Exploiting USB/IP in Linux
|
|
|
- Jeffrey Shields
- 6 years ago
- Views:
Transcription
1 Exploiting USB/IP in Linux Ignat
2 Who am I? systems engineer at Cloudflare interests in security and crypto enjoy low-level programming more builder than a breaker but try to stay alert
3 Agenda What is USB/IP USB/IP implementation in Linux Overview of sharing a USB device Vulnerable USB/IP code Potential exploit impact Hardening USB/IP setups
4 But first...
5 But first... Am I vulnerable?
6 What is USB/IP?
7 What is USB/IP? a way to share your USB devices over the network
8 What is USB/IP? a way to share your USB devices over the network driver/device agnostic
9 What is USB/IP? a way to share your USB devices over the network driver/device agnostic sends URBs over TCP connection
10 What is USB/IP? a way to share your USB devices over the network driver/device agnostic sends URBs over TCP connection implemented for Linux and Windows
11 USB/IP architecture
12 USB/IP implementation in Linux
13 USB/IP Linux implementation Client Server user kernel usbip vhci-hcd usbipd usbip-host usbip-core usbip-core USB hcd
14 USB/IP Linux implementation Client Server user kernel usbip vhci-hcd usbipd usbip-host usbip-core usbip-core USB hcd USB device
15 USB/IP Linux implementation Client Server user kernel usbip usbipd vhci-hcd usbip-host driver usbip-core usbip-core USB hcd USB device
16 USB/IP Linux implementation Client Server user kernel usbip usbipd vhci-hcd usbip-host driver usbip-core usbip-core USB hcd USB device
17 USB/IP Linux implementation Client Server user kernel usbip usbipd vhci-hcd usbip-host driver usbip-core usbip-core USB hcd USB device
18 USB/IP Linux implementation Client Server user kernel usbip usbipd vhci-hcd usbip-host driver usbip-core usbip-core USB hcd USB device
19 USB/IP Linux implementation Client Server user kernel usbip usbipd vhci-hcd usbip-host driver usbip-core usbip-core USB hcd USB device
20 USB/IP Linux implementation Client Server user kernel usbip usbipd driver vhci-hcd usbip-host driver usbip-core usbip-core USB hcd USB device
21 USB/IP Linux implementation $ usbip list -r usbip: error: failed to open /usr/share/hwdata//usb.ids Exportable USB devices ====================== : unknown vendor : unknown product (dead:beef) : /sys/fake/dangerous/usbipdemo : (Defined at Interface level) (00/00/00)
22 USB/IP Linux implementation $ usbip list -r usbip: error: failed to open /usr/share/hwdata//usb.ids Exportable USB devices ====================== : unknown vendor : unknown product (dead:beef) : /sys/fake/dangerous/usbipdemo : (Defined at Interface level) (00/00/00) $ sudo usbip attach -r b 1-1
23 USB/IP Linux implementation $ ps aux grep usbip root ? S 16:46 0:00 [usbip_eh] root ? S 16:46 0:00 [usbip_eh] root ? S 16:46 0:00 [usbip_eh] root ? S 16:46 0:00 [usbip_eh] root ? S 16:46 0:00 [usbip_eh] root ? S 16:46 0:00 [usbip_eh] root ? S 16:46 0:00 [usbip_eh] root ? S 16:46 0:00 [usbip_eh] ignat pts/1 S+ 16:46 0:00 grep usbip
24 WAT?
25 USB/IP Linux implementation Client Kernel usbip usbipd Server Kernel vhci-hcd usbip-core get device list usbip-host usbip-core
26 USB/IP Linux implementation Client Kernel usbip usbipd Server Kernel vhci-hcd usbip-core get device list import device usbip-host usbip-core
27 USB/IP Linux implementation Client Kernel usbip usbipd Server Kernel vhci-hcd usbip-core get device list import device usbip-host usbip-core socket fd socket fd
28 USB/IP Linux implementation Client Kernel usbip usbipd Server Kernel vhci-hcd usbip-core get device list import device usbip-host usbip-core socket fd socket fd URB traffic
29 Vulnerable USB/IP code
30 USB/IP network protocol USB/IP header USB request block data
31 USB/IP network protocol length USB/IP header USB request block data
32 USB/IP network protocol length USB/IP header USB request block data
33 USB/IP in Linux kernel static void vhci_recv_ret_submit(struct vhci_device *vdev, struct usbip_header *pdu) {... /* unpack the pdu to a urb */ usbip_pack_pdu(pdu, urb, USBIP_RET_SUBMIT, 0);... /* recv transfer buffer */ if (usbip_recv_xbuff(ud, urb) < 0) return;
34 USB/IP in Linux kernel static void vhci_recv_ret_submit(struct vhci_device *vdev, struct usbip_header *pdu) {... /* unpack the pdu to a urb */ usbip_pack_pdu(pdu, urb, USBIP_RET_SUBMIT, 0);... /* recv transfer buffer */ if (usbip_recv_xbuff(ud, urb) < 0) return;
35 USB/IP in Linux kernel static void vhci_recv_ret_submit(struct vhci_device *vdev, struct usbip_header *pdu) {... /* unpack the pdu to a urb */ usbip_pack_pdu(pdu, urb, USBIP_RET_SUBMIT, 0);... /* recv transfer buffer */ if (usbip_recv_xbuff(ud, urb) < 0) return;
36 USB/IP in Linux kernel static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb, int pack) { struct usbip_header_ret_submit *rpdu = &pdu->u.ret_submit; } if (pack) {... } else { urb->status = rpdu->status; urb->actual_length = rpdu->actual_length; urb->start_frame = rpdu->start_frame; urb->number_of_packets = rpdu->number_of_packets; urb->error_count = rpdu->error_count; }
37 USB/IP in Linux kernel static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb, int pack) { struct usbip_header_ret_submit *rpdu = &pdu->u.ret_submit; } if (pack) {... } else { urb->status = rpdu->status; urb->actual_length = rpdu->actual_length; urb->start_frame = rpdu->start_frame; urb->number_of_packets = rpdu->number_of_packets; urb->error_count = rpdu->error_count; }
38 USB/IP in Linux kernel int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) { int ret; int size; if (ud->side == USBIP_STUB) {... } else {... size = urb->actual_length; }... ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
39 USB/IP in Linux kernel int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) { int ret; int size; if (ud->side == USBIP_STUB) {... } else {... size = urb->actual_length; }... ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
40 USB/IP in Linux kernel int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) { int ret; int size; if (ud->side == USBIP_STUB) {... } else {... size = urb->actual_length; }... ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
41 USB/IP in Linux kernel It is possible to write arbitrary length data to urb->transfer_buffer
42 USB/IP in Linux kernel It is possible to write arbitrary length data to urb->transfer_buffer urb->transfer_buffer is usually allocated either by USB core code or USB device driver
43 USB/IP in Linux kernel It is possible to write arbitrary length data to urb->transfer_buffer urb->transfer_buffer is usually allocated either by USB core code or USB device driver urb->transfer_buffer is allocated on request submit, so always assumes some maximum length
44 USB/IP in Linux kernel It is possible to write arbitrary length data to urb->transfer_buffer urb->transfer_buffer is usually allocated either by USB core code or USB device driver urb->transfer_buffer is allocated on request submit, so always assumes some maximum length According to USB/IP protocol the packet with large amount of data is valid
45 USB/IP in Linux kernel It is possible to write arbitrary length data to urb->transfer_buffer Introducing CVE
46 USB/IP in Linux kernel It is possible to write arbitrary length data to urb->transfer_buffer Introducing CVE CVSS base score: 9.8 (v. 3.0) and 10 (v. 2.0)
47 USB/IP in Linux kernel It is possible to write arbitrary length data to urb->transfer_buffer Introducing CVE CVSS base score: 9.8 (v. 3.0) and 10 (v. 2.0) UBOAT = [U]SB/IP [B]uffer [O]verflow [AT]tack
48 Requisites Victim has to actually use USB/IP
49 Requisites Victim has to actually use USB/IP Victim has to be a client in USB/IP terminology
50 Requisites Victim has to actually use USB/IP Victim has to be a client in USB/IP terminology Victim has to import at least one USB device
51 Requisites Victim has to actually use USB/IP Victim has to be a client in USB/IP terminology Victim has to import at least one USB device Attacker either has to control USB/IP server or do a MiTM on the network
52 Demo
53 Potential exploit impact
54 DoS: crash USB/IP client Linux kernel heap exploit
55 Linux kernel heap exploit DoS: crash USB/IP client Data injection
56 Linux kernel heap exploit DoS: crash USB/IP client Data injection Code execution
57 Linux kernel heap exploit DoS: crash USB/IP client Data injection Code execution (much harder with heap exploits, but still possible)
58 Linux kernel heap exploit DoS: crash USB/IP client Data injection Code execution (much harder with heap exploits, but still possible)
59 Linux SLUB caches
60 Linux SLUB caches
61 Linux SLUB caches
62 Linux SLUB caches Find out which USB device drivers are using the same cache size as the desired object to be exploited
63 Linux SLUB caches Find out which USB device drivers are using the same cache size as the desired object to be exploited Emulate the device from the USB/IP server or by modifying USB/IP network traffic
64 Linux SLUB caches Find out which USB device drivers are using the same cache size as the desired object to be exploited Emulate the device from the USB/IP server or by modifying USB/IP network traffic Perform the buffer overflow
65 Hardening USB/IP setups
66 Reconsider Hardening USB/IP setups
67 Hardening USB/IP setups Reconsider Patch your system
68 Hardening USB/IP setups Reconsider Patch your system Protect your traffic (TLS, IPSec)
69 Hardening USB/IP setups Reconsider Patch your system Protect your traffic (TLS, IPSec) even in intranet
70 Hardening USB/IP setups Reconsider Patch your system Protect your traffic (TLS, IPSec) even in intranet Ensure your USB/IP server is trustworthy with proper ACLs
71 Resources
72 Black Hat Sound Bytes Never sacrifice security for performance extra buffer copy is not an excuse to move everything to kernel space Validate your input Consider least privilege principle break code into modules pay more attention to high-privileged code
73 Thank you
SA30228 / CVE
Generated by Secunia 29 May, 2008 5 pages Table of Contents Introduction 2 Technical Details 2 Exploitation 4 Characteristics 4 Tested Versions 5 Fixed Versions 5 References 5 Generated by Secunia 29 May,
A Heap of Trouble Exploiting the Linux Kernel SLOB Allocator
A Heap of Trouble Exploiting the Linux Kernel SLOB Allocator Dan Rosenberg 1 Who am I? Security consultant and vulnerability researcher at VSR in Boston App/net pentesting, code review, etc. Published
DHCP is hard. Felix Wilhelm HITB Dubai 2018
DHCP is hard. Felix Wilhelm HITB Dubai 2018 A story of 5 bugs Intro Dynamic Host Configuration Protocol (DHCP) is a 25 year old protocol designed to dynamically assign an IP address and other related config
General Pr0ken File System
General Pr0ken File System Hacking IBM s GPFS Felix Wilhelm & Florian Grunow 11/2/2015 GPFS Felix Wilhelm && Florian Grunow #2 Agenda Technology Overview Digging in the Guts of GPFS Remote View Getting
Qiang Li && Zhibin Hu/Qihoo 360 Gear Team Ruxcon 2016
Qiang Li && Zhibin Hu/Qihoo 360 Gear Team Ruxcon 2016 Who are we Security researcher in Qihoo 360 Inc(Gear Team) Vulnerability discovery and analysis Specialize in QEMU currently 50+ security issues, 33
Lecture 10. Pointless Tainting? Evaluating the Practicality of Pointer Tainting. Asia Slowinska, Herbert Bos. Advanced Operating Systems
Lecture 10 Pointless Tainting? Evaluating the Practicality of Pointer Tainting Asia Slowinska, Herbert Bos Advanced Operating Systems December 15, 2010 SOA/OS Lecture 10, Pointer Tainting 1/40 Introduction
12 th January MWR InfoSecurity Security Advisory. WebSphere MQ xcsgetmem Heap Overflow Vulnerability. Contents
Contents MWR InfoSecurity Security Advisory WebSphere MQ xcsgetmem Heap Overflow Vulnerability 12 th January 2009 2009-01-05 Page 1 of 9 Contents Contents 1 Detailed Vulnerability Description...5 1.1 Introduction...5
Advanced System Security: Vulnerabilities
Advanced System Security: Vulnerabilities Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University CSE544 -Advanced
Hackveda Training - Ethical Hacking, Networking & Security
Hackveda Training - Ethical Hacking, Networking & Security Day1: Hacking windows 7 / 8 system and security Part1 a.) Windows Login Password Bypass manually without CD / DVD b.) Windows Login Password Bypass
Spectre, Meltdown, and the Impact of Security Vulnerabilities on your IT Environment. Orin Jeff Melnick
Spectre, Meltdown, and the Impact of Security Vulnerabilities on your IT Environment Orin Thomas @orinthomas Jeff Melnick Jeff.Melnick@Netwrix.com In this session Vulnerability types Spectre Meltdown Spectre
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 Programming Why do we write programs? Function What functions do we enable via our programs?
CVE : https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve
Component: Kernel CVSS Score: 6.2 CVE-2013-4312: https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4312 The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause
MWR InfoSecurity Security Advisory. Linux USB Device Driver - Buffer Overflow. 29 th October Contents
Contents MWR InfoSecurity Security Advisory Linux USB Device Driver - Buffer Overflow 29 th October 2009 2009-10-29 Page 1 of 8 Contents Contents 1 Detailed Vulnerability Description... 4 1.1 Technical
CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Software Vulnerabilities Professor Trent Jaeger 1 Programming Why do we write programs? Function What functions do we enable via our programs?
Program Security and Vulnerabilities Class 2
Program Security and Vulnerabilities Class 2 CEN-5079: 28.August.2017 1 Secure Programs Programs Operating System Device Drivers Network Software (TCP stack, web servers ) Database Management Systems Integrity
Bringing Android to Secure SDRs
Bringing Android to Secure SDRs David Kleidermacher Frank Vandenberg SDR 11 WinnComm - Europe Agenda Overview Why Android in SDR? Android Security Proposed Architecture Typical red-black architecture for
CS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Homework 1 Due: Wednesday, February 9, at 9:59pm Instructions. Submit your solution by Wednesday, February 9, at 9:59pm, in the drop box labelled CS161 in 283
Remote Exploit. compass-security.com 1
Remote Exploit compass-security.com 1 Content Intel Architecture Memory Layout C Arrays Buffer Overflow BoF Exploit Assembler Shellcode Function Calls Debugging Remote Exploit Exploit Mitigations Defeat
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 1 Programming Why do we write programs? Function What functions do we enable via our programs?
Buffer Overflow. Jo, Heeseung
Buffer Overflow Jo, Heeseung IA-32/Linux Memory Layout Heap Runtime stack (8MB limit) Dynamically allocated storage When call malloc(), calloc(), new() DLLs (shared libraries) Data Text Dynamically linked
BUFFER OVERFLOW. Jo, Heeseung
BUFFER OVERFLOW Jo, Heeseung IA-32/LINUX MEMORY LAYOUT Heap Runtime stack (8MB limit) Dynamically allocated storage When call malloc(), calloc(), new() DLLs (shared libraries) Data Text Dynamically linked
Buffer Overflow. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University
Buffer Overflow Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu IA-32/Linux Memory Layout Runtime stack (8MB limit) Heap Dynamically allocated storage
Advances In Single Packet Authorization
Advances In Single Packet Authorization Michael Rash Enterasys Networks, Inc. http://www.cipherdyne.org/ ShmooCon 01/14/2006 Agenda Vulnerabilities vs. IDS/IPS Why another authentication / authorization
RBS Axis Products Management Web Interface Multiple Vulnerabilities of 9
RBS-2018-003 Axis Products Management Web Interface Multiple Vulnerabilities 2018-05-23 1 of 9 Table of Contents Table of Contents... 2 Vendor / Product Information.... 3 Vulnerable Program Details.. 3
Privilege Escalation via adbd Misconfiguration
Privilege Escalation via adbd Misconfiguration 17/01/2018 Software Affected Versions CVE Reference Author Severity Vendor Vendor Response Android Open Source Project (AOSP) Android 4.2.2 to Android 8.0
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 Programming Why do we write programs? Function What functions do we enable via our programs?
KSMA: Breaking Android kernel isolation and Rooting with ARM MMU features. WANG, YONG a.k.a. Pandora Lab of Ali Security
KSMA: Breaking Android kernel isolation and Rooting with ARM MMU features WANG, YONG a.k.a. ThomasKing(@ThomasKing2014) Pandora Lab of Ali Security About WANG, YONG a.k.a. ThomasKing(@ThomasKing2014) Security
Vulnerability Signature Update
Vulnerability Signature Update March 2017 - Document WST-0014-015 For Versions 1.12+ OpShieldSignature_0053-R1.12-2017-03.asg MD5 A0A246A65443E542358EE7B24859F90D SHA-1 6E1A9CB01AB043AB81FD4361B580535DF61C5FEA
Triconex TriStation Emulator Denial of Service
AR2019003 Triconex TriStation Emulator Denial of Service Author: Tom Westenberg Release Date: 19 th March 2019 Copyright Notice Copyright 2019 by Applied Risk BV. All rights reserved. OVERVIEW A vulnerability
Remote Exploit. Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona
Remote Exploit Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch Content Intel Architecture Memory Layout C Arrays
Containers: Exploits, Surprises, And Security
Containers: Exploits, Surprises, And Security with Elissa Shevinsky COO at SoHo Token Labs Editor of Lean Out #RVASec @ElissaBeth on twitter @Elissa_is_offmessage on Instagram this was Silicon Valley in
Advanced Systems Security: Ordinary Operating Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Kernel Self Protection
Kernel Self Protection Kernel Summit 2016, Santa Fe Kees ( Case ) Cook keescook@chromium.org @kees_cook http://kernsec.org/wiki/index.php/kernel_self_protection_project http://www.openwall.com/lists/kernel-hardening/
The Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel. Di Shen a.k.a. Retme Keen Lab of Tencent
The Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel Di Shen a.k.a. Retme (@returnsme) Keen Lab of Tencent whoami Di Shen a.k.a. Retme (@returnsme) Member of Keen Lab Android Kernel
IS THERE A HOLE IN YOUR RISC-V SECURITY STACK? JOTHY ROSENBERG DOVER MICROSYSTEMS
IS THERE A HOLE IN YOUR RISC-V SECURITY STACK? JOTHY ROSENBERG DOVER MICROSYSTEMS I understand the difference in destruction is dramatic, but this has a whiff of August 1945. Someone just used a new weapon,
I Don't Want to Sleep Tonight:
I Don't Want to Sleep Tonight: Subverting Intel TXT with S3 Sleep Seunghun Han, Jun-Hyeok Park (hanseunghun parkparkqw)@nsr.re.kr Wook Shin, Junghwan Kang, HyoungChun Kim (wshin ultract khche)@nsr.re.kr
typedef void (*type_fp)(void); int a(char *s) { type_fp hf = (type_fp)(&happy_function); char buf[16]; strncpy(buf, s, 18); (*hf)(); return 0; }
![typedef void (*type_fp)(void); int a(char *s) { type_fp hf = (type_fp)(&happy_function); char buf[16]; strncpy(buf, s, 18); (*hf)(); return 0; }](/thumbs/82/86078968.jpg "typedef void (*type_fp)(void); int a(char *s) { type_fp hf = (type_fp)(&happy_function); char buf[16]; strncpy(buf, s, 18); (*hf)(); return 0; }")
Dawn Song Fall 2012 CS 161 Computer Security Practice Questions 1. (6 points) Control Hijacking Indicate whether the statement is always valid. Indicate true or false, and give a one sentence explanation.
Black Hat Webcast Series. C/C++ AppSec in 2014
Black Hat Webcast Series C/C++ AppSec in 2014 Who Am I Chris Rohlf Leaf SR (Security Research) - Founder / Consultant BlackHat Speaker { 2009, 2011, 2012 } BlackHat Review Board Member http://leafsr.com
Secure C Coding...yeah right. Andrew Zonenberg Alex Radocea
Secure C Coding...yeah right Andrew Zonenberg Alex Radocea Agenda Some Quick Review Data Representation Pointer Arithmetic Memory Management Basic C Vulnerabilities Memory Corruption Ignoring Return values
Linux Forensics. Newbug Tseng Oct
Linux Forensics Newbug Tseng Oct. 2004. Contents Are u ready Go Real World Exploit Attack Detect Are u ready Linux File Permission OWNER 4 2 1 GROUP 4 2 1 OTHER 4 2 1 R R R W SUID on exection 4000 X W
MASSIVE SCALE USB DEVICE DRIVER FUZZ WITHOUT DEVICE. HC Tencent s XuanwuLab
MASSIVE SCALE USB DEVICE DRIVER FUZZ WITHOUT DEVICE HC Ma @ Tencent s XuanwuLab whoami Security Researcher@ Used to doing Chemistry; Interested in: Console Hacking; Embedded Device Security; Firmware Reverse
CNIT 127: Exploit Development. Ch 3: Shellcode. Updated
CNIT 127: Exploit Development Ch 3: Shellcode Updated 1-30-17 Topics Protection rings Syscalls Shellcode nasm Assembler ld GNU Linker objdump to see contents of object files strace System Call Tracer Removing
Stack Overflow. Faculty Workshop on Cyber Security May 23, 2012
Stack Overflow Faculty Workshop on Cyber Security May 23, 2012 Goals Learn to hack into computer systems using buffer overflow Steal sensitive data Crash computer programs Lay waste to systems throughout
CSE 509: Computer Security
CSE 509: Computer Security Date: 2.16.2009 BUFFER OVERFLOWS: input data Server running a daemon Attacker Code The attacker sends data to the daemon process running at the server side and could thus trigger
Introduction to Computer Systems , fall th Lecture, Sep. 28 th
Introduction to Computer Systems 15 213, fall 2009 9 th Lecture, Sep. 28 th Instructors: Majd Sakr and Khaled Harras Last Time: Structures struct rec { int i; int a[3]; int *p; }; Memory Layout i a p 0
CS 155 Final Exam. CS 155: Spring 2012 June 11, 2012
CS 155: Spring 2012 June 11, 2012 CS 155 Final Exam This exam is open books and open notes. You may use course notes and documents that you have stored on a laptop, but you may NOT use the network connection
EURECOM 6/2/2012 SYSTEM SECURITY Σ
EURECOM 6/2/2012 Name SYSTEM SECURITY 5 5 5 5 5 5 5 5 5 5 50 1 2 3 4 5 6 7 8 9 10 Σ Course material is not allowed during the exam. Try to keep your answers precise and short. You will not get extra points
How to fix Usually Slightly Broken devices and drivers?
How to fix Usually Slightly Broken devices and drivers? Krzysztof Opasiak Samsung R&D Institute Poland Agenda USB basics Plug & Play Plug & do what I want Plug & tell me more Summary Q & A 1 This presentation
ISA564 SECURITY LAB. Code Injection Attacks
ISA564 SECURITY LAB Code Injection Attacks Outline Anatomy of Code-Injection Attacks Lab 3: Buffer Overflow Anatomy of Code-Injection Attacks Background About 60% of CERT/CC advisories deal with unauthorized
Advanced Systems Security: Ordinary Operating Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Microsoft Office Protected-View Out-Of- Bound Array Access
Microsoft Office Protected-View Out-Of- Bound Array Access 2017-11-23 Software Microsoft Office Affected Versions Microsoft Excel 2010, 2013, 2016 (x86 and x64) CVE Reference Author Severity Vendor CVE-2017-8692
Defeat Exploit Mitigation Heap Attacks. compass-security.com 1
Defeat Exploit Mitigation Heap Attacks compass-security.com 1 ASCII Armor Arbitrary Write Overflow Local Vars Exploit Mitigations Stack Canary ASLR PIE Heap Overflows Brute Force Partial RIP Overwrite
Pangu 9 Internals. Tielei Wang and Hao Xu
Pangu 9 Internals Tielei Wang and Hao Xu Team Pangu Agenda ios Security Overview Pangu 9 Overview Userland Exploits Kernel Patching in Kernel Patch Protections Persistent Code Signing Bypass Conclusion
Attacking Mobile Broadband Modems Like A Criminal Would. Andreas IT-SeCX 2014
Attacking Mobile Broadband Modems Like A Criminal Would Andreas Lindh, @addelindh, IT-SeCX 2014 whoami Security Analyst with I Secure Sweden Technical generalist Not really an expert on anything I like
MIS Week 7. Operating System Security. Windows Firewalls
MIS 5170 Operating System Security Week 7 Windows Firewalls Tonight s Plan 2 Questions from Last Week Firewalls Review Quiz Questions Review for 1 st test Assignment 3 Overview Spring Break Test 1 Questions
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 8
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 8 System Vulnerabilities and Denial of Service Attacks System Vulnerabilities and
Ruckus Wireless Security Advisory ID FAQ
Multiple Vulnerabilities in DNSMASQ (CVE-2017-14491, CVE-2017-14492, CVE-2017-14493, CVE-2017-14494, CVE-2017-14495, CVE-2017-14496, CVE-2017-13704, CVE-2015-3294) Initial Internal Release Date: 11/27/2017
Secure Coding Techniques
Secure Coding Techniques "... the world outside your function should be treated as hostile and bent upon your destruction" [Writing Secure Code, Howard and LeBlanc] "Distrust and caution are the parents
McAfee Labs: Combating Aurora
McAfee Labs: Combating Aurora By Rohit Varma, McAfee Labs Contents Overview... 2 McAfee detection names for Aurora... 3 Exploit-Comele... 3 Roarur.dr... 3 Roarur.dll... 3 Symptoms... 5 Characteristics...
Fundamentals of Computer Security
Fundamentals of Computer Security Spring 2015 Radu Sion Software Errors Buffer Overflow TOCTTOU 2005-15 Portions copyright by Bogdan Carbunar and Wikipedia. Used with permission Why Security Vulnerabilities?
Huawei Frame Buffer Driver Arbitrary Memory Write
Huawei Frame Buffer Driver Arbitrary Memory Write 18/07/2017 Software Affected Versions Author Severity Vendor Vendor Response MediaTek Frame Buffer Driver Huawei Y6 Pro Dual SIM (TIT-L01C576B115) Mateusz
Ranking Vulnerability for Web Application based on Severity Ratings Analysis
Ranking Vulnerability for Web Application based on Severity Ratings Analysis Nitish Kumar #1, Kumar Rajnish #2 Anil Kumar #3 1,2,3 Department of Computer Science & Engineering, Birla Institute of Technology,
Linux Memory Layout. Lecture 6B Machine-Level Programming V: Miscellaneous Topics. Linux Memory Allocation. Text & Stack Example. Topics.
Lecture 6B Machine-Level Programming V: Miscellaneous Topics Topics Linux Memory Layout Understanding Pointers Buffer Overflow Upper 2 hex digits of address Red Hat v. 6.2 ~1920MB memory limit FF C0 Used
Web Security. Outline
Security CS 161/194-1 Anthony D. Joseph November 21, 2005 s Outline Static and Dynamic Content Firewall review Adding a DMZ Secure Topologies 2 1 Polls How many people have set up a personal web server?
5. Execute the attack and obtain unauthorized access to the system.
Describe how a combination of preventive, detective, and corrective controls can be employed to provide reasonable assurance about information security. Before discussing the preventive, detective, and
IMC inode Intelligent Client v7.0 (E0106) Copyright (c) Hewlett-Packard Development Company, L.P. and its licensors.
IMC inode Intelligent Client v7.0 (E0106) Copyright (c) 2011-2014 Hewlett-Packard Development Company, L.P. and its licensors. Table of Contents 1. What's New in this Release 2. Problems Fixed in this
Authors: Mark Handley, Vern Paxson, Christian Kreibich
Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics Authors: Mark Handley, Vern Paxson, Christian Kreibich Exploitable Ambiguities NIDS does not have full range
Our Narrow Focus Computer Networking Security Vulnerabilities. Outline Part II
Our Narrow Focus 15-441 15-441 Computer Networking 15-641 Lecture 22 Security: DOS Peter Steenkiste Fall 2016 www.cs.cmu.edu/~prs/15-441-f16 Yes: Creating a secure channel for communication (Part I) Protecting
Beyond Stack Smashing: Recent Advances in Exploiting. Jonathan Pincus(MSR) and Brandon Baker (MS)
Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns Jonathan Pincus(MSR) and Brandon Baker (MS) Buffer Overflows and How they Occur Buffer is a contiguous segment of memory of a fixed
Lecture 4 September Required reading materials for this class
EECS 261: Computer Security Fall 2007 Lecture 4 September 6 Lecturer: David Wagner Scribe: DK Moon 4.1 Required reading materials for this class Beyond Stack Smashing: Recent Advances in Exploiting Buffer
1 TABLE OF CONTENTS UNCLASSIFIED//LES
1 TABLE OF CONTENTS 2 In troduction...3 2.1 Terminology...3 2.2 Anatomy of the Pivot...3 2.3 Requirements for a Successful Pivot...3 3 Risks and Caveats...4 3.1 Fulcrum Does Not Measure Success or Failure
Secure Containers with EPT Isolation
Secure Containers with EPT Isolation Chunyan Liu liuchunyan9@huawei.com Jixing Gu jixing.gu@intel.com Presenters Jixing Gu: Software Architect, from Intel CIG SW Team, working on secure container solution
Buffer Overflow. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University
Buffer Overflow Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu x86-64/linux Memory Layout Stack Runtime stack (8MB limit) Heap Dynamically allocated
Microsoft Office Protected-View Out-Of- Bound Array Access
Microsoft Office Protected-View Out-Of- Bound Array Access 2017-11-23 Software Microsoft Office Affected Versions Microsoft Excel 2010, 2013, 2016 (x86 and x64) CVE Reference Author Severity Vendor CVE-2017-8502
Other array problems. Integer overflow. Outline. Integer overflow example. Signed and unsigned
Other array problems CSci 5271 Introduction to Computer Security Day 4: Low-level attacks Stephen McCamant University of Minnesota, Computer Science & Engineering Missing/wrong bounds check One unsigned
ECE 471 Embedded Systems Lecture 22
ECE 471 Embedded Systems Lecture 22 Vince Weaver http://www.eece.maine.edu/~vweaver vincent.weaver@maine.edu 31 October 2018 Don t forget HW#7 Announcements 1 Computer Security and why it matters for embedded
Jailbreaking. Apple Watch. Max Bazaliy. December 4-7, 2017
1 2 Jailbreaking 3 4 5 Apple Watch 6 7 8 9 Max Bazaliy 10 11 12 whoami 1 2 3 o Security researcher at Lookout o ios/tvos/watchos jailbreak author o Lead researcher on Pegasus exploit chain o Focused on
Leveraging CVE for ASLR Bypass & RCE. Gal De Leon & Nadav Markus
Leveraging CVE-2015-7547 for ASLR Bypass & RCE Gal De Leon & Nadav Markus 1 Who We Are Nadav Markus, Gal De-Leon Security researchers @ PaloAltoNetworks Vulnerability research and exploitation Reverse
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 15: Software Security II Department of Computer Science and Engineering University at Buffalo 1 Software Vulnerabilities Buffer overflow vulnerabilities account
Debugging Usually Slightly Broken Devices and Drivers
Debugging Usually Slightly Broken Devices and Drivers Krzysztof Opasiak Samsung R&D Institute Poland Agenda USB basics Plug & Play Plug & do what I want Plug & tell me more Summary Q & A 1 This presentation
Buffer Overflow. Jinkyu Jeong Computer Systems Laboratory Sungkyunkwan University
Buffer Overflow Jinkyu Jeong (jinkyu@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu SSE2030: Introduction to Computer Systems, Spring 2018, Jinkyu Jeong (jinkyu@skku.edu)
Intrusion Detection and Malware Analysis
Intrusion Detection and Malware Analysis Host Based Attacks Pavel Laskov Wilhelm Schickard Institute for Computer Science Software security threats Modification of program code viruses and self-replicating
Attack Vectors in Computer Security
Attack Vectors in Computer Security Who Am I @WillGoard My first proper hacksoc talk I speak fluent greek Sell more pizzas have more fun Why attack vectors? Didn t know what to do for my dissertation Started
Threat Centric Vulnerability Management
Threat Centric Vulnerability Management Q. Which vulnerabilities should I address first? A. Your EXPOSED vulnerabilities AND the ones criminals are using. Agenda Understanding exploited vulnerabilities
Linux Kernel Exploitation. Where no user has gone before
Linux Kernel Exploitation Where no user has gone before Overview Background The Vulnerabilities The Plans The Exploits Lessons Questions Background A kernel is: the main OS program to run after boot a
ELEC 377 Operating Systems. Week 4 Lab 2 Tutorial
ELEC 377 Operating Systems Week 4 Tutorial Modules Provide extensions to the kernel Device Drivers File Systems Extra Functionality int init_module() {.. do initialization stuff.... tell the kernel what
Owning a Cisco VOIP environment Exploiting the Call Manager HITB2013KUL. Francisco. October 2013 LEXFO 1
Owning a Cisco VOIP environment Exploiting the Call Manager HITB2013KUL Francisco October 2013 LEXFO 1 Plan Introduction Methodology Exploitation Demo Patch Conclusion October 2013 LEXFO 2 Introduction
New York University CSCI-UA : Advanced Computer Systems: Spring 2016 Midterm Exam
New York University CSCI-UA.480-008: Advanced Computer Systems: Spring 2016 Midterm Exam This exam is 75 minutes. Stop writing when time is called. You must turn in your exam; we will not collect it. Do
CMSC 414 Computer and Network Security
CMSC 414 Computer and Network Security Buffer Overflows Dr. Michael Marsh August 30, 2017 Trust and Trustworthiness You read: Reflections on Trusting Trust (Ken Thompson), 1984 Smashing the Stack for Fun
Training for the cyber professionals of tomorrow
Hands-On Labs Training for the cyber professionals of tomorrow CYBRScore is a demonstrated leader in professional cyber security training. Our unique training approach utilizes immersive hands-on lab environments
Tolerating Malicious Drivers in Linux. Silas Boyd-Wickizer and Nickolai Zeldovich
XXX Tolerating Malicious Drivers in Linux Silas Boyd-Wickizer and Nickolai Zeldovich How could a device driver be malicious? Today's device drivers are highly privileged Write kernel memory, allocate memory,...
1. Oracle mod_plsql v in Oracle9i Application Server v1.0.2.x (Oracle9iAS v1.0.2.x)
Oracle Security Alert #28 Dated: 06 Feburary 2002 Updated: 05 July 2002 1. Oracle mod_plsql v3.0.9.8.2 in Oracle9i Application Server (Oracle9iAS ) a) Potential buffer overflow-related security vulnerabilities
Lab 6: OS Security for the Internet of Things
Department of Computer Science: Cyber Security Practice Lab 6: OS Security for the Internet of Things Introduction The Internet of Things (IoT) is an emerging technology that will affect our daily life.
Lab 6: OS Security for the Internet of Things
Department of Computer Science: Cyber Security Practice Lab 6: OS Security for the Internet of Things Introduction The Internet of Things (IoT) is an emerging technology that will affect our daily life.
Network File System (NFS)
Network File System (NFS) Nima Honarmand User A Typical Storage Stack (Linux) Kernel VFS (Virtual File System) ext4 btrfs fat32 nfs Page Cache Block Device Layer Network IO Scheduler Disk Driver Disk NFS
Verification & Validation of Open Source
Verification & Validation of Open Source 2011 WORKSHOP ON SPACECRAFT FLIGHT SOFTWARE Gordon Uchenick Coverity, Inc Open Source is Ubiquitous Most commercial and proprietary software systems have some open
C and C++ Secure Coding 4-day course. Syllabus
C and C++ Secure Coding 4-day course Syllabus C and C++ Secure Coding 4-Day Course Course description Secure Programming is the last line of defense against attacks targeted toward our systems. This course
CS System Security 2nd-Half Semester Review
CS 356 - System Security 2nd-Half Semester Review Fall 2013 Final Exam Wednesday, 2 PM to 4 PM you may bring one 8-1/2 x 11 sheet of paper with any notes you would like no cellphones, calculators This
HP-UX Security I. Ideal candidate for this course Experienced system and network administrators responsible for securing and monitoring HP-UX systems
Course Data Sheet HP-UX Security I Course description This course teaches you about the most common HP-UX system security vulnerabilities, and introduces a variety of tools and techniques that can be used
Question No: 2 Which identifier is used to describe the application or process that submitted a log message?
Volume: 65 Questions Question No: 1 Which definition of a fork in Linux is true? A. daemon to execute scheduled commands B. parent directory name of a file pathname C. macros for manipulating CPU sets