Computer Security 03
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Secure Programming II: the Revenge
Secure Programming II: The Revenge Lecture for 5/11/20 (slides from Prof. Dooley) CS 330 Secure Programming 13 Administrivia • Seminar on Tuesday (5/12, 7pm): Tech Career Tips and Strategies for International Students (Extra credit!) • HW 6 (password cracking) due Thursday night CS 330 Secure Programming Recall: Secure programming problems • Buffer overflow • Resource exhaustion • Incomplete mediation (checking valid data) • Time-of-check to time-of-use errors • Other race conditions • Numeric over/underflow • Trust in general (users and privileges, environment variables, trusting other programs) CS 330 Secure Programming 15 General principles of secure software • Simplicity is a virtue • If code is complex, you don’t know if it’s right (but it probably isn’t) • In a complex system, isolate the security-critical modules. Make them simple • Modules should have a clean, clear, precisely defined interface CS 330 Secure Programming 16 General principles of secure software - 2 • Reliance on global state is bad (usually) • Reliance on global variables is bad (usually) • Use of explicit parameters makes input assumptions explicit • Validate all input data • Don’t trust tHe values of environment variables • Don’t trust library functions tHat copy data CS 330 Secure Programming 17 Buffer Overflows CS 330 Secure Programming Buffer Overflow • 1988: Morris worm exploits buffer overflows in fingerd to infect 6,000 Unix servers • 2001: Code Red exploits buffer overflows in IIS to infect 250,000 servers – Single largest cause of vulnerabilities in CERT advisories – Buffer overflow threatens Internet- WSJ(1/30/01) • CERT advisory dated 12 April 2005 notes several vulnerabilities in MS Windows, including three buffer overflows in Explorer, MSN Messenger, and MS Exchange Server. -
Version 7.8-Systemd
Linux From Scratch Version 7.8-systemd Created by Gerard Beekmans Edited by Douglas R. Reno Linux From Scratch: Version 7.8-systemd by Created by Gerard Beekmans and Edited by Douglas R. Reno Copyright © 1999-2015 Gerard Beekmans Copyright © 1999-2015, Gerard Beekmans All rights reserved. This book is licensed under a Creative Commons License. Computer instructions may be extracted from the book under the MIT License. Linux® is a registered trademark of Linus Torvalds. Linux From Scratch - Version 7.8-systemd Table of Contents Preface .......................................................................................................................................................................... vii i. Foreword ............................................................................................................................................................. vii ii. Audience ............................................................................................................................................................ vii iii. LFS Target Architectures ................................................................................................................................ viii iv. LFS and Standards ............................................................................................................................................ ix v. Rationale for Packages in the Book .................................................................................................................... x vi. Prerequisites -
INNOV-04 the SANS Top 20 Internet Security Vulnerabilities (And What It Means to Openedge™ Applications)
INNOV-04 The SANS Top 20 Internet Security Vulnerabilities (and what it means to OpenEdge™ Applications) Michael Solomon, CISSP PMP CISM Solomon Consulting Inc. www.solomonconsulting.com (Thanks to John Bruggeman for presentation input) What is the SANS Top 20 SANS and FBI / NIPC created list in 2000 10 Windows vulnerabilities 10 Unix vulnerabilities – 90% of all computer security breaches are caused by known vulnerabilities (Gartner Group 2002) Tools to detect and repair the Top 20 – Many referenced tools help detect and repair many more than the Top 20 Vulnerabilities INNOV-04, SANS Top 20 Security Vulnerabilities 2 How do these vulnerabilities affect OpenEdge applications? OpenEdge is not specifically mentioned – Many vulnerabilities on the list still apply to OpenEdge application systems – Interpret each vulnerability in terms of your system Any system vulnerability affects your OpenEdge application INNOV-04, SANS Top 20 Security Vulnerabilities 3 Windows Top 10 – www.sans.org/top20/#w1 1. Web Servers and Services 2. Workstation Service 3. Windows Remote Access Services (not RAS) 4. Microsoft SQL Server 5. Windows Authentication 6. Web Browsers 7. File-Sharing Applications 8. LSAS Exposures 9. Mail Client 10. Instant Messaging INNOV-04, SANS Top 20 Security Vulnerabilities 4 W1: Web Servers and Services Risks of default installations – Denial of service (DoS) – Compromise server and data – Execution of arbitrary commands All web servers are affected, including – Internet Information Server (IIS) • Even though IIS 6.0 is ‘secure -
Powerview Command Reference
PowerView Command Reference TRACE32 Online Help TRACE32 Directory TRACE32 Index TRACE32 Documents ...................................................................................................................... PowerView User Interface ............................................................................................................ PowerView Command Reference .............................................................................................1 History ...................................................................................................................................... 12 ABORT ...................................................................................................................................... 13 ABORT Abort driver program 13 AREA ........................................................................................................................................ 14 AREA Message windows 14 AREA.CLEAR Clear area 15 AREA.CLOSE Close output file 15 AREA.Create Create or modify message area 16 AREA.Delete Delete message area 17 AREA.List Display a detailed list off all message areas 18 AREA.OPEN Open output file 20 AREA.PIPE Redirect area to stdout 21 AREA.RESet Reset areas 21 AREA.SAVE Save AREA window contents to file 21 AREA.Select Select area 22 AREA.STDERR Redirect area to stderr 23 AREA.STDOUT Redirect area to stdout 23 AREA.view Display message area in AREA window 24 AutoSTOre .............................................................................................................................. -
Chapter 11 – Buffer Overflow
Computer Security: Principles and Practice ChapterChapter 1111 –– BufferBuffer OverflowOverflow First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Buffer Overflow • a very common attack mechanism – from 1988 Morris Worm to Code Red, Slammer, Sasser and many others • prevention techniques known • still of major concern due to – legacy of widely deployed buggy – continued careless programming techniques 2 Buffer Overflow Basics • caused by programming error • allows more data to be stored than capacity available in a fixed sized buffer – buffer can be on stack, heap, global data • overwriting adjacent memory locations – corruption of program data – unexpected transfer of control – memory access violation – execution of code chosen by attacker 3 int main( int argc, char * argv[]) { int valid = FALSE; Buffer char str1[8]; char str2[8]; Overflow next_tag(str1); gets(str2); Example if (strncmp(str1, str2, 8) == 0) valid = TRUE; printf("buffer1: str1(%s), str2(%s), valid(%d)\n", st r1, str2, valid); } $ cc -g -o buffer1 buffer1.c $ ./buffer1 START buffer1: str1(START), str2(START), valid(1) $ ./buffer1 EVILINPUTVALUE buffer1: str1(TVALUE), str2(EVILINPUTVALUE), valid(0) $ ./buffer1 BADINPUTBADINPUT buffer1: str1(BADINPUT), str2(BADINPUTBADINPUT), valid(1) 4 Buffer Memory Before After Contains Address gets(str2) gets(str2) Value of Overflow . Example bffffbf4 34fcffbf 34fcffbf argv 4 . 3 . bffffbf0 01000000 01000000 argc . bffffbec c6bd0340 c6bd0340 return . @ . @ addr bffffbe8 08fcffbf 08fcffbf old base . ptr bffffbe4 00000000 01000000 valid . bffffbe0 80640140 00640140 . d . @ . d . @ bffffbdc 54001540 4e505554 str1[4-7] T . @ N P U T bffffbd8 53544152 42414449 str1[0-3] S T A R B A D I bffffbd4 00850408 4e505554 str2[4-7] . -
Rhd256.Bowez Notes.2006-07-20.Txt Thu Jul 20 15:31
../rhd256.bowez_notes.2006-07-20.txt Thu Jul 20 15:31:29 2006 1 ==> ./01_intro/notes.txt <== ---------------------------------------------------------------------- ---------------------------------------------------------------------- 2.3 Bash Special Characaters 1.3 Prerequisates ---------------------------------------------------------------------- ---------------------------------------------------------------------- ------------------------------------------------------------------ Familiarity: Redirection (Stream Manipulation) ------------------------------------------------------------------ the classroom setup (server1, station1, etc...) the "pub" directory every process has three default file descriptors (streams): Common Tools: 0: stdin 1: stdout terminal: 2: stderr changing fonts, etc.... - by default, all are connected to the terminal. editors: - In RHL, can be accessed by /dev/std{in,out,err} emacs vi, vim, gvim < redirect descriptor input pico -w, gedit > redirect descriptor output (create or clobber) (less pager) >> redirect descriptor output (create or append) finding information: 2>&1 bind one descriptor to another (i.e., combine stderr and stdout) --help, -h >& bash shortcut for the same man pages (chapters) info pages (info, pinfo, nautilus) examples: /usr/share/doc grep root /etc/* rpm (-qf filename, -ql, -qi) grep root /etc/* > /tmp/out grep root /etc/* 2> /tmp/err ---------------------------------------------------------------------- grep root /etc/* > /tmp/out2 2> /tmp/err2 grep root /etc/* >& /tmp/all 1.4 Procedures -
11.6. Tempfile — Generate Temporary Files and Directories — Python V2
Navigation • index • modules | • next | • previous | • Python v2.6.4 documentation » • The Python Standard Library » • 11. File and Directory Access » 11.6. tempfile — Generate temporary files and directories¶ This module generates temporary files and directories. It works on all supported platforms. In version 2.3 of Python, this module was overhauled for enhanced security. It now provides three new functions, NamedTemporaryFile(), mkstemp(), and mkdtemp(), which should eliminate all remaining need to use the insecure mktemp() function. Temporary file names created by this module no longer contain the process ID; instead a string of six random characters is used. Also, all the user-callable functions now take additional arguments which allow direct control over the location and name of temporary files. It is no longer necessary to use the global tempdir and template variables. To maintain backward compatibility, the argument order is somewhat odd; it is recommended to use keyword arguments for clarity. The module defines the following user-callable functions: tempfile.TemporaryFile([mode='w+b'[, bufsize=-1[, suffix=''[, prefix='tmp'[, dir=None]]]]])¶ Return a file-like object that can be used as a temporary storage area. The file is created using mkstemp(). It will be destroyed as soon as it is closed (including an implicit close when the object is garbage collected). Under Unix, the directory entry for the file is removed immediately after the file is created. Other platforms do not support this; your code should not rely on a temporary file created using this function having or not having a visible name in the file system. The mode parameter defaults to 'w+b' so that the file created can be read and written without being closed. -
GNU Coreutils Cheat Sheet (V1.00) Created by Peteris Krumins ([email protected], -- Good Coders Code, Great Coders Reuse)
GNU Coreutils Cheat Sheet (v1.00) Created by Peteris Krumins ([email protected], www.catonmat.net -- good coders code, great coders reuse) Utility Description Utility Description arch Print machine hardware name nproc Print the number of processors base64 Base64 encode/decode strings or files od Dump files in octal and other formats basename Strip directory and suffix from file names paste Merge lines of files cat Concatenate files and print on the standard output pathchk Check whether file names are valid or portable chcon Change SELinux context of file pinky Lightweight finger chgrp Change group ownership of files pr Convert text files for printing chmod Change permission modes of files printenv Print all or part of environment chown Change user and group ownership of files printf Format and print data chroot Run command or shell with special root directory ptx Permuted index for GNU, with keywords in their context cksum Print CRC checksum and byte counts pwd Print current directory comm Compare two sorted files line by line readlink Display value of a symbolic link cp Copy files realpath Print the resolved file name csplit Split a file into context-determined pieces rm Delete files cut Remove parts of lines of files rmdir Remove directories date Print or set the system date and time runcon Run command with specified security context dd Convert a file while copying it seq Print sequence of numbers to standard output df Summarize free disk space setuidgid Run a command with the UID and GID of a specified user dir Briefly list directory -
Constraints in Dynamic Symbolic Execution: Bitvectors Or Integers?
Constraints in Dynamic Symbolic Execution: Bitvectors or Integers? Timotej Kapus, Martin Nowack, and Cristian Cadar Imperial College London, UK ft.kapus,m.nowack,[email protected] Abstract. Dynamic symbolic execution is a technique that analyses programs by gathering mathematical constraints along execution paths. To achieve bit-level precision, one must use the theory of bitvectors. However, other theories might achieve higher performance, justifying in some cases the possible loss of precision. In this paper, we explore the impact of using the theory of integers on the precision and performance of dynamic symbolic execution of C programs. In particular, we compare an implementation of the symbolic executor KLEE using a partial solver based on the theory of integers, with a standard implementation of KLEE using a solver based on the theory of bitvectors, both employing the popular SMT solver Z3. To our surprise, our evaluation on a synthetic sort benchmark, the ECA set of Test-Comp 2019 benchmarks, and GNU Coreutils revealed that for most applications the integer solver did not lead to any loss of precision, but the overall performance difference was rarely significant. 1 Introduction Dynamic symbolic execution is a popular program analysis technique that aims to systematically explore all the paths in a program. It has been very successful in bug finding and test case generation [3, 4]. The research community and industry have produced many tools performing symbolic execution, such as CREST [5], FuzzBALL [9], KLEE [2], PEX [14], and SAGE [6], among others. To illustrate how dynamic symbolic execution works, consider the program shown in Figure 1a. -
NSWI 0138: Advanced Unix Programming
NSWI 0138: Advanced Unix programming (c) 2011-2016 Vladim´ırKotal (c) 2009-2010 Jan Pechanec, Vladim´ırKotal SISAL MFF UK, Malostransk´en´am.25, 118 00 Praha 1 Charles University Czech Republic Vladim´ırKotal [email protected] March 10, 2016 1 Vladim´ırKotal NSWI 0138 (Advanced Unix programming) Contents 1 Overview 5 1.1 What is this lecture about? . .5 1.2 The lecture will cover... .5 1.3 A few notes on source code files . .6 2 Testing 6 2.1 Why?...........................................6 2.2 When ? . .6 2.3 Types of testing . .7 3 Debugging 8 3.1 Debuging in general . .8 3.2 Observing . .9 3.3 Helper tools . .9 3.3.1 ctags . .9 3.3.2 cscope . 10 3.3.3 OpenGrok . 11 3.3.4 Other tools . 11 3.4 Debugging data . 11 3.4.1 stabs . 11 3.4.2 DWARF . 12 3.4.3 CTF (Compact C Type Format) . 12 3.5 Resource leaks . 13 3.6 libumem . 13 3.6.1 How does libumem work . 14 3.6.2 Using libumem+mdb to find memory leaks . 14 3.6.3 How does ::findleaks work . 16 3.7 watchmalloc . 17 3.8 Call tracing . 18 3.9 Using /proc . 19 3.10 Debugging dynamic libraries . 20 3.11 Debuggers . 20 3.12 Symbol search and interposition . 20 3.13 dtrace . 21 4 Terminals 21 4.1 Terminal I/O Overview . 21 4.2 Terminal I/O Overview (cont.) . 22 4.3 Physical (Hardware) Terminal . 24 4.4 stty(1) command . 24 4.5 TTY Driver Connected To a Phy Terminal . -
Stack Buffer Overflow
1 Stack Buffer Overflow Chengyu Song Slides modified from Dawn Song 2 Infection vectors of malware • Human assistant, unknowingly • Exploiting vulnerabilities • We see the term "buffer overflow" several time, but • What is buffer overflow? • Why it would allow attackers/malware to get into the system? 3 Software security • Surround a central topic vulnerabilities • What is a vulnerability? • What types of vulnerabilities are there? • How do we find vulnerabilities? • How do we fix vulnerabilities? • How do we exploit vulnerabilities? • How do we prevent exploits? 4 Software vulnerability A vulnerability is a weakness in a software that could allow an attacker to compromise the information assurance of the system. -- Wikipedia “• Weakness: bugs, configure errors, etc. • Information assurance: confidentiality, integrity, availability, etc. 5 Exploit An exploit is a piece of input that takes advantage of a vulnerability in order to cause unintended behavior -- Wikipedia “• Input: file, data, program, etc. • Unintended behavior: arbitrary code execution, privilege escalation, denial- of-service (DoS), information leak, etc. 6 Putting things together --OWASP 7 Popular types of vulnerabilities • Memory corruption • Buffer overflow, use-after-free, uninitialized data access, etc. • Improper input sanitation (a.k.a. injection attacks) • SQL injection, command injection, cross-site script (XSS), etc. • Insufficient Authentication/authorization • Missing checks, hardcoded credential, backdoor, etc. • Incorrect use of crypto primitives • Weak primitives (encryption, -
Advanced Bash-Scripting Guide
Advanced Bash−Scripting Guide An in−depth exploration of the art of shell scripting Mendel Cooper <[email protected]> 5.0 24 June 2007 Revision History Revision 4.2 10 Dec 2006 Revised by: mc 'SPARKLEBERRY' release: Important Update. Revision 4.3 29 Apr 2007 Revised by: mc 'INKBERRY' release: Minor Update. Revision 5.0 24 Jun 2007 Revised by: mc 'SERVICEBERRY' release: Major Update. This tutorial assumes no previous knowledge of scripting or programming, but progresses rapidly toward an intermediate/advanced level of instruction . all the while sneaking in little snippets of UNIX® wisdom and lore. It serves as a textbook, a manual for self−study, and a reference and source of knowledge on shell scripting techniques. The exercises and heavily−commented examples invite active reader participation, under the premise that the only way to really learn scripting is to write scripts. This book is suitable for classroom use as a general introduction to programming concepts. The latest update of this document, as an archived, bzip2−ed "tarball" including both the SGML source and rendered HTML, may be downloaded from the author's home site. A pdf version is also available ( pdf mirror site). See the change log for a revision history. Dedication For Anita, the source of all the magic Advanced Bash−Scripting Guide Table of Contents Chapter 1. Why Shell Programming?...............................................................................................................1 Chapter 2. Starting Off With a Sha−Bang.......................................................................................................3