lec1-slides - cornell university · whybufferoverflows? • still#a#major#problem •...
TRANSCRIPT
![Page 1: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/1.jpg)
CS 5431 January 27, 2017
Lecture 1: Buffer Overflows
![Page 2: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/2.jpg)
Once Upon a Time…
![Page 3: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/3.jpg)
Memory: A Quick Review
Globals
Code
Stack
Heap
0x00000000
![Page 4: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/4.jpg)
The Stack
![Page 5: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/5.jpg)
Buffer Overflows
![Page 6: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/6.jpg)
Stack Smashing
![Page 7: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/7.jpg)
Canaries
![Page 8: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/8.jpg)
Memory: A Quick Review
Globals
Code
Stack
Heap
0x00000000
![Page 9: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/9.jpg)
The Heap
![Page 10: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/10.jpg)
Heap Smashing
![Page 11: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/11.jpg)
Memory Tagging
![Page 12: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/12.jpg)
Return-into-libc
![Page 13: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/13.jpg)
Address Space Layout Randomization
![Page 14: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/14.jpg)
Language Support
![Page 15: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/15.jpg)
Why Buffer Overflows?
• Still a major problem• Low level details can impact security• Capabilities motivate threat models• Example arms race
![Page 16: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/16.jpg)
Course Logistics• Class: F 10:10-11:25, Hollister 314• Website: www.cs.cornell.edu/courses/5431/2017sp
• Instructor: Eleanor Birrell• [email protected]• Gates Hall 441• Office Hourse: M 4-6pm
![Page 17: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/17.jpg)
Practicum = Course Project• Build and secure a software system (with non-trivial security functionality)• You choose and design your system!• Authentication. The system must authenticate its clients (humans, machines, and/or programs). Might include user registration, passwords, two-factor, generation of secrets, distribution of keys, etc.
• Authorization. The system must enforce some authorization policy to control some subset of its operation.
• Audit. The system must provide infrastructure for audit or other means of establishing accountability for actions.
• Confidentiality and Integrity. The system must involve information that resides in long-term storage or that is transmitted over a network. The system’s mission must require that information to be kept secret and/or be protected from corruption.
![Page 18: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/18.jpg)
tldr;;If it has:1) More than one computer2) More than one user3) Some data somebody cares about
then it is probably ok
![Page 19: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/19.jpg)
Project Schedule• Six Project Milestones• Milestone 0: Charter Due: February 8• Milestone 1: Security Goals Due: February 17• Milestone 2: Prototype Due: March 8• Milestone 3: Authentication Due: March 22• Milestone 4: Authorization Due: April 28• Milestone 5: Final Due: May 10
• Demos: Milestone 2, Milestone 3, Milestone 4• Final Project Presentations
![Page 20: Lec1-slides - Cornell University · WhyBufferOverflows? • Still#a#major#problem • Low#level#detailscan#impact#security • Capabilitiesmotivate#threat#models • Example#armsrace#](https://reader034.vdocuments.us/reader034/viewer/2022042403/5f184c6f407a6202b2777eed/html5/thumbnails/20.jpg)
Conficker, again