Transcript Darpa Presentation - Carnegie Mellon University

Introduction to Computer Security
David Brumley
[email protected]
Carnegie Mellon University
Today: Overview
•
•
•
•
•
•
Course Staff
Trusting Trust
Course Overview
Example Applications
Course Mechanics
CMU CTF Team
2
You will find
at least one error
on each set of slides. :)
3
David Brumley
• B.A. Math UNC 1998
• M.S. CS Stanford 2003
• Ph.D. CS CMU 2008
• Computer security
officer, Stanford
University, 1998-2002
• Assistant Professor,
CMU, Jan 2009
4
Current Research Thrusts
• Automatic Exploit Generation
– AEG and Mayhem
• Scalable Malware Analysis
– BitShred
• Binary code analysis
– Decompilation
• Vetting whole systems
5
Trusting
Trust
6
Do you trust his
Software?
Photo from http://culturadigitalbau.wikispaces.com/
file/view/thompson.c1997.102634882.lg.jpg/212982274/thompson.c1997.102634882.lg.jpg
7
Ken Thompson
Co-Creator of
UNIX and C
Turing Award: 1983
8
Compiler
011001001111010
9
Compiler
...
if(program == “login”)
add-login-backdoor();
if(program == “compiler”)
add-compiler-backdoor();
011001001111010
10
Ken Thompson
Co-Creator of
UNIX and C
Turing Award: 1983
11
Would you trust
Mother Teresa’s
software?
12
Would you trust
Mother Teresa’s
software?
13
Ron Rivest
Adi Shamir
Len Adleman
Surely cryptographers code must be
secure?
Picture from http://www.usc.edu/dept/molecular-science/RSA-2003.htm
14
Perfect Cryptography Exists!
We’re no better off
guessing what an
encrypted message
contains given the
ciphertext.
- Claude Shannon
15
But implementations may still leak...
message decrypt(ciphertext c, private_key k){
plaintext m;
if(k == 1) m = time t1 decryption ops; return m;
if(k == 2) m = time t2 decryption ops; return m;
if(k == 3) m = time t3 decryption ops; return m;
....
}
16
Isn’t this networking?
Routers run an
operating system,
which hackers now
target
17
Even GPS systems run
• Webservers
• FTP servers
• Network time daemons
18
Security is many
things
19
This Class: Introduction to the Four
Research Cornerstones of Security
Software Security
OS Security
Network Security
Cryptography
20
Course Topics
Control Flow Hijack
Software Security
Execution Safety
Information Flow
Goals of Crypto
Stream Ciphers
Cryptography
Block Ciphers
Asymmetric Crypto
Authentication/Integrity
Intro to Computer Security
Common Defenses
OS Security
Authorization
Security Architectures
Web Security
Network Security
Denial of Service
Protocols
Intrusion Detection
Your job: become conversant in these topics
21
Software Security
22
Control Flow Hijacks
shellcode (aka payload) padding
computation
+
&buf
control
Allow attacker ability to run arbitrary code
– Install malware
– Steal secrets
– Send spam
23
24
25
26
Software Security
• Recognize and exploit vulnerabilities
– Format string
– Buffer overflow
– Gist of other control flow hijacks, e.g., heap overflow
• Understand defenses in theory and practice
–
–
–
–
ASLR
DEP
Canaries
Know the limitations!
27
Cryptography
28
Everyday Cryptography
•
•
•
•
ATM’s
On-line banking
SSH
Kerberos
M
Alice
Public Channel
Bob
Adversary Eve:
A very clever person
M
Alice
Public Channel
Bob
Adversary Eve:
A very clever person
Cryptography’s Goals:
– Data Privacy
– Data Integrity
– Data Authenticity
M
Alice
Cryptonium
Pipe
Public Channel
Bob
Adversary Eve:
A very clever person
Public Channel
M
Alice
Bob
Cryptonium
Pipe
Adversary Eve:
A very clever person
Cryptography’s Goals:
– Privacy
– Integrity
– Authenticity
34
Goals
• Understand and believe you should never,
ever invent your own algorithm
• Basic construction
• Basic pitfalls
35
OS Security
36
Requested
Operation
Approved
Operation
Principal
Reference
Monitor
Object
Source
Guard
Resource
Authentication
Authorization
In security, we isolate reasoning
about the guard
37
Authentication
Authorization
Principles
Reference monitors
Access control lists
OS Security
Auditing
Security Architectures
Virtual Machines
Software Fault Isolation
38
OS Goals
• Know Lampson’s “gold” standard
– Authorization
– Authentication
– Audit
• Know currently used security architectures
39
Network Security
40
XSS
Stored XSS
Reflected XSS
SQL Injection
Defense
Sanitization
Bots
CDN
Stored procedures
Denial of Service
Attacks
Web Security
Basic syntax
Kerberos
BGP
Comments
Protocols
Network Security
Probes
CSRF
Stateful
Stateless
Attack
Intrusion Detection
Defense
Base Rate
Referer Validation
Custom Header
Token validation
41
XSS
Stored XSS
Reflected XSS
SQL Injection
Defense
Sanitization
Bots
CDN
Stored procedures
Denial of Service
Attacks
Web Security
Basic syntax
Kerberos
BGP
Comments
Protocols
Network Security
Probes
CSRF
Stateful
Stateless
Attack
Intrusion Detection
Defense
Base Rate
Referer Validation
Custom Header
Token validation
42
XSS
Stored XSS
Reflected XSS
SQL Injection
Defense
Sanitization
Bots
CDN
Stored procedures
Denial of Service
Attacks
Web Security
Basic syntax
Kerberos
BGP
Comments
Protocols
Network Security
Probes
CSRF
Stateful
Stateless
Attack
Intrusion Detection
Defense
Base Rate
Referer Validation
Custom Header
Token validation
43
Networking Goals
• Understand the base rate fallacy and it’s
application to IDS
• Be able to recognize and perform basic web
attacks
• State what a DDoS is, and how CDN’s
mitigate their effect
44
Course Mechanics
45
Basics
• Pre-req:
– Basic UNIX development (gcc, gdb, etc.)
– 15-213 or similar is recommended
• Read all papers before lecture
–
–
–
–
Read
Underline
Question
Review
• Course website:
http://www.ece.cmu.edu/~dbrumley/courses/18487-f13
46
Workload
• 3 homework assignments
• 3 exams, keep highest 2 grades
• The Coolest Bug day.
47
The Coolest Bug
• Describe a classic old bug, or a new zero-day
• Provide an 5 minute tutorial on the bug.
• Present to the class.
• Class votes (via a limited number of tokens) on
best.
• Encourage finding your own zero-days.
48
1996
#1 Song: The Macarena
Spice Girls Play Olympics
Windows 95 Reigned
49
Ping of Death!
50
ICMP and IP Packets
Max IP packet size = 65535 octets (216 – 1)
(RFC 791)
IP
Packet
20 for
8 for
typical header ICMP header
65507 for data
(65535-20-8)
To process ICMP, I need to
handle up to 65507 octets
http://jobtrakr.com/2011/11/16/so-you-want-to-be-a-manager/
51
ICMP and IP Packets
Max IP packet size = 65535 octets (216 – 1)
(RFC 791)
IP
Packet
20 for
8 for
typical header ICMP header
65507 for data
(65535-20-8)
To process ICMP, I need to
handle up to 65507 octets
http://jobtrakr.com/2011/11/16/so-you-want-to-be-a-manager/
52
IP Fragmentation
One 4000 byte packet
with Maximum
Transmission Unit
(MTU) of 1500
...
length
4000
ID
x
fragflag
0
offset
0
...
1480 octet data
Gets fragmented in
3 packets
...
length
1500
ID
x
fragflag
1
offset
0
...
...
length
1500
ID
x
fragflag
1
offset
185
...
...
length
1040
ID
x
fragflag
0
offset
370
...
packet len < MTU
offset = 1480/8
53
ping of death
Attacker
2. Victim reassembles fragments
into one big packet
Victim
3. Victim copies large packet,
exceeds buffer bounds,
crashes
54
“A few ICMPv6 packets with router advertisements requests can cause a
denial-of-service vulnerability reminiscent of the famous "Ping of Death".
It’s a good illustration of how much we still do not know about the
stability of IPv6. We continue to recommend turning off IPv6 on
workstations if your network is not engineered for its use.”
55
“A few ICMPv6 packets with router advertisements requests can cause a
denial-of-service vulnerability reminiscent of the famous "Ping of Death".
It’s a good illustration of how much we still do not know about the
stability of IPv6. We continue to recommend turning off IPv6 on
workstations if your network is not engineered for its use.”
56
Basic Mechanics
• Grading based on:
– 3 homeworks (35%)
– Highest 2 out of 3 tests (30% each)
– Participation and coolest bug (5%)
• No late days except under exceptional circumstances.
• I guarantee at least the following:
–
–
–
–
–
90-100%: A
80-89%: B
70-79%: C
60-69%: D
< 59%: F
57
• Obey the law
• Do not be a nuisance
• Don’t cheat, copy others
work, let others copy, etc.
58
One note
My wife will have a baby boy sometime this
semester. This may affect the course.
Image credits: http://onyx-ii.com/srcstore/scripts/store/item.cfm?Item_Number=BE-STXLW-CD
59
Capture the Flag
60
CMU Capture the Flag Team
61
Red Team
•
•
•
•
Vulnerability Discovery
Exploitation
Network mapping
Web security
Blue Team
•
•
•
•
Intrusion detection
Hot-patching
Firewalls
Work-arounds
62
63
64
10,000 Students in 2,000 teams
Size of circle proportional to number of teams
65
66
67
Example Network Forensics
68
PicoCTF
• 10,000 students
• 600 teams solving advanced problems
– ROP attacks
– Breaking incorrect use of modern crypto
• Identified the best of the best
“I learned more in one week than the last two years in CS courses.”
If you get an A, you may be eligible to
help with PicoCTF 2014
69
Questions?
70
END
Information Flow
e.g., password
High In
Low In
e.g., dictionary
Program
OK to mix
NO mixing!
High Out
Low Out
72
Information Flow
Data Dependence
Assignment
Control Dependence
if-then-else
Side Channel
Timing
73
Information Flow Goals
• What is safe and unsafe information flow?
• How is it calculated?
• Know the non-interference information flow
property.
74
Execution Safety
Trapped Errors
Untrapped Errors
halts computation
immediately
can go unnoticed until
(possibly much) later
ex:
• divide by zero
• dereference (R/W)
an illegal address
ex:
• buffer overflow
• writing an integer into
an array of strings
75
76
Safe Languages
A safe language has no
untrapped errors.
untyped
dynamically
checked
Untrapped Errors
can go unnoticed until
(possibly much) later
typed
statically
checked
ex:
• buffer overflow
• writing a string into an
integer
“typechecking”
77
Execution Safety Goals
• State what type safety means.
• Read typing inference rules.
• Give examples of differences between type
safety and security.
• State control flow integrity
– Give examples of vulnerabilities protected by CFI
– Give examples of vulnerabilities not protected by CFI
78