CS Computer Security Thirteenth topic: System attacks. defenses
|
|
- Tobias Malone
- 7 years ago
- Views:
Transcription
1 Overflows... Security case studies CS Computer Security Thirteenth topic: System attacks and defenses Hugh Anderson National University of Singapore School of Computing March/April, 2016 Hugh Anderson CS Computer Security Thirteenth topic: System attacks
2 System attacks
3 Outline Overflows... Security case studies 1 Overflows... Buffer overflow attacks Heartbleed (April 2014) 2 Security case studies DVD security Hugh Anderson CS Computer Security Thirteenth topic: System attacks
4 Outline Overflows... Security case studies 1 Overflows... Buffer overflow attacks Heartbleed (April 2014) 2 Security case studies DVD security Hugh Anderson CS Computer Security Thirteenth topic: System attacks
5 Outline Overflows... Security case studies Buffer overflow attacks Heartbleed (April 2014) 1 Overflows... Buffer overflow attacks Heartbleed (April 2014) 2 Security case studies DVD security Hugh Anderson CS Computer Security Thirteenth topic: System attacks
6 Windows (32-bit) memory allocation Several space options 0xffffffff 2G Option 3G Option 0xffffffff kernel 0xc xbfffffff 0x x7fffffff user 0x x The Kernel area of memory has the HAL, drivers, page tables... The User area contains your exe code, dlls, stacks...
7 Linux (32-bit) memory allocation 3G before kernel v2.6, 4G afterwards 0xffffffff 3G (before v2.6) 4G (after v2.6) 0xffffffff 0xc xbfffffff kernel 0x x7fffffff user 0x x The Kernel area of memory has drivers, system stacks, page tables... The User area contains executable code, libraries, stacks...
8 Windows process memory allocation...for 2G model... Windows user memory 0x x guard user 0x7fffffff 0x7ffeffff TEB, PEB, guard TEB and PEB are thread and process environment blocks. The 64K guard blocks are sacrificial... against bad pointer references.
9 Linux ELF format user segments Program, shared libraries, stack... Linux/ELF user memory stack bss data code malloc bss data code 0x x guard Program 0x C libraries 0x stack 0xbfffffff guard The malloc ed memory is above the program. As always, the stack grows downwards.
10 Memory attack 1: simple program (CS2107) Normal operation Buffer (512 bytes) Computer s Memory Arguments Variables Stack grows down... Stack Return address Overwrite the end of an array, with an "EGG" Computer s Memory Stack Arguments Variables Stack grows down... Return address
11 Smashing the stack - the payload! (CS2107) Contents of the payload Computer s Memory Stack The payload Multiple no op machine code Machine code for the exploit Multiple copies of Malicious return address
12 Payload code for an exploit A C program which calls a shell... #include <stdio.h> void main() { char *nm[2]; nm[0] = "/bin/sh"; nm[1] = NULL; execve(nm[0], nm, NULL); } movl string,string_addr movb $0x0,null_byte movl $0x0,null_addr movl $0xb,%eax movl string,%ebx leal string,%ecx leal null_string,%edx int $0x80 // OS call /bin/sh string goes here. At the left we see some C source code for running the program /bin/sh. On the right we see assembler code with extra OS nonsense removed. Note that the binary code program has zeroes in it, and these will have to be removed if strcpy is to copy the program onto the stack. We can use translations like: movb $0x0,null_byte xorl %eax,%eax movb eax, null_byte
13 Using the buffer overflow attack 3 examples of situations in which we can use it 1 A server (say a web server) that expects a query, and returns a response. The demo buffer overflow attack done in CS2107 was one of these. 2 A CGI/ASP or perl script inside a web server 3 A SUID root program on a UNIX system Example attack Find a program that has a buffer,... and that does not check its bounds. Then deliver an EGG to it to overflow the buffer. Overwrite stack return address with address of OUR code. The program then runs OUR code. Many attacks on Microsoft systems are based on various buffer overflow problems. CA W32/Blaster worm: The W32/Blaster worm exploits a vulnerability in Microsoft s DCOM RPC interface as described in VU# and CA Upon successful execution...
14 Overflows... Security case studies Buffer overflow attacks Heartbleed (April 2014) Memory attack 2: heap overflow (CS2107) The normal free() and merge... Chunk of free Chunk of free Merged (bigger) Chunk of free p[1] p[0] m[p[1]] is location that p1 points to. Chunk of in use Return this one: free() m[p[1]][1] Chunk of free Then merge the links (garbage collection) m[p[1]][0] is the forward pointer m[p[1]][1] is the backward pointer m[p[1]][0] Chunk of in use Chunk of in use Chunk of in use Note that merging involves setting m[p[1]][0] to have the value in p[0] The OS heap management software automatically rewrites the values of the forward and backward links, using the values in the next links. Hugh Anderson CS Computer Security Thirteenth topic: System attacks
15 Overflows... Security case studies Buffer overflow attacks Heartbleed (April 2014) Memory attack 2: heap overflow (CS2107) Consider the scenario where attacker changes pointers... Chunk of free Chunk of free Links all messed up now... Address of bad code Address of return vector Address of bad code Address of return vector The garbage collector writes the address of the bad code into the return vector. Chunk of in use Return this one: free() Chunk of in use Then merge the links (garbage collection) Later the return instruction is done (same as in buffer overflow), and the system starts executing bad code. Chunk of in use Chunk of in use Chunk of in use The attacker uses the OS GC to write the address of malicious code into a return-address location, as for the buffer overflow. Hugh Anderson CS Computer Security Thirteenth topic: System attacks
16 Stack, heap protection Three methods to make buffer overflow attacks harder: 1 Not allow execution of code in the stack segment (as in MacOSX/openBSD). 2 Randomly move the starting stack for processes. 3 Put a value just below the return address (a canary), and check it before doing a return from subroutine. It is hard to overwrite the return address without overwriting the canary. The Memory/Mitigations paper from CS2107 is relevant here - I will bring a copy of it to class. Windows 7 includes a wide range of protection against stack/heap overflows: They include the removal of commonly targeted data structures, heap entry metadata randomization, header is more complex, there are randomized heap base addresses, function pointer are encoded, as well as the normal DEP and ASLR.
17 Outline Overflows... Security case studies Buffer overflow attacks Heartbleed (April 2014) 1 Overflows... Buffer overflow attacks Heartbleed (April 2014) 2 Security case studies DVD security Hugh Anderson CS Computer Security Thirteenth topic: System attacks
18 OpenSSL Heartbeat What is a heartbeat in openssl? A heartbeat is a recent (February 2012) extension to TLS, to allow a client to check if a TLS server is still alive (rather than tearing down a connection and renegotiating). It is described in The general idea is that clients can request a heartbeat, sending a heartbeat_request message with this structure: struct { HeartbeatMessageType type; uint16 payload_length; opaque payload[payload_length];... } HeartbeatMessage; The server will send back the payload in a matching heartbeat_response. What is the issue? What if the client lied about the payload_length?
19 OpenSSL Heartbeat, Hearts bleed Request and response different...
20 OpenSSL Heartbeat Original openssl-1.0.1f/ssl/d1_both.c... /* Read type and payload length first */ hbtype = *p++; n2s(p, payload); pl = p;... The original source gets the type from the record that p points to, and puts it into hbtype. It then copies the next two bytes into the variable payload. This is the length of the payload, and is done without checking. The variable pl is the actual payload, which is later echoed, using the length value without any more checking. Fixed openssl-1.0.1g/ssl/d1_both.c... /* Read type and payload length first */ hbtype = *p++; n2s(p, payload); if ( payload + 16 > s->s3->rrec.length) return 0; /* silently discard */ pl = p;... (There is a little more, but that is the general idea).
21 Outline Overflows... Security case studies DVD security 1 Overflows... Buffer overflow attacks Heartbleed (April 2014) 2 Security case studies DVD security Hugh Anderson CS Computer Security Thirteenth topic: System attacks
22 DVD security What is the point of DVD regions? The DVD CSS is a Content Scrambling System - data encryption scheme, developed by commercial interests to stop copying... but it is easy to copy a DVD: CSS only prevents decrypting, changing and re-recording. The CSS algorithm details are a trade secret. There is a master set of 400 keys stored on every DVD, and the DVD player uses these to generate a key needed to decrypt data from the disc. LINUX and the CSS Linux users were excluded from access to CSS licenses because of the open-source nature of Linux. The source code for decoding DVDs is available on a T-shirt, because in October 1999, hobbyists/hackers in Europe cracked the CSS algorithm. Since then DVD industry players have been trying to prevent distribution of any software
23 DVD security What do we learn? The lesson to learn from this is that security-through-obscurity is a very poor strategy. The source code and detailed descriptions for a CSS descrambler is available at: dst/decss/gallery/ Description of the key/descrambling process: First one must have a master key, which is unique to the DVD player manufacturer. It is also known as a player key. The player reads an encrypted disk key from the DVD, and uses its player key to decrypt the disk key. Then the player reads the encrypted title key for the file to be played. (The DVD will likely contain multiple files, typically 4 to 8, each with its own title key.) It uses the decrypted disk key (DK) to decrypt the title key. Finally, the decrypted title key, TK, is used to descramble the actual content.
24 DVD security Confusion and diffusion... #define m(i)(x[i]^s[i+84])<< unsigned char x[5],y,s[2048];main(n){for(read(0,x,5);read(0,s,n=2048); write(1,s,n))if(s[y=s[13]%8+20]/16%4==1){int i=m(1)17^256+m(0)8,k=m(2) 0,j=m(4)17^m(3)9^k *2-k%8^8,a=0,c=26;for(s[y]-=16;--c;j*=2) a=a*2^i&1,i=i/2^j&1<<24;for(j=127;++j<n ;c=c>y)c+=y=i^i/8^i>>4^ i>>12,i=i>>8^y<<17,a^=a>>14,y=a^a*8^a<<6,a=a>>8^y<<9,k=s [j],k="7 Wo~ G_\216"[k&7]+2^"cr3sfw6v;*k+>/n."[k>>4]*2^k*257/8,s[j]=k^(k&k *2&34) *6^c+~y;}}
Heartbleed. or: I read the news, too. Martin R. Albrecht. Information Security Group, Royal Holloway, University of London
Heartbleed or: I read the news, too Martin R. Albrecht Information Security Group, Royal Holloway, University of London XKCD #1354 XKCD #1354 XKCD #1354 XKCD #1354 XKCD #1354 XKCD #1354 RFC 6520: Transport
More informationRecent (2014) vulnerabilities in SSL implementations. Leiden University. The university to discover.
Recent (2014) vulnerabilities in SSL implementations Introduction We will discuss two vulnerabilities in SSL implementations that were found in 2014: The Apple bug, affecting recent Mac OS X and ios devices.
More informationSoftware security. Buffer overflow attacks SQL injections. Lecture 11 EIT060 Computer Security
Software security Buffer overflow attacks SQL injections Lecture 11 EIT060 Computer Security Buffer overflow attacks Buffer overrun is another common term Definition A condition at an interface under which
More informationSoftware Vulnerabilities
Software Vulnerabilities -- stack overflow Code based security Code based security discusses typical vulnerabilities made by programmers that can be exploited by miscreants Implementing safe software in
More informationUnix Security Technologies. Pete Markowsky <peterm[at] ccs.neu.edu>
Unix Security Technologies Pete Markowsky What is this about? The goal of this CPU/SWS are: Introduce you to classic vulnerabilities Get you to understand security advisories Make
More informationTLS/SSL in distributed systems. Eugen Babinciuc
TLS/SSL in distributed systems Eugen Babinciuc Contents 1. Introduction to TLS/SSL 2. A quick review of cryptography 3. TLS/SSL in distributed systems 4. Conclusions Introduction to TLS/SSL TLS/SSL History
More informationLecture 10: Dynamic Memory Allocation 1: Into the jaws of malloc()
CS61: Systems Programming and Machine Organization Harvard University, Fall 2009 Lecture 10: Dynamic Memory Allocation 1: Into the jaws of malloc() Prof. Matt Welsh October 6, 2009 Topics for today Dynamic
More informationEugene Tsyrklevich. Ozone HIPS: Unbreakable Windows
Eugene Tsyrklevich Eugene Tsyrklevich has an extensive security background ranging from designing and implementing Host Intrusion Prevention Systems to training people in research, corporate, and military
More informationBypassing Memory Protections: The Future of Exploitation
Bypassing Memory Protections: The Future of Exploitation Alexander Sotirov alex@sotirov.net About me Exploit development since 1999 Research into reliable exploitation techniques: Heap Feng Shui in JavaScript
More informationSummary of the SEED Labs For Authors and Publishers
SEED Document 1 Summary of the SEED Labs For Authors and Publishers Wenliang Du, Syracuse University To help authors reference our SEED labs in their textbooks, we have created this document, which provides
More informationSupply Chain Management of Open Source Software used within Software Development Lifecycle
Slide 1 Supply Chain Management of Open Source Software used within Software Development Lifecycle Author: Roderick Koch Co-Author: Kym Watkin-Statham http://www.sentar.com/ Secure Sw. Dev. Lifecycle with
More informationWhy Do Software Assurance Tools Have Problems Finding Bugs Like Heartbleed?
April 22 WP003 2014 Why Do Software Assurance Tools Have Problems Finding Bugs Like Heartbleed? James A. Kupsch and Barton P. Miller University of Wisconsin-Madison In response to the Heartbleed vulnerability,
More informationDefense in Depth: Protecting Against Zero-Day Attacks
Defense in Depth: Protecting Against Zero-Day Attacks Chris McNab FIRST 16, Budapest 2004 Agenda Exploits through the ages Discussion of stack and heap overflows Common attack behavior Defense in depth
More informationBypassing Browser Memory Protections in Windows Vista
Bypassing Browser Memory Protections in Windows Vista Mark Dowd & Alexander Sotirov markdowd@au1.ibm.com alex@sotirov.net Setting back browser security by 10 years Part I: Introduction Thesis Introduction
More informationPractical taint analysis for protecting buggy binaries
Practical taint analysis for protecting buggy binaries So your exploit beats ASLR/DEP? I don't care Erik Bosman Traditional Stack Smashing buf[16] GET / HTTP/1.100baseretnarg1arg2 Traditional
More informationAttacking Obfuscated Code with IDA Pro. Chris Eagle
Attacking Obfuscated Code with IDA Pro Chris Eagle Outline Introduction Operation Demos Summary 2 First Order Of Business MOVE UP AND IN! There is plenty of room up front I can't increase the font size
More informationAttacking Host Intrusion Prevention Systems. Eugene Tsyrklevich eugene@securityarchitects.com
Attacking Host Intrusion Prevention Systems Eugene Tsyrklevich eugene@securityarchitects.com Agenda Introduction to HIPS Buffer Overflow Protection Operating System Protection Conclusions Demonstration
More informationCSC 2405: Computer Systems II
CSC 2405: Computer Systems II Spring 2013 (TR 8:30-9:45 in G86) Mirela Damian http://www.csc.villanova.edu/~mdamian/csc2405/ Introductions Mirela Damian Room 167A in the Mendel Science Building mirela.damian@villanova.edu
More informationFor a 64-bit system. I - Presentation Of The Shellcode
#How To Create Your Own Shellcode On Arch Linux? #Author : N3td3v!l #Contact-mail : 4nonymouse@usa.com #Website : Nopotm.ir #Spcial tnx to : C0nn3ct0r And All Honest Hackerz and Security Managers I - Presentation
More informationCataloguing and Avoiding the Buffer Overflow Attacks in Network Operating Systems
Abstract: Cataloguing and Avoiding the Buffer Overflow Attacks in Network Operating Systems *P.VADIVELMURUGAN #K.ALAGARSAMY *Research Scholar, Department of Computer Center, Madurai Kamaraj University,
More informationOff-by-One exploitation tutorial
Off-by-One exploitation tutorial By Saif El-Sherei www.elsherei.com Introduction: I decided to get a bit more into Linux exploitation, so I thought it would be nice if I document this as a good friend
More informationProject: Simulated Encrypted File System (SEFS)
Project: Simulated Encrypted File System (SEFS) Omar Chowdhury Fall 2015 CS526: Information Security 1 Motivation Traditionally files are stored in the disk in plaintext. If the disk gets stolen by a perpetrator,
More informationModern Binary Exploitation Course Syllabus
Modern Binary Exploitation Course Syllabus Course Information Course Title: Modern Binary Exploitation Course Number: CSCI 4968 Credit Hours: 4 Semester / Year: Spring 2015 Meeting Days: Tuesday/Friday
More informationExploiting Trustzone on Android
1 Introduction Exploiting Trustzone on Android Di Shen(@returnsme) retme7@gmail.com This paper tells a real story about exploiting TrustZone step by step. I target an implementation of Trusted Execution
More informationERNW Newsletter 51 / September 2015
ERNW Newsletter 51 / September 2015 Playing With Fire: Attacking the FireEye MPS Date: 9/10/2015 Classification: Author(s): Public Felix Wilhelm TABLE OF CONTENT 1 MALWARE PROTECTION SYSTEM... 4 2 GAINING
More informationApplication Security: Web service and E-Mail
Application Security: Web service and E-Mail (April 11, 2011) Abdou Illia Spring 2011 Learning Objectives Discuss general Application security Discuss Webservice/E-Commerce security Discuss E-Mail security
More informationStack Overflows. Mitchell Adair
Stack Overflows Mitchell Adair Outline Why? What? There once was a VM Virtual Memory Registers Stack stack1, stack2, stack3 Resources Why? Real problem Real money Real recognition Still prevalent Very
More informationAn Analysis of Address Space Layout Randomization on Windows Vista
ADVANCED THREAT RESEARCH 2007 Symantec Corporation 1 An Analysis of Address Space Layout Randomization on Windows Vista Ollie Whitehouse, Architect, Symantec Advanced Threat Research Abstract: Address
More informationEECS 354 Network Security. Introduction
EECS 354 Network Security Introduction Why Learn To Hack Understanding how to break into computer systems allows you to better defend them Learn how to think like an attacker Defense then becomes second-nature
More information1) The postfix expression for the infix expression A+B*(C+D)/F+D*E is ABCD+*F/DE*++
Answer the following 1) The postfix expression for the infix expression A+B*(C+D)/F+D*E is ABCD+*F/DE*++ 2) Which data structure is needed to convert infix notations to postfix notations? Stack 3) The
More informationExploiting nginx chunked overflow bug, the undisclosed attack vector
Exploiting nginx chunked overflow bug, the undisclosed attack vector Long Le longld@vnsecurity.net About VNSECURITY.NET CLGT CTF team 2 VNSECURITY.NET In this talk Nginx brief introduction Nginx chunked
More informationLast Class: OS and Computer Architecture. Last Class: OS and Computer Architecture
Last Class: OS and Computer Architecture System bus Network card CPU, memory, I/O devices, network card, system bus Lecture 3, page 1 Last Class: OS and Computer Architecture OS Service Protection Interrupts
More informationBetriebssysteme KU Security
Betriebssysteme KU Security IAIK Graz University of Technology 1 1. Drivers 2. Security - The simple stuff 3. Code injection attacks 4. Side-channel attacks 2 1. Drivers 2. Security - The simple stuff
More informationMemory Management CS 217. Two programs can t control all of memory simultaneously
Memory Management CS 217 Memory Management Problem 1: Two programs can t control all of memory simultaneously Problem 2: One program shouldn t be allowed to access/change the memory of another program
More informationCryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 39 System Security Welcome
More informationIntroduction to Information Security
Introduction to Information Security 0368-3065, Spring 2015 Lecture 1: Introduction, Control Hijacking (1/2) Eran Tromer Slides credit: Avishai Wool, Tel Aviv University 1 Administration Lecturer: Eran
More informationSecurity & Exploitation
Security & Exploitation Operating Systems Spring 2015 RPISEC - 05/11/2015 OS Security 1 whoami Markus Gaasedelen B.S. Computer Science 15 Security Enthusiast I like to hack things President of RPISEC http://rpis.ec
More informationtelnetd exploit FreeBSD Telnetd Remote Exploit Für Compass Security AG Öffentliche Version 1.0 Januar 2012
telnetd exploit FreeBSD Telnetd Remote Exploit Für Compass Security AG Öffentliche Version 1.0 Januar 2012 Content Part I Info Bug Telnet Exploit Part II Advanced Exploitation Meta Information Disclosed
More informationJonathan Worthington Scarborough Linux User Group
Jonathan Worthington Scarborough Linux User Group Introduction What does a Virtual Machine do? Hides away the details of the hardware platform and operating system. Defines a common set of instructions.
More informationAdvanced IBM AIX Heap Exploitation. Tim Shelton V.P. Research & Development HAWK Network Defense, Inc. tshelton@hawkdefense.com
Advanced IBM AIX Heap Exploitation Tim Shelton V.P. Research & Development HAWK Network Defense, Inc. tshelton@hawkdefense.com Introduction Our society has become dependent on computers and network systems.
More informationCustom Penetration Testing
Custom Penetration Testing Compromising a Vulnerability through Discovery and Custom Exploitation Stephen Sims Advanced Penetration Testing - 2009 SANS 1 Objectives Penetration Testing Precompiled Tools
More informationWhere s the FEEB? The Effectiveness of Instruction Set Randomization
Where s the FEEB? The Effectiveness of Instruction Set Randomization Ana Nora Sovarel David Evans Nathanael Paul University of Virginia, Department of Computer Science http://www.cs.virginia.edu/feeb Abstract
More informationI Control Your Code Attack Vectors Through the Eyes of Software-based Fault Isolation. Mathias Payer, ETH Zurich
I Control Your Code Attack Vectors Through the Eyes of Software-based Fault Isolation Mathias Payer, ETH Zurich Motivation Applications often vulnerable to security exploits Solution: restrict application
More informationDAWSON -- Synthetic Diversity for Intrusion Tolerance 1
DAWSON -- Synthetic Diversity for Intrusion Tolerance 1 1. Introduction Global Infotek, Inc.: James Just, Nathan Li UC Davis: Karl Levitt, Jeff Rowe, Tufan Demire SUNY-Stonybrook: R. Sekar Fault-tolerant
More informationVirtualization for Cloud Computing
Virtualization for Cloud Computing Dr. Sanjay P. Ahuja, Ph.D. 2010-14 FIS Distinguished Professor of Computer Science School of Computing, UNF CLOUD COMPUTING On demand provision of computational resources
More informationLecture 11 Doubly Linked Lists & Array of Linked Lists. Doubly Linked Lists
Lecture 11 Doubly Linked Lists & Array of Linked Lists In this lecture Doubly linked lists Array of Linked Lists Creating an Array of Linked Lists Representing a Sparse Matrix Defining a Node for a Sparse
More informationSECURITY B-SIDES: ATLANTA STRATEGIC PENETRATION TESTING. Presented by: Dave Kennedy Eric Smith
SECURITY B-SIDES: ATLANTA STRATEGIC PENETRATION TESTING Presented by: Dave Kennedy Eric Smith AGENDA Penetration Testing by the masses Review of current state by most service providers Deficiencies in
More informationHow To Protect Your Computer From Being Hacked By A Hacker (For A Fee)
Illuminating the Security Issues with Lights-Out Server Management Anthony J. Bonkoski J. Alex Halderman University of Michigan What is IPMI? Need to manage a massive cluster of servers? OS installs, monitoring,
More informationIPMI: Understanding Your Server s Remote Backdoor
IPMI: Understanding Your Server s Remote Backdoor Anthony J. Bonkoski abonkosk@umich.edu SUMIT 2013 What is IPMI? Need to manage a massive cluster of servers? Operating system installs Monitoring Power
More informationDistributed storage for structured data
Distributed storage for structured data Dennis Kafura CS5204 Operating Systems 1 Overview Goals scalability petabytes of data thousands of machines applicability to Google applications Google Analytics
More informationDFW Backup Software. Whitepaper Data Security
Version 6 Jan 2012 Table of Content 1 Introduction... 3 2 DFW Backup Offsite Backup Server Secure, Robust and Reliable... 4 2.1 Secure 128-bit SSL communication... 4 2.2 Backup data are securely encrypted...
More informationFormat string exploitation on windows Using Immunity Debugger / Python. By Abysssec Inc WwW.Abysssec.Com
Format string exploitation on windows Using Immunity Debugger / Python By Abysssec Inc WwW.Abysssec.Com For real beneficiary this post you should have few assembly knowledge and you should know about classic
More informationSECURITY APPLICATIONS OF DYNAMIC BINARY TRANSLATION DINO DAI ZOVI THESIS. Submitted in Partial Fulfillment of the Requirements for the Degree of
SECURITY APPLICATIONS OF DYNAMIC BINARY TRANSLATION by DINO DAI ZOVI THESIS Submitted in Partial Fulfillment of the Requirements for the Degree of Bachelor of Science Computer Science The University of
More informationFile Systems for Flash Memories. Marcela Zuluaga Sebastian Isaza Dante Rodriguez
File Systems for Flash Memories Marcela Zuluaga Sebastian Isaza Dante Rodriguez Outline Introduction to Flash Memories Introduction to File Systems File Systems for Flash Memories YAFFS (Yet Another Flash
More informationHotpatching and the Rise of Third-Party Patches
Hotpatching and the Rise of Third-Party Patches Alexander Sotirov asotirov@determina.com BlackHat USA 2006 Overview In the next one hour, we will cover: Third-party security patches _ recent developments
More informationMalware and Attacks Further reading:
Malware and Attacks Further reading: Dwan B., The Malapropisms of Malware, Computer Fraud & Security, Volume 2004, Number 3 (2004), pp. 13-16 Bradbury, D., The metamorphosis of malware writers, Computers
More informationThis report is a detailed analysis of the dropper and the payload of the HIMAN malware.
PAGE 5 Check Point Malware Research Group HIMAN Malware Analysis December 12, 2013 Researcher: Overview This report is a detailed analysis of the dropper and the payload of the HIMAN malware. This malware
More informationData Structure Reverse Engineering
Data Structure Reverse Engineering Digging for Data Structures Polymorphic Software with DSLR Scott Hand October 28 th, 2011 Outline 1 Digging for Data Structures Motivations Introduction Laika Details
More informationA Dozen Years of Shellphish From DEFCON to the Cyber Grand Challenge
A Dozen Years of Shellphish From DEFCON to the Cyber Grand Challenge Antonio Bianchi antoniob@cs.ucsb.edu University of California, Santa Barbara HITCON Enterprise August 27th, 2015 Agenda Shellphish The
More informationProject 4: IP over DNS Due: 11:59 PM, Dec 14, 2015
CS168 Computer Networks Jannotti Project 4: IP over DNS Due: 11:59 PM, Dec 14, 2015 Contents 1 Introduction 1 2 Components 1 2.1 Creating the tunnel..................................... 2 2.2 Using the
More informationCS 356 Lecture 23 and 24 Software Security. Spring 2013
CS 356 Lecture 23 and 24 Software Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
More informationDiscovering passwords in the memory
Discovering passwords in the memory Abhishek Kumar (abhishek.kumar@paladion.net) November 2003 Escalation of privileges is a common method of attack where a low privileged user exploits a vulnerability
More informationComputer forensics 2015-12-01
Computer forensics Evidence acquisition Protocol analysis Packet analysis Flow analysis Network Logs Network devices Network intrusion detection/prevention systems Common network attacks Web browser forensics
More informationCVE-2012-1535 Adobe Flash Player Integer Overflow Vulnerability Analysis
Your texte here. CVE-2012-1535 Adobe Flash Player Integer Overflow Vulnerability Analysis October 11 th, 2012 Brian MARIANI & Frédéric BOURLA A FEW WORDS ABOUT FLASH PLAYER Your Adobe texte Flash here
More informationSYMANTEC ADVANCED THREAT RESEARCH. An Analysis of Address Space Layout Randomization on Windows Vista
SYMANTEC ADVANCED THREAT RESEARCH An Analysis of Address Space Layout Randomization on Windows Vista Ollie Whitehouse, Architect, Symantec Advanced Threat Research Symantec Advanced Threat Research An
More informationCS 416: Opera-ng Systems Design
Question 1 Explain the major difference between a file system that supports journaling (e.g., Linux ext4) versus a log-structured file system (e.g., YAFFS2). Operating Systems 2015 Exam 3 Review Paul Krzyzanowski
More informationCS5460: Operating Systems
CS5460: Operating Systems Lecture 13: Memory Management (Chapter 8) Where are we? Basic OS structure, HW/SW interface, interrupts, scheduling Concurrency Memory management Storage management Other topics
More informationInput Validation Vulnerabilities, Encoded Attack Vectors and Mitigations OWASP. The OWASP Foundation. Marco Morana & Scott Nusbaum
Input Validation Vulnerabilities, Encoded Attack Vectors and Mitigations Marco Morana & Scott Nusbaum Cincinnati Chapter September 08 Meeting Copyright 2008 The Foundation Permission is granted to copy,
More informationDataTrust Backup Software. Whitepaper Data Security. Version 6.8
Version 6.8 Table of Contents 1 Introduction... 3 2 DataTrust Offsite Backup Server Secure, Robust and Reliable... 4 2.1 Secure 128-bit SSL communication... 4 2.2 Backup data are securely encrypted...
More informationWindows XP Login Vulnerabilities
Windows XP Login Vulnerabilities A Case Study Using Ophcrack Yoan Hermida 12/1/2008 Hermida 2 Abstract This paper aims to demonstrate that the login process for Windows XP is inherently unsecure. It will
More informationMemory Allocation. Static Allocation. Dynamic Allocation. Memory Management. Dynamic Allocation. Dynamic Storage Allocation
Dynamic Storage Allocation CS 44 Operating Systems Fall 5 Presented By Vibha Prasad Memory Allocation Static Allocation (fixed in size) Sometimes we create data structures that are fixed and don t need
More informationDesign of a secure system. Example: trusted OS. Bell-La Pdula Model. Evaluation: the orange book. Buffer Overflow Attacks
Stware Security Holes and Defenses Design a secure system Follows a ring design. Every object has an associated security attribute. Every subject has a security clearance. Least secure Highest security
More information90% of data breaches are caused by software vulnerabilities.
90% of data breaches are caused by software vulnerabilities. Get the skills you need to build secure software applications Secure Software Development (SSD) www.ce.ucf.edu/ssd Offered in partnership with
More informationTitle: Bugger The Debugger - Pre Interaction Debugger Code Execution
White Paper Title: Bugger The Debugger Pre Interaction Debugger Code Execution Prepared by: Brett Moore Network Intrusion Specialist, CTO SecurityAssessment.com Date: April 2005 Abstract The use of debuggers
More informationLeak Check Version 2.1 for Linux TM
Leak Check Version 2.1 for Linux TM User s Guide Including Leak Analyzer For x86 Servers Document Number DLC20-L-021-1 Copyright 2003-2009 Dynamic Memory Solutions LLC www.dynamic-memory.com Notices Information
More informationCS161: Operating Systems
CS161: Operating Systems Matt Welsh mdw@eecs.harvard.edu Lecture 2: OS Structure and System Calls February 6, 2007 1 Lecture Overview Protection Boundaries and Privilege Levels What makes the kernel different
More informationBuffer Overflows. Code Security: Buffer Overflows. Buffer Overflows are everywhere. 13 Buffer Overflow 12 Nov 2015
CSCD27 Computer and Network Security Code Security: Buffer Overflows 13 Buffer Overflow CSCD27 Computer and Network Security 1 Buffer Overflows Extremely common bug. First major exploit: 1988 Internet
More informationProgramming Flaws and How to Fix Them
19 ö Programming Flaws and How to Fix Them MICHAEL HOWARD DAVID LEBLANC JOHN VIEGA McGraw-Hill /Osborne New York Chicago San Francisco Lisbon London Madrid Mexico City- Milan New Delhi San Juan Seoul Singapore
More informationEmbedded Systems. Review of ANSI C Topics. A Review of ANSI C and Considerations for Embedded C Programming. Basic features of C
Embedded Systems A Review of ANSI C and Considerations for Embedded C Programming Dr. Jeff Jackson Lecture 2-1 Review of ANSI C Topics Basic features of C C fundamentals Basic data types Expressions Selection
More informationWindows XP SP3 Registry Handling Buffer Overflow
Windows XP SP3 Registry Handling Buffer Overflow by Matthew j00ru Jurczyk and Gynvael Coldwind Hispasec 1. Basic Information Name Windows XP SP3 Registry Handling Buffer Overflow Class Design Error Impact
More informationhttp://www.nologin.org Bypassing Windows Hardware-enforced Data Execution Prevention
http://www.nologin.org Bypassing Windows Hardware-enforced Data Execution Prevention Oct 2, 2005 skape mmiller@hick.org Skywing Skywing@valhallalegends.com One of the big changes that Microsoft introduced
More informationCS 155 Final Exam. CS 155: Spring 2013 June 11, 2013
CS 155: Spring 2013 June 11, 2013 CS 155 Final Exam This exam is open book and open notes. You may use course notes and documents that you have stored on a laptop, but you may NOT use the network connection
More informationBetween Mutual Trust and Mutual Distrust: Practical Fine-grained Privilege Separation in Multithreaded Applications
Between Mutual Trust and Mutual Distrust: Practical Fine-grained Privilege Separation in Multithreaded Applications Jun Wang, Xi Xiong, Peng Liu Penn State Cyber Security Lab 1 An inherent security limitation
More informationFast Arithmetic Coding (FastAC) Implementations
Fast Arithmetic Coding (FastAC) Implementations Amir Said 1 Introduction This document describes our fast implementations of arithmetic coding, which achieve optimal compression and higher throughput by
More information6.828 Operating System Engineering: Fall 2003. Quiz II Solutions THIS IS AN OPEN BOOK, OPEN NOTES QUIZ.
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.828 Operating System Engineering: Fall 2003 Quiz II Solutions All problems are open-ended questions. In
More informationAppSecUSA New York City 2013
AppSecUSA New York City 2013 ME? Simón Roses Femerling Founder & CEO, VULNEX www.vulnex.com Blog: www.simonroses.com Twitter: @simonroses Former Microsoft, PwC, @Stake DARPA Cyber Fast Track award on software
More informationstatic void insecure (localhost *unix)
static void insecure (localhost *unix) Eric Pancer epancer@infosec.depaul.edu Information Security Team DePaul University http://infosec.depaul.edu Securing UNIX Hosts from Local Attack p.1/32 Overview
More informationBuffer Overflows. Security 2011
Buffer Overflows Security 2011 Memory Organiza;on Topics Kernel organizes memory in pages Typically 4k bytes Processes operate in a Virtual Memory Space Mapped to real 4k pages Could live in RAM or be
More informationSandy. The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis. Garage4Hackers
Sandy The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis About Me! I work as a Researcher for a Global Threat Research firm.! Spoke at the few security
More informationHomeland Security Red Teaming
Homeland Security Red Teaming Directs intergovernmental coordination Specifies Red Teaming Viewing systems from the perspective of a potential adversary Target hardening Looking for weakness in existing
More informationSimple C Programs. Goals for this Lecture. Help you learn about:
Simple C Programs 1 Goals for this Lecture Help you learn about: Simple C programs Program structure Defining symbolic constants Detecting and reporting failure Functionality of the gcc command Preprocessor,
More informationMemory management. Announcements. Safe user input. Function pointers. Uses of function pointers. Function pointer example
Announcements Memory management Assignment 2 posted, due Friday Do two of the three problems Assignment 1 graded see grades on CMS Lecture 7 CS 113 Spring 2008 2 Safe user input If you use scanf(), include
More informationOperating Systems and Networks
recap Operating Systems and Networks How OS manages multiple tasks Virtual memory Brief Linux demo Lecture 04: Introduction to OS-part 3 Behzad Bordbar 47 48 Contents Dual mode API to wrap system calls
More informationAnalysis of FileVault 2: Apple's full disk encryption. Omar Choudary Felix Grobert Joachim Metz
Analysis of FileVault 2: Apple's full disk encryption Omar Choudary Felix Grobert Joachim Metz FileVault 2 Project Overview Goal reverse engineer and analyse Apple's full disk encryption (aka File Vault)
More informationVirtual Servers. Virtual machines. Virtualization. Design of IBM s VM. Virtual machine systems can give everyone the OS (and hardware) that they want.
Virtual machines Virtual machine systems can give everyone the OS (and hardware) that they want. IBM s VM provided an exact copy of the hardware to the user. Virtual Servers Virtual machines are very widespread.
More informationCyber Security Workshop Encryption Reference Manual
Cyber Security Workshop Encryption Reference Manual May 2015 Basic Concepts in Encoding and Encryption Binary Encoding Examples Encryption Cipher Examples 1 P a g e Encoding Concepts Binary Encoding Basics
More informationEMET 4.0 PKI MITIGATION. Neil Sikka DefCon 21
EMET 4.0 PKI MITIGATION Neil Sikka DefCon 21 ABOUT ME Security Engineer on MSRC (Microsoft Security Response Center) I look at 0Days EMET Developer I enjoy doing security research on my free time too:
More informationComputer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 24 Windows and Windows Vista Security First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Windows and Windows Vista Security
More informationDepartment of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY. 6.828 Operating System Engineering: Fall 2005
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.828 Operating System Engineering: Fall 2005 Quiz II Solutions Average 84, median 83, standard deviation
More information