Rooting Routers Using Symbolic Execution. Mathy HITB DXB 2018, Dubai, 27 November 2018
|
|
|
- Harold Thornton
- 5 years ago
- Views:
Transcription
1 Rooting Routers Using Symbolic Execution Mathy HITB DXB 2018, Dubai, 27 November 2018
2 Overview Symbolic Execution 4-way handshake Handling Crypto Results 2
3 Overview Symbolic Execution 4-way handshake Handling Crypto Results 3
4 Symbolic Execution void recv(data, len) { if (data[0]!= 1) return if (data[1]!= len) return Mark data as symbolic Symbolic branch } int num = len/data[2]... 4
5 Symbolic Execution data[0]!= 1 void recv(data, len) { if (data[0]!= 1) return if (data[1]!= len) return data[0] == 1 void recv(data, len) { if (data[0]!= 1) return if (data[1]!= len) return } int num = len/data[2]... } int num = len/data[2]... 5
6 Symbolic Execution data[0]!= 1 data[0] == 1 PC = Path Constraint Continue execution: if (data[1]!= len) 6
7 Symbolic Execution data[0]!= 1 data[0] == 1 && data[1]!= len data[0] == 1 && data[1] == len Continue execution 7
8 Symbolic Execution data[0] == 1 && data[1] == len void recv(data, len) { if (data[0]!= 1) return if (data[1]!= len) return int num = len/data[2]... Yes! Bug detected! Can data[2] equal zero under the current PC? 8
9 Implementations We build upon KLEE Works on LLVM bytecode Actively maintained Practical limitations: paths = 2 if statements Infinite-length paths SMT query complexity 9
10 Overview Symbolic Execution 4-way handshake Handling Crypto Results 10
11 Motivating Example void recv(data, len) { plain = decrypt(data, len) if (plain == NULL) return Mark data as symbolic Summarize crypto algo. (time consuming) } if (plain[0] == COMMAND) process_command(plain) else... Analyze crypto algo. (time consuming) Won t reach this function! 11
12 Efficiently handling decryption? Decrypted output = fresh symbolic variable 12
13 Example void recv(data, len) { plain = decrypt(data, len) if (plain == NULL) return Mark data as symbolic Create fresh symbolic variable } if (plain[0] == COMMAND) process_command(plain) else... Can now analyze code that parses decrypted data Normal analysis 13
14 Other than handling decryption Handling hash functions Output = fresh symbolic variable Also works for HMACs (Message Authentication Codes) Tracking use of crypto primitives? Record relationship between input & output = Treat fresh variable as information flow taint 14
15 Detecting Crypto Misuse Timing side-channels (paths): all bytes of MAC in path constraint? If not: comparison exits on first byte difference Decryption oracles Behavior depends on unauth. decrypted data Decrypt data is in path constraint, but not in MAC 15
16 Overview Symbolic Execution 4-way handshake Handling Crypto Results 16
17 The 4-way handshake Used to connect to any protected Wi-Fi network Mutual authentication Negotiates fresh PTK: pairwise transient key 17
18 4-way handshake (simplified) 18
19 4-way handshake (simplified) 19
20 4-way handshake (simplified) PTK = Combine(shared secret, ANonce, SNonce) 20
21 4-way handshake (simplified) 21
22 4-way handshake (simplified) 22
23 4-way handshake (simplified) Encrypted with PTK 23
24 4-way handshake (simplified) 24
25 4-way handshake (simplified) 25
26 4-way handshake (simplified) Authenticated with a MAC 26
27 We focus on the client Symbolic execution of Intel s iwd deamon wpa_supplicant kernel driver How to get these working under KLEE? 27
28 Intel s iwd Avoid running full program under KLEE Would need to model Wi-Fi stack symbolically Our approach iwd contains unit test for the 4-way handshake Reuse initialization code of unit test! Symbolically execute only receive function 28
29 wpa_supplicant Unit test uses virtual Wi-Fi interface Would again need to simulate Wi-Fi stack Alternative approach: Write unit test that isolates 4-way handshake like iwd Then symbolically execute receive function! Need to modify code of wpa_supplicant (non-trivial) 29
30 MediaTek s Driver No unit tests & it s a Linux driver Symbolically executing the Linux kernel?! Inspired by previous cases Write unit test & simulate used kernel functions in userspace Verify that code is correctly simulated in userspace Again symbolically execute receive function! 30
31 Not all our unit tests have clean code 31
32 Overview Symbolic Execution 4-way handshake Handling Crypto Results 32
33 Discovered Bugs I Timing side-channels Authenticity tag not checked in constant time MediaTek and iwd are vulnerable Denial-of-service in iwd Caused by integer underflow Leads to huge malloc that fails 33
34 Discovered Bugs II Buffer overflow in MediaTek kernel module Occurs when copying the group key Remote code execution (details follow) Flawed AES unwrap crypto primitive Also in MediaTek s kernel driver Manually discovered 34
35 Decryption oracle in wpa_supplicant Decryption oracle: Authenticity of Msg3 not checked But decrypts and processes data Decrypt group key in Msg3 (details follow) 35
36 Rooting Routers: Buffer overflow in MediaTek kernel module 36
37 MediaTek buffer overflow preconditions I Triggered when the client processes Msg3 Adversary needs password of network Examples: Wi-Fi at conferences, hotels, etc. 37
38 MediaTek buffer overflow preconditions II Which clients use the MediaTek driver? Not part of Linux kernel source tree Used in repeater modes of routers Our target: RT-AC51U running Padavan firmware Original firmware has no WPA2 repeater 38
39 Popularity of Padavan firmware 39
40 Popularity of Padavan firmware We exploit this version 40
41 The vulnerable code (simplified) void RMTPParseEapolKeyData(pKeyData, KeyDataLen, MsgType) { UCHAR GTK[MAX_LEN_GTK]; if (MsgType == PAIR_MSG3 MsgType == GROUP_MSG_1) { PKDE_HDR *pkde = find_tlv(pkeydata, KeyDataLen, WPA2GTK); GTK_KDE *pkdegtk = (GTK_KDE*)pKDE->octet; UCHAR GTKLEN = pkde->len 6; NdisMoveMemory(GTK, pkdegtk->gtk, GTKLEN); } } APCliInstallSharedKey(GTK, GTKLEN); 41
42 The vulnerable code (simplified) void RMTPParseEapolKeyData(pKeyData, KeyDataLen, MsgType) { UCHAR GTK[MAX_LEN_GTK]; if (MsgType == PAIR_MSG3 MsgType == GROUP_MSG_1) { PKDE_HDR *pkde = find_tlv(pkeydata, KeyDataLen, WPA2GTK); GTK_KDE *pkdegtk = (GTK_KDE*)pKDE->octet; UCHAR GTKLEN = pkde->len 6; NdisMoveMemory(GTK, pkdegtk->gtk, GTKLEN); } } APCliInstallSharedKey(GTK, GTKLEN); 42
43 The vulnerable code (simplified) void RMTPParseEapolKeyData(pKeyData, KeyDataLen, MsgType) { UCHAR GTK[MAX_LEN_GTK]; } if (MsgType == PAIR_MSG3 MsgType == GROUP_MSG_1) { PKDE_HDR Len controlled *pkde = find_tlv(pkeydata, by attacker KeyDataLen, WPA2GTK); GTK_KDE *pkdegtk = (GTK_KDE*)pKDE->octet; UCHAR GTKLEN = pkde->len 6; NdisMoveMemory(GTK, pkdegtk->gtk, GTKLEN); } Destination buffer 32 bytes d APCliInstallSharedKey(GTK, GTKLEN); 43
44 Main exploitation steps Code execution in kernel Obtain a process context Inject shellcode in process Run injected shellcode 44
45 Main exploitation steps Code execution in kernel Obtain a process context Inject shellcode in process Run injected shellcode 45
46 Gaining kernel code execution How to control return address & where to return? Kernel doesn t use stack canaries Kernel stack has no address randomization And the kernel stack is executable Return to shellcode on stack & done? 46
47 Gaining kernel code execution How to control return address & where to return? Kernel doesn t use stack canaries Kernel stack has no address randomization And the kernel stack is executable Return to shellcode on stack & done? Nope our shellcode crashes 47
48 Problem: cache incoherency on MIPS Memory old stack data Data cache old stack data 48
49 Problem: cache incoherency on MIPS Memory old stack data Fetch shellcode Data cache Instruction cache <no cached entry> 49
50 Problem: cache incoherency on MIPS Memory old stack data Fetch shellcode Data cache Instruction cache old stack data 50
51 Solution: flush cache after write Memory old stack data Flush shellcode Data cache Instruction cache <no cached entry> 51
52 Solution: flush cache after write shellcode Memory shellcode Flush Data cache Instruction cache <no cached entry> Fetch 52
53 Solution: flush cache after write shellcode Memory shellcode Flush Data cache Instruction cache shellcode Fetch 53
54 How to flush the cache? Execute kernel function to flush cache Rely on Return Oriented Programming (ROP) Use mipsrop tool of Craig Heffner Building ROP chain is tedious but doable 54
55 Main exploitation steps Code execution in kernel Obtain a process context Inject shellcode in process Run injected shellcode 55
56 Obtaining a process context Code execution in kernel, let s spawn a shell? Tricky when in interrupt context Easier in process context: access to address space How to obtain a process context? System calls run in process context so intercept a close() system call 56
57 Intercepting system calls System call table: sys_open sys_read sys_close sys_close normal code 57
58 Intercepting system calls System call table: sys_open sys_read sys_close Interceptor attackers code Jump to sys_close sys_close normal code 58
59 Main exploitation steps Code execution in kernel Obtain a process context Inject shellcode in process Run injected shellcode 59
60 Hijacking a process Kernel now executes in process context Hijack unimportant detect_link process Recognize by its predictable PID Now easy to inject shellcode in process: 1. Call mprotect to mark process code writable 2. Copy user space shellcode to return address 3. Flush caches 60
61 Main exploitation steps Code execution in kernel Obtain a process context Inject shellcode in process Run injected shellcode 61
62 User space shellcode When close() returns, shellcode is triggered It runs telnetd p 1337 l /bin/sh using execve Adversary can now connect to router Important remaks: Original process is killed, but causes no problems Used telnetd to keep shellcode small 62
63 Running the full exploit Multi-chain exploit. Space for shellcode? For initial stage we have 250 bytes Handshake frame can transport ~2048 bytes We can even use null bytes! 63
64 Exploit recap & lessons learned Cache incoherence Debug with infinite loops First test ideas in C / /\ / /\ / /::\ \ \:\ / /:/\:\ / /::\ / /:/ \:\ / /:/\/ / /:/ \ \:\ / /\/:/~~ \ \:\ / /:/ \ \::/ \ \:\ /:/ \ \:\ \ \:\/:/ \ \/ \ \::/ \ \/ io.netgarage.org 64
65 Decryption Oracle 65
66 Recall: decryption oracle in wpa_supplicant Decryption oracle: Authenticity of Msg3 not checked Does decrypt and process data How can this be abused to leak data? 66
67 Background: process ordinary Msg3 Encrypted and authenticated header Key Data On reception of Msg3 the receiver: 1. Decrypts the Key Data field 67
68 Background: process ordinary Msg3 header Encrypted and authenticated On reception of Msg3 the receiver: 1. Decrypts the Key Data field 2. Parses the type-length-values elements 68
69 Background: process ordinary Msg3 header Encrypted and authenticated Type Len On reception of Msg3 the receiver: 1. Decrypts the Key Data field 2. Parses the type-length-values elements 69
70 Background: process ordinary Msg3 Encrypted and authenticated header y 0 y 17 Type Len RSNE On reception of Msg3 the receiver: 1. Decrypts the Key Data field 2. Parses the type-length-values elements 70
71 Background: process ordinary Msg3 Encrypted and authenticated header y 0 y Type Len RSNE Type Len On reception of Msg3 the receiver: 1. Decrypts the Key Data field 2. Parses the type-length-values elements 71
72 Background: process ordinary Msg3 Encrypted and authenticated header y 0 y x 0 x 37 Type Len RSNE Type Len GTK On reception of Msg3 the receiver: 1. Decrypts the Key Data field 2. Parses the type-length-values elements 72
73 Background: process ordinary Msg3 Encrypted and authenticated header y 0 y x 0 x 37 Type Len RSNE Type Len GTK On reception of Msg3 the receiver: 1. Decrypts the Key Data field 2. Parses the type-length-values elements 3. Extracts and installs the group key (GTK) 73
74 How to turn parsing into an oracle? 74
75 Constructing an oracle Encrypted header x 0 x 37 Type Len GTK Adversary knows type and length, but not GTK 75
76 Constructing an oracle Encrypted header x 0 x 37 Type Len Adversary knows type and length, but not GTK. 1. Reduce length by two 76
77 Constructing an oracle Encrypted header x 0 x 37 Type Len Adversary knows type and length, but not GTK. 1. Reduce length by two 2. Parsing 77
78 Constructing an oracle Encrypted header x 0 x 37 Type Len Adversary knows type and length, but not GTK. 1. Reduce length by two 2. Parsing 78
79 Constructing an oracle Encrypted header x 0 x 35 x 36 x 37 Type Len GTK Adversary knows type and length, but not GTK. 1. Reduce length by two 2. Parsing 79
80 Constructing an oracle Encrypted header x 0 x 35 x 36 x 37 Type Len GTK Type Len Adversary knows type and length, but not GTK. 1. Reduce length by two 2. Parsing only succeeds if x 37 equals zero 80
81 Constructing an oracle Encrypted header x 0 x 35 x 36 x 37 Type Len GTK Type Len Adversary knows type and length, but not GTK. 1. Reduce length by two 2. Parsing only succeeds if x 37 equals zero 3. Keep flipping encrypted x 37 until parsing succeeds 81
82 Abusing the oracle in practice 1. Guess the last byte (in our example x 37 ) 2. XOR the ciphertext with the guessed value 3. Correct guess: decryption of x 37 is zero Parsing succeeds & we get a reply 4. Wrong guess: decryption of x 37 is non-zero Parsing fails, no reply Keep guessing last byte until parsing succeeds 82
83 Practical aspects Test against Debian 8 client: Adversary can guess a value every 14 seconds Decrypting 16-byte group key takes ~8 hours Attack can be made faster by: Attacking several clients simultaneously Can brute-force the last 4 bytes 83
84 The big picture 84
85 The big picture Although limitations remain, symbolic execution tools are now more usable & efficient. 85
86 Future symbolic execution work Short-term Efficiently simulate reception of multiple packets If 1 st packet doesn t affect state, stop exploring this path Long-term Extract packet formats and state machine Verify basic properties of protocol 86
87 Conclusion Symbolic execution of protocols Simple simulation of crypto Root exploit & decryption oracle Interesting future work 87
88 Thank you! Questions?
Improved KRACK Attacks Against WPA2 Implementations. Mathy OPCDE, Dubai, 7 April 2018
Improved KRACK Attacks Against WPA2 Implementations Mathy Vanhoef @vanhoefm OPCDE, Dubai, 7 April 2018 Overview Key reinstalls in 4-way handshake New KRACKs Practical impact Lessons learned 2 Overview
Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2. Mathy CCS 2017, 1 October 2017
Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2 Mathy Vanhoef @vanhoefm CCS 2017, 1 October 2017 Overview Key reinstalls in 4-way handshake Misconceptions Practical impact Lessons learned 2 Overview
KRACKing WPA2 by Forcing Nonce Reuse. Mathy Nullcon, 2 March 2018
KRACKing WPA2 by Forcing Nonce Reuse Mathy Vanhoef @vanhoefm Nullcon, 2 March 2018 Introduction PhD Defense, July 2016: You recommend WPA2 with AES, but are you sure that s secure? Seems so! No attacks
Discovering Logical Vulnerabilities in the Wi-Fi Handshake Using Model-Based Testing
Discovering Logical Vulnerabilities in the Wi-Fi Handshake Using Model-Based Testing Mathy Vanhoef, Domien Schepers, Frank Piessens imec-distrinet, KU Leuven Asia CCS 2017 Introduction More and more Wi-Fi
Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2. Mathy Vanhoef, PhD Wi-Fi Alliance meeting Bucharest, 24 October 2017
Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2 Mathy Vanhoef, PhD Wi-Fi Alliance meeting Bucharest, 24 October 2017 Overview 1. Key reinstallation in 4-way handshake 2. Misconceptions and remarks
KRACKing WPA2 by Forcing Nonce Reuse. Mathy Chaos Communication Congress (CCC), 27 December 2017
KRACKing WPA2 by Forcing Nonce Reuse Mathy Vanhoef @vanhoefm Chaos Communication Congress (CCC), 27 December 2017 Introduction PhD Defense, July 2016: You recommend WPA2 with AES, but are you sure that
WiFuzz: Detecting and Exploiting Logical Flaws in the Wi-Fi Cryptographic Handshake
WiFuzz: Detecting and Exploiting Logical Flaws in the Wi-Fi Cryptographic Handshake Mathy Vanhoef - @vanhoefm imec-distrinet, KU Leuven Black Hat, 27 July 2017 Introduction More and more Wi-Fi network
KRACKing WPA2 in Practice Using Key Reinstallation Attacks. Mathy BlueHat IL, 24 January 2018
KRACKing WPA2 in Practice Using Key Reinstallation Attacks Mathy Vanhoef @vanhoefm BlueHat IL, 24 January 2018 Overview Key reinstalls in 4-way handshake Misconceptions Practical impact Lessons learned
Software Security II: Memory Errors - Attacks & Defenses
1 Software Security II: Memory Errors - Attacks & Defenses Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab1 Writeup 3 Buffer overflow Out-of-bound memory writes (mostly sequential) Allow
WPA-GPG: Wireless authentication using GPG Key
Università degli Studi di Bologna DEIS WPA-GPG: Wireless authentication using GPG Key Gabriele Monti December 9, 2009 DEIS Technical Report no. DEIS-LIA-007-09 LIA Series no. 97 WPA-GPG: Wireless authentication
2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks
Runtime attacks are major threats to today's applications Control-flow of an application is compromised at runtime Typically, runtime attacks include injection of malicious code Reasons for runtime attacks
CNIT 127: Exploit Development. Ch 3: Shellcode. Updated
CNIT 127: Exploit Development Ch 3: Shellcode Updated 1-30-17 Topics Protection rings Syscalls Shellcode nasm Assembler ld GNU Linker objdump to see contents of object files strace System Call Tracer Removing
(Early) Memory Corruption Attacks
(Early) Memory Corruption Attacks CS-576 Systems Security Instructor: Georgios Portokalidis Fall 2018 Fall 2018 Stevens Institute of Technology 1 Memory Corruption Memory corruption occurs in a computer
Denial-of-Service Attacks Against the 4-way Wi-Fi Handshake
Denial-of-Service Attacks Against the 4-way Wi-Fi Handshake ABSTRACT Mathy Vanhoef and Frank Piessens imec-distrinet, KU Leuven firstname.lastname@cs.kuleuven.be Having a secure implementation of the 4-way
typedef void (*type_fp)(void); int a(char *s) { type_fp hf = (type_fp)(&happy_function); char buf[16]; strncpy(buf, s, 18); (*hf)(); return 0; }
![typedef void (*type_fp)(void); int a(char *s) { type_fp hf = (type_fp)(&happy_function); char buf[16]; strncpy(buf, s, 18); (*hf)(); return 0; }](/thumbs/82/86078968.jpg "typedef void (*type_fp)(void); int a(char *s) { type_fp hf = (type_fp)(&happy_function); char buf[16]; strncpy(buf, s, 18); (*hf)(); return 0; }")
Dawn Song Fall 2012 CS 161 Computer Security Practice Questions 1. (6 points) Control Hijacking Indicate whether the statement is always valid. Indicate true or false, and give a one sentence explanation.
Lecture 08 Control-flow Hijacking Defenses
Lecture 08 Control-flow Hijacking Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides adapted from Miller, Bailey, and Brumley Control Flow Hijack: Always control + computation
Chapter 24 Wireless Network Security
Chapter 24 Wireless Network Security Wireless Security Key factors contributing to higher security risk of wireless networks compared to wired networks include: o Channel Wireless networking typically
Internet Layers. Physical Layer. Application. Application. Transport. Transport. Network. Network. Network. Network. Link. Link. Link.
Internet Layers Application Application Transport Transport Network Network Network Network Link Link Link Link Ethernet Fiber Optics Physical Layer Wi-Fi ARP requests and responses IP: 192.168.1.1 MAC:
Discovering Logical Vulnerabilities in the Wi-Fi Handshake Using Model-Based Testing
Discovering Logical Vulnerabilities in the Wi-Fi Handshake Using Model-Based Testing Mathy Vanhoef imec-distrinet, KU Leuven Domien Schepers imec-distrinet, KU Leuven Frank Piessens imec-distrinet, KU
Hacking Blind BROP. Presented by: Brooke Stinnett. Article written by: Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazie`res, Dan Boneh
Hacking Blind BROP Presented by: Brooke Stinnett Article written by: Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazie`res, Dan Boneh Overview Objectives Introduction to BROP ROP recap BROP key phases
CS 161 Computer Security
Paxson Spring 2017 CS 161 Computer Security Discussion 2 Question 1 Software Vulnerabilities (15 min) For the following code, assume an attacker can control the value of basket passed into eval basket.
Documentation for exploit entitled nginx 1.3.9/1.4.0 x86 Brute Force Remote Exploit
Documentation for exploit entitled nginx 1.3.9/1.4.0 x86 Brute Force Remote Exploit about a generic way to exploit Linux targets written by Kingcope Introduction In May 2013 a security advisory was announced
EXPLOITING BUFFER OVERFLOWS ON MIPS ARCHITECTURES
EXPLOITING BUFFER OVERFLOWS ON MIPS ARCHITECTURES A Walkthrough by Lyon Yang @l0op3r Editing and Support: Bernhard Mueller PUBLIC VERSION Table of Contents 1.! Introduction,...,3! 2.! Triggering,and,Debugging,the,Exploit,...,3!
Buffer overflow is still one of the most common vulnerabilities being discovered and exploited in commodity software.
Outline Morris Worm (1998) Infamous attacks Secure Programming Lecture 4: Memory Corruption II (Stack Overflows) David Aspinall, Informatics @ Edinburgh 23rd January 2014 Recap Simple overflow exploit
Other array problems. Integer overflow. Outline. Integer overflow example. Signed and unsigned
Other array problems CSci 5271 Introduction to Computer Security Day 4: Low-level attacks Stephen McCamant University of Minnesota, Computer Science & Engineering Missing/wrong bounds check One unsigned
Summary on Crypto Primitives and Protocols
Summary on Crypto Primitives and Protocols Levente Buttyán CrySyS Lab, BME www.crysys.hu 2015 Levente Buttyán Basic model of cryptography sender key data ENCODING attacker e.g.: message spatial distance
The Security Problem
CSC 4103 - Operating Systems Spring 2007 Lecture - XX Protection and Security Tevfik Koşar Louisiana State University April 12 th, 2007 1 The Security Problem Security must consider external environment
Remote Exploit. compass-security.com 1
Remote Exploit compass-security.com 1 Content Intel Architecture Memory Layout C Arrays Buffer Overflow BoF Exploit Assembler Shellcode Function Calls Debugging Remote Exploit Exploit Mitigations Defeat
General Pr0ken File System
General Pr0ken File System Hacking IBM s GPFS Felix Wilhelm & Florian Grunow 11/2/2015 GPFS Felix Wilhelm && Florian Grunow #2 Agenda Technology Overview Digging in the Guts of GPFS Remote View Getting
NETWORK INTRUSION. Information Security in Systems & Networks Public Development Program. Sanjay Goel University at Albany, SUNY Fall 2006
NETWORK INTRUSION Information Security in Systems & Networks Public Development Program Sanjay Goel University at Albany, SUNY Fall 2006 1 Learning Objectives Students should be able to: Recognize different
Return-orientated Programming
Return-orientated Programming or The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86) Hovav Shacham, CCS '07 Return-Oriented oriented Programming programming
Play with FILE Structure Yet Another Binary Exploitation Technique. Abstract
Play with FILE Structure Yet Another Binary Exploitation Technique An-Jie Yang (Angelboy) angelboy@chroot.org Abstract To fight against prevalent cyber threat, more mechanisms to protect operating systems
Internet Protocol and Transmission Control Protocol
Internet Protocol and Transmission Control Protocol CMSC 414 November 13, 2017 Internet Protcol Recall: 4-bit version 4-bit hdr len 8-bit type of service 16-bit total length (bytes) 8-bit TTL 16-bit identification
Software Security: Buffer Overflow Defenses
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Defenses Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin,
Homework 2: Symmetric Crypto Due at 11:59PM on Monday Feb 23, 2015 as a PDF via websubmit.
Homework 2: Symmetric Crypto February 17, 2015 Submission policy. information: This assignment MUST be submitted as a PDF via websubmit and MUST include the following 1. List of collaborators 2. List of
ECS 153 Discussion Section. April 6, 2015
ECS 153 Discussion Section April 6, 2015 1 What We ll Cover Goal: To discuss buffer overflows in detail Stack- based buffer overflows Smashing the stack : execution from the stack ARC (or return- to- libc)
L13. Reviews. Rocky K. C. Chang, April 10, 2015
L13. Reviews Rocky K. C. Chang, April 10, 2015 1 Foci of this course Understand the 3 fundamental cryptographic functions and how they are used in network security. Understand the main elements in securing
Security Lab. Episode 6: Format String Vulnerabilities. Jan Nordholz, Matthias Petschick, Julian Vetter
Security Lab Episode 6: Format String Vulnerabilities Jan Nordholz, Matthias Petschick, Julian Vetter Prof. Jean-Pierre Seifert Security in Telecommunications TU Berlin SoSe 2015 jan, matthias, julian
Lecture 6: Symmetric Cryptography. CS 5430 February 21, 2018
Lecture 6: Symmetric Cryptography CS 5430 February 21, 2018 The Big Picture Thus Far Attacks are perpetrated by threats that inflict harm by exploiting vulnerabilities which are controlled by countermeasures.
Inject malicious code Call any library functions Modify the original code
Inject malicious code Call any library functions Modify the original code 2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks 2 3 Sadeghi, Davi TU Darmstadt
Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR
Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR Presentation by Eric Newberry and Youssef Tobah Paper by Dmitry Evtyushkin, Dmitry Ponomarev, and Nael Abu-Ghazaleh 1 Motivation Buffer overflow
Lecture Embedded System Security A. R. Darmstadt, Runtime Attacks
2 ARM stands for Advanced RISC Machine Application area: Embedded systems Mobile phones, smartphones (Apple iphone, Google Android), music players, tablets, and some netbooks Advantage: Low power consumption
EasyCrypt passes an independent security audit
July 24, 2017 EasyCrypt passes an independent security audit EasyCrypt, a Swiss-based email encryption and privacy service, announced that it has passed an independent security audit. The audit was sponsored
Link & end-to-end protocols SSL/TLS WPA 2/25/07. Outline. Network Security. Networks. Link and End-to-End Protocols. Link vs. End-to-end protection
T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A Outline Network Security EECE 412 Link & end-to-end protocols SSL/TLS WPA Copyright 2004 Konstantin Beznosov 2 Networks Link and End-to-End Protocols
CYBER ATTACKS EXPLAINED: WIRELESS ATTACKS
CYBER ATTACKS EXPLAINED: WIRELESS ATTACKS Wireless networks are everywhere, from the home to corporate data centres. They make our lives easier by avoiding bulky cables and related problems. But with these
When the Lights go out. Hacking Cisco EnergyWise. Version: 1.0. Date: 7/1/14. Classification: Ayhan Koca, Matthias Luft
When the Lights go out Hacking Cisco EnergyWise Version: 1.0 Date: 7/1/14 Classification: Author(s): Public Ayhan Koca, Matthias Luft TABLE OF CONTENT 1 HANDLING... 5 1.1 DOCUMENT STATUS AND OWNER... 5
CS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Discussion 1 January 26, 2011 Question 1 Buffer Overflow Mitigations Buffer overflow mitigations generally fall into two categories: (i) eliminating the cause
Hacking Blind. Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazières, Dan Boneh. Stanford University
Hacking Blind Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazières, Dan Boneh Stanford University Hacking 101 Exploit GET /0xDEAD HTTP/1.0 shell $ cat /etc/passwd root:x:0:0:::/bin/sh sorbo:x:6:9:pac:/bin/sh
Remote Exploit. Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona
Remote Exploit Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch Content Intel Architecture Memory Layout C Arrays
This time. Defenses and other memory safety vulnerabilities. Everything you ve always wanted to know about gdb but were too afraid to ask
This time We will continue Buffer overflows By looking at Overflow Defenses and other memory safety vulnerabilities Everything you ve always wanted to know about gdb but were too afraid to ask Overflow
CS 361S - Network Security and Privacy Spring Homework #2
CS 361S - Network Security and Privacy Spring 2014 Homework #2 Due: 11am CDT (in class), April 17, 2014 YOUR NAME: Collaboration policy No collaboration is permitted on this assignment. Any cheating (e.g.,
Overview AEG Conclusion CS 6V Automatic Exploit Generation (AEG) Matthew Stephen. Department of Computer Science University of Texas at Dallas
CS 6V81.005 Automatic Exploit Generation (AEG) Matthew Stephen Department of Computer Science University of Texas at Dallas February 20 th, 2012 Outline 1 Overview Introduction Considerations 2 AEG Challenges
Wireless Security. Comp Sci 3600 Security. Attacks WEP WPA/WPA2. Authentication Encryption Vulnerabilities
Wireless Security Comp Sci 3600 Security Outline 1 2 3 Wired versus wireless Endpoint Access point Figure 24.1 Wireless Networking Components Locations and types of attack Outline 1 2 3 Wired Equivalent
Lecture Nov. 21 st 2006 Dan Wendlandt ISP D ISP B ISP C ISP A. Bob. Alice. Denial-of-Service. Password Cracking. Traffic.
15-441 Lecture Nov. 21 st 2006 Dan Wendlandt Worms & Viruses Phishing End-host impersonation Denial-of-Service Route Hijacks Traffic modification Spyware Trojan Horse Password Cracking IP Spoofing DNS
GETTING THE MOST OUT OF EVIL TWIN
GETTING THE MOST OUT OF EVIL TWIN B-SIDES ATHENS 2016 GEORGE CHATZISOFRONIOU (@_sophron) sophron@census-labs.com www.census-labs.com > WHOAMI Security Engineer at CENSUS S.A. Cryptography, Wi-Fi hacking,
This presentation covers Gen Z s Security capabilities.
This presentation covers Gen Z s Security capabilities. 1 2 Gen Z architecture assumes every component is an attack vector. This is critical to appreciate, as time and again cyber attacks have exploited
Managing and Securing Computer Networks. Guy Leduc. Chapter 7: Securing LANs. Chapter goals: security in practice: Security in the data link layer
Managing and Securing Computer Networks Guy Leduc Chapter 7: Securing LANs Computer Networking: A Top Down Approach, 7 th edition. Jim Kurose, Keith Ross Addison-Wesley, April 2016. (section 8.8) Also
ECE 471 Embedded Systems Lecture 22
ECE 471 Embedded Systems Lecture 22 Vince Weaver http://www.eece.maine.edu/~vweaver vincent.weaver@maine.edu 31 October 2018 Don t forget HW#7 Announcements 1 Computer Security and why it matters for embedded
Program Security and Vulnerabilities Class 2
Program Security and Vulnerabilities Class 2 CEN-5079: 28.August.2017 1 Secure Programs Programs Operating System Device Drivers Network Software (TCP stack, web servers ) Database Management Systems Integrity
1. (6 points) Control Hijacking Indicate whether the statement is always valid. Indicate true or false, and give a one sentence explanation.
Dawn Song Fall 2012 CS 161 Computer Security Practice Questions 1. (6 points) Control Hijacking Indicate whether the statement is always valid. Indicate true or false, and give a one sentence explanation.
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 15: Software Security II Department of Computer Science and Engineering University at Buffalo 1 Software Vulnerabilities Buffer overflow vulnerabilities account
CMPSC 497 Buffer Overflow Vulnerabilities
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CMPSC 497 Buffer Overflow
Is stack overflow still a problem?
Morris Worm (1998) Code Red (2001) Secure Programming Lecture 4: Memory Corruption II (Stack Overflows) David Aspinall, Informatics @ Edinburgh 31st January 2017 Memory corruption Buffer overflow remains
All Your Biases Belong To Us: Breaking RC4 in WPA-TKIP and TLS
All Your Biases Belong To Us: Breaking RC4 in WPA-TKIP and TLS Mathy Vanhoef and Frank Piessens, KU Leuven USENIX Security 2015 RC4 Intriguingly simple stream cipher WEP WPA-TKIP SSL / TLS PPP/MPPE And
ISA564 SECURITY LAB. Code Injection Attacks
ISA564 SECURITY LAB Code Injection Attacks Outline Anatomy of Code-Injection Attacks Lab 3: Buffer Overflow Anatomy of Code-Injection Attacks Background About 60% of CERT/CC advisories deal with unauthorized
Buffer Overflow Defenses
Buffer Overflow Defenses Some examples, pros, and cons of various defenses against buffer overflows. Caveats: 1. Not intended to be a complete list of products that defend against buffer overflows. 2.
Protection. Thierry Sans
Protection Thierry Sans Protecting Programs How to lower the risk of a program security flaw resulting from a bug? 1. Build better programs 2. Build better operating systems Build Better Programs Why are
Network Access Flows APPENDIXB
APPENDIXB This appendix describes the authentication flows in Cisco Identity Services Engine (ISE) by using RADIUS-based Extensible Authentication Protocol (EAP) and non-eap protocols. Authentication verifies
Outline. Heap meta-data. Non-control data overwrite
Outline CSci 5271 Introduction to Computer Security Day 5: Low-level defenses and counterattacks Stephen McCamant University of Minnesota, Computer Science & Engineering Non-control data overwrite Heap
Hackveda Training - Ethical Hacking, Networking & Security
Hackveda Training - Ethical Hacking, Networking & Security Day1: Hacking windows 7 / 8 system and security Part1 a.) Windows Login Password Bypass manually without CD / DVD b.) Windows Login Password Bypass
EURECOM 6/2/2012 SYSTEM SECURITY Σ
EURECOM 6/2/2012 Name SYSTEM SECURITY 5 5 5 5 5 5 5 5 10 50 1 2 3 4 5 6 7 8 9 Σ Course material is not allowed during the exam. Try to keep your answers precise and short. You will not get extra points
Software Security: Buffer Overflow Attacks (continued)
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks (continued) Spring 2015 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
The Geometry of Innocent Flesh on the Bone
The Geometry of Innocent Flesh on the Bone Return-into-libc without Function Calls (on the x86) Hovav Shacham hovav@cs.ucsd.edu CCS 07 Technical Background Gadget: a short instructions sequence (e.x. pop
Foreword by Katie Moussouris... Acknowledgments... xvii. Introduction...xix. Chapter 1: The Basics of Networking... 1
Brief Contents Foreword by Katie Moussouris.... xv Acknowledgments... xvii Introduction...xix Chapter 1: The Basics of Networking... 1 Chapter 2: Capturing Application Traffic... 11 Chapter 3: Network
Secure Development After Security Bugs
Secure Development After Security Bugs Jeremy Epstein Program Manager Presentation to 1 st IEEE Cybersecurity Development Conference (SecDev) 11/03/16 Distribution Statement A. Approved for public release:
WiFuzz: detecting and exploiting logical flaws in the Wi-Fi cryptographic handshake
WiFuzz: detecting and exploiting logical flaws in the Wi-Fi cryptographic handshake Mathy Vanhoef imec-distrinet 1 mathy.vanhoef@cs.kuleuven.be Encrypted Wi-Fi networks are increasingly popular. This is
: Practical Cryptographic Systems March 25, Midterm
650.445: Practical Cryptographic Systems March 25, 2010 Instructor: Matthew Green Midterm Name: As with any exam, please do not collaborate or otherwise share information with any other person. You are
Università Ca Foscari Venezia
Stack Overflow Security 1 2018-19 Università Ca Foscari Venezia www.dais.unive.it/~focardi secgroup.dais.unive.it Introduction Buffer overflow is due to careless programming in unsafe languages like C
CSE Computer Security
CSE 543 - Computer Security Lecture 19 - Network Security November 6, 2007 URL: http://www.cse.psu.edu/~tjaeger/cse543-f07/ 1 Big picture Abstract Introduction Results Summary Background Problem Description/Finalized
Survey of Cyber Moving Targets. Presented By Sharani Sankaran
Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber moving target technique refers to any technique that attempts to defend a system and increase the complexity of
Beyond Stack Smashing: Recent Advances in Exploiting. Jonathan Pincus(MSR) and Brandon Baker (MS)
Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns Jonathan Pincus(MSR) and Brandon Baker (MS) Buffer Overflows and How they Occur Buffer is a contiguous segment of memory of a fixed
Analysis of Security or Wired Equivalent Privacy Isn t. Nikita Borisov, Ian Goldberg, and David Wagner
Analysis of 802.11 Security or Wired Equivalent Privacy Isn t Nikita Borisov, Ian Goldberg, and David Wagner WEP Protocol Wired Equivalent Privacy Part of the 802.11 Link-layer security protocol Security
1 FIVE STAGES OF I.
1 1 FIVE STAGES OF 802.11I. Stage 1. AP and Security Capability Discovery This stage consists of messages numbered (1) to (3). The AP either periodically broadcasts its security capabilities, indicated
We will focus on Buffer overflow attacks SQL injections. See book for other examples
We will focus on Buffer overflow attacks SQL injections See book for other examples Buffer overrun is another common term Buffer Overflow A condition at an interface under which more input can be placed
Persistent key, value storage
Persistent key, value storage In programs, often use hash tables - E.g., Buckets are an array of pointers, collision chaining For persistant data, minimize # disk accesses - Traversing linked lists is
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY Fall Quiz I
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.858 Fall 2010 Quiz I All problems are open-ended questions. In order to receive credit you must answer
Outline. Format string attack layout. Null pointer dereference
CSci 5271 Introduction to Computer Security Day 5: Low-level defenses and counterattacks Stephen McCamant University of Minnesota, Computer Science & Engineering Null pointer dereference Format string
Secure Coding Techniques
Secure Coding Techniques "... the world outside your function should be treated as hostile and bent upon your destruction" [Writing Secure Code, Howard and LeBlanc] "Distrust and caution are the parents
20: Exploits and Containment
20: Exploits and Containment Mark Handley Andrea Bittau What is an exploit? Programs contain bugs. These bugs could have security implications (vulnerabilities) An exploit is a tool which exploits a vulnerability
BEng (Hons) Telecommunications. Examinations for / Semester 1
BEng (Hons) Telecommunications Cohort: BTEL/14B/FT Examinations for 2017 2018 / Semester 1 MODULE: Security in Telecommunications MODULE CODE: SECU4114 Duration: 3 Hours Instructions to Candidates: 1.
Applications. Cloud. See voting example (DC Internet voting pilot) Select * from userinfo WHERE id = %%% (variable)
Software Security Requirements General Methodologies Hardware Firmware Software Protocols Procedure s Applications OS Cloud Attack Trees is one of the inside requirement 1. Attacks 2. Evaluation 3. Mitigation
Lecture 4 September Required reading materials for this class
EECS 261: Computer Security Fall 2007 Lecture 4 September 6 Lecturer: David Wagner Scribe: DK Moon 4.1 Required reading materials for this class Beyond Stack Smashing: Recent Advances in Exploiting Buffer
Security Handshake Pitfalls
Hello Challenge R f(k, R f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone can send the challenge R. f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone
Secure Software Development: Theory and Practice
Secure Software Development: Theory and Practice Suman Jana MW 2:40-3:55pm 415 Schapiro [SCEP] *Some slides are borrowed from Dan Boneh and John Mitchell Software Security is a major problem! Why writing
Cyber Moving Targets. Yashar Dehkan Asl
Cyber Moving Targets Yashar Dehkan Asl Introduction An overview of different cyber moving target techniques, their threat models, and their technical details. Cyber moving target technique: Defend a system
Software Security: Buffer Overflow Defenses and Miscellaneous
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Defenses and Miscellaneous Spring 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter
Computer Security. 10r. Recitation assignment & concept review. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 10r. Recitation assignment & concept review Paul Krzyzanowski Rutgers University Spring 2018 April 3, 2018 CS 419 2018 Paul Krzyzanowski 1 1. What is a necessary condition for perfect
One-Slide Summary. Lecture Outline. Language Security
Language Security Or: bringing a knife to a gun fight #1 One-Slide Summary A language s design principles and features have a strong influence on the security of programs written in that language. C s
Physical and Link Layer Attacks
Physical and Link Layer Attacks CMSC 414 November 1, 2017 Attenuation Physical links are subject to attenuation Copper cables have internal resistance, which degrades signal over large distances Fiber
Module: Return-oriented Programming. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Return-oriented Programming Professor Trent Jaeger 1 1 Anatomy of Control-Flow Exploits Two steps in control-flow exploitation First -- attacker