the compliant way of adding two unsigned integers
          according to CERT C standard?
          % §5.1.1.2, page 133 (find link to CERT C pdf in the slides)
          %   unsigned int ui_b, ui_a, sum;
          %   if (UINT_MAX - ui_a < ui_b) {
          %       /* handle error condition */
          %   } else {
          %       sum = ui_a + ui_b;
          %   }
        \vfill
      }
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}
  \frametitle{Assignment questions \titlefloatright{(2/3)}}
  \alert{4.} Suppose that the code below is compiled as follows: \texttt{gcc
    -Wall -Werror -std=c99 -fno-stack-protector main.c}. Explain the steps
    necessary to trigger the print statement. Make assumptions if necessary.
    % Assume that secret is 4 bytes and on a higher address than buf.
    % Exploit: python -c 'print "\xff"*12' | ./a.out
  \begin{columns}
    \begin{column}{0.59\textwidth}
      \lstinputlisting[style=CStyle]{sample/assignment-buffer-overflow.c}
    \end{column}
    \begin{column}{0.39\textwidth}
      \vbox to .65\textheight{
        \vfill
        \alert{5.} How would you adapt your strategy if \texttt{SECRET} was set
          to \texttt{0xff0a0dff}? Explain principles.
          % If we try to enter this value gets() will stop since CRLF. Instead
          % we would have to overwrite the return address so that the program
          % jumps to gotcha().
        \vfill
        \alert{6.} Which type of buffer overflow mitigation technique does the
          new secret value remind you of?
          % Terminator-based stack canary
        \vfill
        \alert{7.} Explain two other mitigation techniques that make it harder
          to execute code in a buffer overflow.
          % - Address randomization: every time program executes all addresses
          % are changed based on a cryptographically secure PRNG
          % - Non-executable memory: halt program if instruction pointer takes
          % on a value that corresponds to memory that should not be executed
          % 
          % In other words: both of these techniques try to make it hard for
          % the attacker to specify a return address that does not cause a crash
      }
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}
  \frametitle{Assignment questions \titlefloatright{(3/3)}}
  \vfill
  \alert{8.} Attackers may use \texttt{nop}-sleds to increase the likelihood of
    jumping to their shell-code. To defend against this a colleague of yours
    suggested that all user input be filtered for repeated \texttt{nop}
    instructions. How would you trivially bypass such a filtering mechanism?
    % Use other dummy instructions that increment instruction pointer, e.g.,
    % add, sub, mul, and write results to dummy register (not important).
  \vfill
  \alert{9.} What is the difference between static and dynamic code analysis?\\
    % Static code analysis takes place _before_ a program is being executed.
    % Conversely, dynamic code analysis examines what a program does at runtime.
  \vfill
  \alert{10.} Briefly explain the process of fuzzing a program: how does it work
    and what is the goal? Name one fuzzer that found a buffer overflow
    vulnerability in a TLS library.
    % - How: supply lots and lots of funky input and see what happens; record
    % errors % and examine in more detail later.
    % - Goal: find untested cases that cause `unintended behaviour'
    % - Example: American Fuzzy Lop (AFL)
  \vfill
  \alert{11.} Suppose that you are hired by a consultant company to work on a
    brand new project. Explain the circumstances in which you would choose to
    program in \texttt{C/C++}, and why you might choose a different programming
    language in most other cases.
    % C/C++: if low-level access to memory is _required_, i.e., there should
    % be a very clear motivation why you must use C as opposed to Go,C#, ...
    % Memory safe languages: would be chosen otherwise, since it is generally
    % easier not to mess up the code.
  \vfill
\end{frame}