Presentation is loading. Please wait.

Presentation is loading. Please wait.

Introduction to Computer Security David Brumley Carnegie Mellon University.

Similar presentations


Presentation on theme: "Introduction to Computer Security David Brumley Carnegie Mellon University."— Presentation transcript:

1 Introduction to Computer Security David Brumley Carnegie Mellon University

2 Today: Overview Course Staff Trusting Trust Course Overview Example Applications Course Mechanics CMU CTF Team 2

3 You will find at least one error on each set of slides. :) 3

4 4 David Brumley B.A. Math UNC 1998 M.S. CS Stanford 2003 Ph.D. CS CMU 2008 Computer security officer, Stanford University, Assistant Professor, CMU, Jan 2009

5 Current Research Thrusts Automatic Exploit Generation – AEG and Mayhem Binary code analysis – Decompilation Vetting whole systems 5

6 Teaching Assistants 1.Zack Weinberg 2.Peter Chapman 6

7 Trust Trusting 7

8 Do you trust his Software? 8 Photo from file/view/thompson.c lg.jpg/ /thompson.c lg.jpg

9 Ken Thompson Co-Creator of UNIX and C Turing Award:

10 10 Compiler

11 11 Compiler if(program == “login”) add-login-backdoor(); if(program == “compiler”) add-compiler-backdoor();

12 Ken Thompson Co-Creator of UNIX and C Turing Award: Hacker

13 Would you trust Mother Teresa’s software? 13

14 14 Sanitize the environment when invoking external programs Do not call system() if you do not need a command processor Exclude user input from format strings Use the readlink() function properly Do not subtract or compare pointers that do not refer to the same array Mask signals handled by noninterruptible signal handlers Ensure that unsigned integer operations do not wrap Guarantee that array and vector indices are within bounds Would you trust Mother Teresa’s software?

15 15 Surely cryptographers code must be secure? Ron Rivest Adi Shamir Len Adleman Picture from

16 Perfect Cryptography Exists! We’re no better off guessing what an encrypted message contains given the ciphertext. - Claude Shannon 16

17 But implementations may still leak message decrypt(ciphertext c, private_key k){ plaintext m; if(k == 1) m = time t 1 decryption ops; return m; if(k == 2) m = time t 2 decryption ops; return m; if(k == 3) m = time t 3 decryption ops; return m;.... }

18 18 Isn’t this networking? Routers run an operating system, which hackers now target

19 Even GPS runs: Webservers FTP servers Network time daemons 19

20 20 Security is many things

21 This Class: Introduction to the Four Research Cornerstones of Security 21 Software Security Network Security OS SecurityCryptography

22 22 Course Topics Your job: become conversant in these topics

23 Software Security 23

24 Control Flow Hijacks 24 shellcode (aka payload)padding&buf computation + control Allow attacker ability to run arbitrary code – Install malware – Steal secrets – Send spam

25 25

26 26

27 27

28 Software Security Recognize and exploit vulnerabilities – Format string – Buffer overflow – Gist of other control flow hijacks, e.g., heap overflow Understand defenses in theory and practice – ASLR – DEP – Canaries – Know the limitations! 28

29 Cryptography 29

30 Everyday Cryptography ATM’s On-line banking SSH Kerberos

31 AliceBob M Public Channel Adversary Eve: A very clever person

32 AliceBob M Public Channel Adversary Eve: A very clever person Cryptography’s Goals: – Data Privacy – Data Integrity – Data Authenticity

33 AliceBob M Public Channel Adversary Eve: A very clever person Cryptonium Pipe

34 AliceBob M Public Channel Adversary Eve: A very clever person Cryptonium Pipe Cryptography’s Goals: – Privacy – Integrity – Authenticity

35 35

36 Goals Understand and believe you should never, ever invent your own algorithm Goals – Encryption – Integrity – Authentication Concepts – Symmetric key crypto – Hashes – Macs – Signatures Example pitfalls 36

37 OS/Systems Security 37

38 38 Principal Reference Monitor Object Requested Operation Approved Operation SourceGuardResource AuthenticationAuthorization In security, we isolate reasoning about the guard

39 39

40 OS Goals Know Lampson’s “gold” standard – Authorization – Authentication – Audit Know currently used security architectures 40

41 Network Security 41

42 42

43 43

44 44

45 Networking Goals Understand the base rate fallacy and it’s application to IDS Be able to recognize and perform basic web attacks State what a DDoS is, and how CDN’s mitigate their effect 45

46 Course Mechanics 46

47 Basics Pre-req: – Basic UNIX development (gcc, gdb, etc.) – or similar is recommended Read all papers before lecture – Read – Underline – Question – Review Course website: 47

48 Workload 3 homework assignments 3 exams, keep highest 2 grades CTF 48

49 CTF Component: Learn Outside the Course Solve 10 CTF problems – Not picoctf.com Videotape the solutions, put on a private youtube. – Make videos private for now See livectf.com for fun 49

50 Basic Mechanics Grading based on: – 3 homeworks (35%) – Highest 2 out of 3 tests (30% each) – Participation and CTF (5%) No late days except under exceptional circumstances. I guarantee at least the following: – %: A – 80-89%: B – 70-79%: C – 60-69%: D – < 59%: F 50

51 ETHICS! Obey the law Do not be a nuisance Don’t cheat, copy others work, let others copy, etc. 51

52 Capture the Flag 52

53 53 CMU Capture the Flag Team

54 54 Red Team Vulnerability Discovery Exploitation Network mapping Web security Blue Team Intrusion detection Hot-patching Firewalls Work-arounds

55 55

56 56

57 10,000 Students in 2,000 teams 57 Size of circle proportional to number of teams

58 58

59 59

60 Example Network Forensics 60

61 PicoCTF 10,000 students 600 teams solving advanced problems – ROP attacks – Breaking incorrect use of modern crypto Identified the best of the best “I learned more in one week than the last two years in CS courses.” 61 If you get an A, you may be eligible to help with PicoCTF 2014

62 62 Questions?

63 END


Download ppt "Introduction to Computer Security David Brumley Carnegie Mellon University."

Similar presentations


Ads by Google