Smashing the Stack Protector for Fun and Profit
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Meeting Agenda 4:30 – 6:00 PM, Wednesday, Nov 2Nd, 2016 Lyons Town Hall
Meeting Agenda 4:30 – 6:00 PM, Wednesday, Nov 2nd, 2016 Lyons Town Hall I. Roll Call, Agenda, Minutes • Amendments to Agenda • Approve Minutes from Oct 19th • UEB Officers and Member Lead Areas • Upcoming Meetings - Nov 12, 2016 9 AM or 1 PM - Lyons Boards and Commissions Training - Lyons Nov 9. 8 AM - Northern Water Fall Water Users Meeting - Longmont, Best Western 1850 Industrial Cir. Dec 2nd - CAMU Fall Meeting - Fairfield & Woods in Denver, CO II. Audience Business III. Liaison Updates • Board of Trustees Update - MEAN meeting Report • Staff, Engineering Update - Honeywell Savings Gaurantee IV. Continued Business ● Town Utility Account tracking V. New Business ● Water/Wastewater Rate and CIP Study Presentation RG & Assoc. VI. Parking Lot • 2017 Utility FUnd Budget, Pipe Water rates for 2017 Budget, • Reserve/Rate Stabilization Funds • Wastewater Pretreatment Policy • LRAP INF 2.2.1 • Municipal Code Corrections UEB Meeting Minutes, 19 Oct 2016 Meeting Time and Location: Began at 4:30 at Town Hall. Attendance:, Aaron Caplan, Lee Hall, Coco Gordon, John Cowdry, Chuck Keim, Dan Reitz, Jay Stott Staff: Kyle Miller Liaisons: Guests: Amendments to Agenda: Welcomed Jay Stott as the newest member of the UEB. Previous Minutes: . Reviewed and modified Oct 5th Minutes under Water Wastewater CIP to add “Areas where there is no looping of the water mains need looping. It was emphasized to try and coordinate getting water, and wastewater done first in areas that need paving.” Aaron had not followed up with Parks and Rec to find out if they were budgeting for water usage. He would do so. Then approved minutes. -
Embedded Linux Systems with the Yocto Project™
OPEN SOURCE SOFTWARE DEVELOPMENT SERIES Embedded Linux Systems with the Yocto Project" FREE SAMPLE CHAPTER SHARE WITH OTHERS �f, � � � � Embedded Linux Systems with the Yocto ProjectTM This page intentionally left blank Embedded Linux Systems with the Yocto ProjectTM Rudolf J. Streif Boston • Columbus • Indianapolis • New York • San Francisco • Amsterdam • Cape Town Dubai • London • Madrid • Milan • Munich • Paris • Montreal • Toronto • Delhi • Mexico City São Paulo • Sidney • Hong Kong • Seoul • Singapore • Taipei • Tokyo Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations have been printed with initial capital letters or in all capitals. The author and publisher have taken care in the preparation of this book, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for incidental or consequential damages in connection with or arising out of the use of the information or programs contained herein. For information about buying this title in bulk quantities, or for special sales opportunities (which may include electronic versions; custom cover designs; and content particular to your business, training goals, marketing focus, or branding interests), please contact our corporate sales depart- ment at [email protected] or (800) 382-3419. For government sales inquiries, please contact [email protected]. For questions about sales outside the U.S., please contact [email protected]. Visit us on the Web: informit.com Cataloging-in-Publication Data is on file with the Library of Congress. -
Cp 99, Other Filing/Pleading, 11/12/2014
BINGHAM Catherine Wang Brett P. Ferenchak catherine. wang@ bingham. com [email protected] November 11, 2014 Via Overnight Courier and E-Mail Oregon Public Utility Commission Attn: Filing Center 550 Capitol Street, N.E. Suite 215 Salem, OR 97301-2551 [email protected] Re: Business Telecom, LLC d/b/a EarthLink Business I Notification of Conversion and Associated Name Change Dear Sir or Madam: Business Telecom, LLC d/b/a EarthLink Business I (formerly known as Business Telecom, Inc. d/b/a EarthLink Business III) (the "Company") hereby notifies the Commission (1) that the Company converted from a North Carolina corporation to a North Carolina limited liability company' and (2) of the associated name change to "Business Telecom, LLC d/b/a EarthLink Business 1." The Company requests that the Commission update its records, including the Company's Certificate,2 to reflect the conversion and associate name change and, to the extent necessary, approve these changes. Attached hereto are the Company's conversion documents and updated authorization to transact business in Oregon and trade name registration. Beijing Boston Frankfurt Hartford Hong Kong London los Angeles New York Orange County San Francisco Santa Monica Silicon Valley Tokyo Washington The conversion of the Company to a limited liability company was merely a change in its corporate form -the conversion was accomplished through the filing of Articles of Bingham McCutchen LLP Conversion in North Carolina and did not entail any merger or other transactions interrupting 2020 K Street NW Washington, DC the existence of the Company. 20006-1806 2 The Company is authorized to provide interexchange telecommunications services pursuant to Order No. -
Operating Systems and Applications for Embedded Systems >>> Toolchains
>>> Operating Systems And Applications For Embedded Systems >>> Toolchains Name: Mariusz Naumowicz Date: 31 sierpnia 2018 [~]$ _ [1/19] >>> Plan 1. Toolchain Toolchain Main component of GNU toolchain C library Finding a toolchain 2. crosstool-NG crosstool-NG Installing Anatomy of a toolchain Information about cross-compiler Configruation Most interesting features Sysroot Other tools POSIX functions AP [~]$ _ [2/19] >>> Toolchain A toolchain is the set of tools that compiles source code into executables that can run on your target device, and includes a compiler, a linker, and run-time libraries. [1. Toolchain]$ _ [3/19] >>> Main component of GNU toolchain * Binutils: A set of binary utilities including the assembler, and the linker, ld. It is available at http://www.gnu.org/software/binutils/. * GNU Compiler Collection (GCC): These are the compilers for C and other languages which, depending on the version of GCC, include C++, Objective-C, Objective-C++, Java, Fortran, Ada, and Go. They all use a common back-end which produces assembler code which is fed to the GNU assembler. It is available at http://gcc.gnu.org/. * C library: A standardized API based on the POSIX specification which is the principle interface to the operating system kernel from applications. There are several C libraries to consider, see the following section. [1. Toolchain]$ _ [4/19] >>> C library * glibc: Available at http://www.gnu.org/software/libc. It is the standard GNU C library. It is big and, until recently, not very configurable, but it is the most complete implementation of the POSIX API. * eglibc: Available at http://www.eglibc.org/home. -
Rmox: a Raw-Metal Occam Experiment
Communicating Process Architectures – 2003 269 Jan F. Broenink and Gerald H. Hilderink (Eds.) IOS Press, 2003 RMoX: A Raw-Metal occam Experiment Fred BARNES†, Christian JACOBSEN† and Brian VINTER‡ † Computing Laboratory, University of Kent, Canterbury, Kent, CT2 7NF, England. {frmb2,clj3}@kent.ac.uk ‡ Department of Mathematics and Computer Science, University of Southern Denmark, Odense, Denmark. [email protected] Abstract. Operating-systems are the core software component of many modern com- puter systems, ranging from small specialised embedded systems through to large distributed operating-systems. This paper presents RMoX: a highly concurrent CSP- based operating-system written in occam. The motivation for this stems from the overwhelming need for reliable, secure and scalable operating-systems. The major- ity of operating-systems are written in C, a language that easily offers the level of flexibility required (for example, interfacing with assembly routines). C compilers, however, provide little or no mechanism to guard against race-hazard and aliasing er- rors, that can lead to catastrophic run-time failure (as well as to more subtle errors, such as security loop-holes). The RMoX operating-system presents a novel approach to operating-system design (although this is not the first CSP-based operating-system). Concurrency is utilised at all levels, resulting in a system design that is well defined, easily understood and scalable. The implementation, using the KRoC extended oc- cam, provides guarantees of freedom from race-hazard and aliasing errors, and makes extensive use of the recently added support for dynamic process creation and channel mobility. Whilst targeted at mainstream computing, the ideas and methods presented are equally applicable for small-scale embedded systems — where advantage can be made of the lightweight nature of RMoX (providing fast interrupt responses, for ex- ample). -
Porting Musl to the M3 Microkernel TU Dresden
Porting Musl to the M3 microkernel TU Dresden Sherif Abdalazim, Nils Asmussen May 8, 2018 Contents 1 Abstract 2 2 Introduction 3 2.1 Background.............................. 3 2.2 M3................................... 4 3 Picking a C library 5 3.1 C libraries design factors . 5 3.2 Alternative C libraries . 5 4 Porting Musl 7 4.1 M3andMuslbuildsystems ..................... 7 4.1.1 Scons ............................. 7 4.1.2 GNUAutotools........................ 7 4.1.3 Integrating Autotools with Scons . 8 4.2 Repositoryconfiguration. 8 4.3 Compilation.............................. 8 4.4 Testing ................................ 9 4.4.1 Syscalls ............................ 9 5 Evaluation 10 5.1 PortingBusyboxcoreutils . 10 6 Conclusion 12 1 Chapter 1 Abstract Today’s processing workloads require the usage of heterogeneous multiproces- sors to utilize the benefits of specialized processors and accelerators. This has, in turn, motivated new Operating System (OS) designs to manage these het- erogeneous processors and accelerators systematically. M3 [9] is an OS following the microkernel approach. M3 uses a hardware/- software co-design to exploit the heterogeneous systems in a seamless and effi- cient form. It achieves that by abstracting the heterogeneity of the cores via a Data Transfer Unit (DTU). The DTU abstracts the heterogeneity of the cores and accelerators so that they can communicate systematically. I have been working to enhance the programming environment in M3 by porting a C library to M3. I have evaluated different C library implementations like the GNU C Library (glibc), Musl, and uClibc. I decided to port Musl as it has a relatively small code base with fewer configurations. It is simpler to port, and it started to gain more ground in embedded systems which are also a perfect match for M3 applications. -
Creating Ipsec and SSL/TLS Tunnels in Linux What's New
FACEBOOK | WEBGOAT | TOR | DNS | SLEUTHKIT | PACKETFENCE LINUX JOURNAL ™ UU Getting the Most Out of GCC UU Securing Open-Source Phones SECURITY UU How to Store Passwords Safely UU New Column: Hack and / Since 1994: The Original Magazine of the Linux Community JANUARY 2008 | ISSUE 165 Facebook | WebGoat | Tor | DNS | Sleuthkit | PacketFence | GCC Qtopia SXE VPNs | DNS Sleuthkit PacketFence | Tor | WebGoat Facebook SECURITY UU Learn the Path to a More Secure System UU Use Autopsy and Sleuthkit to Analyse Security Breaches UU Discover Dangerous Flaws in Your DNS Infrastructure JANUARY www.linuxjournal.com 2008 Creating IPsec and SSL/TLS $5.99US $6.99CAN 01 ISSUE + Tunnels in Linux 165 What’s New with Eric Raymond? 0 74470 03102 4 lj023:lj018.qxd 11/12/2007 5:36 PM Page 1 The Straight Talk People SM SINCE 1991 ABERDEEN TRUE QUAD-CORE SERVERS. UP TO 16 INDIVIDUAL CORES. ABERDEEN STONEHAVEN A135 ABERDEEN STONEHAVEN A151 ABERDEEN STONEHAVEN A284 Four Quad-Cores 1U 3TB Quad Quad-Core HPC Server 1U 4TB Dual Quad-Core Server 2U 8TB Dual Quad-Core Server • Up to four Quad-Core AMD Opteron™ 8000 Series processors • Up to two Quad-Core AMD Opteron 2000 Series processors • Up to two Quad-Core AMD Opteron 2000 Series processors • nVIDIA nForce Pro Chipset with 64-Bit Support • nVIDIA nForce Pro Chipset with 64-Bit Support • nVIDIA nForce Pro Chipset with 64-Bit Support • Up to 64GB 667MHz ECC Registered DDR2 SDRAM • Up to 32GB 667MHz ECC Registered DDR2 SDRAM • Up to 64GB 667MHz ECC Registered DDR2 SDRAM • Up to 3 x 1TB (3TB Total) Hot-Swap SATA Hard -
Rockjit: Securing Just-In-Time Compilation Using Modular Control-Flow Integrity
RockJIT: Securing Just-In-Time Compilation Using Modular Control-Flow Integrity Ben Niu Gang Tan Lehigh University Lehigh University 19 Memorial Dr West 19 Memorial Dr West Bethlehem, PA, 18015 Bethlehem, PA, 18015 [email protected] [email protected] ABSTRACT For performance, modern managed language implementations Managed languages such as JavaScript are popular. For perfor- adopt Just-In-Time (JIT) compilation. Instead of performing pure mance, modern implementations of managed languages adopt Just- interpretation, a JIT compiler dynamically compiles programs into In-Time (JIT) compilation. The danger to a JIT compiler is that an native code and performs optimization on the fly based on informa- attacker can often control the input program and use it to trigger a tion collected through runtime profiling. JIT compilation in man- vulnerability in the JIT compiler to launch code injection or JIT aged languages is the key to high performance, which is often the spraying attacks. In this paper, we propose a general approach only metric when comparing JIT engines, as seen in the case of called RockJIT to securing JIT compilers through Control-Flow JavaScript. Hereafter, we use the term JITted code for native code Integrity (CFI). RockJIT builds a fine-grained control-flow graph that is dynamically generated by a JIT compiler, and code heap for from the source code of the JIT compiler and dynamically up- memory pages that hold JITted code. dates the control-flow policy when new code is generated on the fly. In terms of security, JIT brings its own set of challenges. First, a Through evaluation on Google’s V8 JavaScript engine, we demon- JIT compiler is large and usually written in C/C++, which lacks strate that RockJIT can enforce strong security on a JIT compiler, memory safety. -
Code and Control Flow Integrity for COTS Binaries
Control Flow and Code Integrity for COTS binaries: An Effective Defense Against Real-World ROP Attacks ∗ Mingwei Zhang R. Sekar Security & Privacy Research Stony Brook University Intel Labs Stony Brook [email protected] [email protected] ABSTRACT bitrary (i.e., Turing-complete) computation. While Turing Despite decades of sustained effort, memory corruption at- completeness is an attractive property that is often the topic tacks continue to be one of the most serious security threats of research papers, real-world ROP attacks have had a more faced today. They are highly sought after by attackers, limited objective: stringing together a small set of gadgets as they provide ultimate control | the ability to execute to bypass DEP. arbitrary low-level code. Attackers have shown time and Control flow integrity (CFI) [16] is a well-known counter- again their ability to overcome widely deployed countermea- measure against control-flow hijack attacks. Such attacks sures such as Address Space Layout Randomization (ASLR) typically rely on memory corruption vulnerabilities to over- and Data Execution Prevention (DEP) by crafting Return write code pointers, e.g., return addresses on the stack, or Oriented Programming (ROP) attacks. Although Turing- variables containing function pointers. CFI thwarts most complete ROP attacks have been demonstrated in research such attacks by constraining the targets of indirect control- papers, real-world ROP payloads have had a more limited flow transfers to be consistent with a statically computed objective: that of disabling DEP so that injected native code control-flow graph. Many research efforts have demonstrated attacks can be carried out. In this paper, we provide a that CFI can be implemented within a compiler [46, 44] or systematic defense, called Control Flow and Code Integrity on binaries [66, 63], and moreover, can be applied to large (CFCI), that makes injected native code attacks impossible. -
Operating System Components for an Embedded Linux System
INSTITUTEFORREAL-TIMECOMPUTERSYSTEMS TECHNISCHEUNIVERSITATM¨ UNCHEN¨ PROFESSOR G. F ARBER¨ Operating System Components for an Embedded Linux System Martin Hintermann Studienarbeit ii Operating System Components for an Embedded Linux System Studienarbeit Executed at the Institute for Real-Time Computer Systems Technische Universitat¨ Munchen¨ Prof. Dr.-Ing. Georg Farber¨ Advisor: Prof.Dr.rer.nat.habil. Thomas Braunl¨ Author: Martin Hintermann Kirchberg 34 82069 Hohenschaftlarn¨ Submitted in February 2007 iii Acknowledgements At first, i would like to thank my supervisor Prof. Dr. Thomas Braunl¨ for giving me the opportunity to take part at a really interesting project. Many thanks to Thomas Sommer, my project partner, for his contribution to our good work. I also want to thank also Bernard Blackham for his assistance by email and phone at any time. In my opinion, it was a great cooperation of all persons taking part in this project. Abstract Embedded systems can be found in more and more devices. Linux as a free operating system is also becoming more and more important in embedded applications. Linux even replaces other operating systems in certain areas (e.g. mobile phones). This thesis deals with the employment of Linux in embedded systems. Various architectures of embedded systems are introduced and the characteristics of common operating systems for these devices are reviewed. The architecture of Linux is examined by looking at the particular components such as kernel, standard C libraries and POSIX tools for embedded systems. Furthermore, there is a survey of real-time extensions for the Linux kernel. The thesis also treats software development for embedded Linux ranging from the prerequi- sites for compiling software to the debugging of binaries. -
Anatomy of Cross-Compilation Toolchains
Embedded Linux Conference Europe 2016 Anatomy of cross-compilation toolchains Thomas Petazzoni free electrons [email protected] Artwork and Photography by Jason Freeny free electrons - Embedded Linux, kernel, drivers - Development, consulting, training and support. http://free-electrons.com 1/1 Thomas Petazzoni I CTO and Embedded Linux engineer at Free Electrons I Embedded Linux specialists. I Development, consulting and training. I http://free-electrons.com I Contributions I Kernel support for the Marvell Armada ARM SoCs from Marvell I Major contributor to Buildroot, an open-source, simple and fast embedded Linux build system I Living in Toulouse, south west of France Drawing from Frank Tizzoni, at Kernel Recipes 2016 free electrons - Embedded Linux, kernel, drivers - Development, consulting, training and support. http://free-electrons.com 2/1 Disclaimer I I am not a toolchain developer. Not pretending to know everything about toolchains. I Experience gained from building simple toolchains in the context of Buildroot I Purpose of the talk is to give an introduction, not in-depth information. I Focused on simple gcc-based toolchains, and for a number of examples, on ARM specific details. I Will not cover advanced use cases, such as LTO, GRAPHITE optimizations, etc. I Will not cover LLVM free electrons - Embedded Linux, kernel, drivers - Development, consulting, training and support. http://free-electrons.com 3/1 What is a cross-compiling toolchain? I A set of tools that allows to build source code into binary code for -
Design and Implementation of Embedded Linux System for Networking Devices
Design and Implementation of Embedded Linux System for Networking Devices Hyun-Joon Cha Distributed Processing and Network Management Laboratory Division of Electrical and Computer Engineering (Computer Science and Engineering) [email protected] POSTECH Design and Implementation of Embedded Linux System (1/24) DP&NM Lab. for Networking Devices Contents • Introduction • Current Embedded Operating Systems • Requirements • Design of Embedded Linux System • Implementation • Conclusions • Future work POSTECH Design and Implementation of Embedded Linux System (2/24) DP&NM Lab. for Networking Devices Introduction • Networking Devices – Devices which has networking capability – Infrastructure of emerging information society • e.g.) Router, Switch, Gateway, Cache engine, Cellular phone, PDA, etc. – Network-capable devices will substitute current dummy and not- connected devices all around – Need more resources, processing power and OSs to coordinate it – Most networking devices use commercial Real-time OSs POSTECH Design and Implementation of Embedded Linux System (3/24) DP&NM Lab. for Networking Devices Introduction – cont’d • Embedded OSs for Networking Devices – Commercial: VxWorks, pSOS, QNX, Nucleus, LynxOS, VRTX, etc. – Free or Almost Free: Xinu, uC/OS, etc. • Frequently Raised Problems from Industry and Academy – No OS approach or using educational OS is harmful – High purchase price and royalty -> affect development cost and device price – Limited target and development platform – OS specific architecture and interface – Technology