1. Lecture 2 Page 1 CS 236 Online Prolog to Lecture 2 CS 236 On-Line MS Program Networks and Systems Security Peter Reiher

2. Lecture 2 Page 2 CS 236 Online What’s This Prolog Stuff? When I can, I will add a short presentation to each lecture Discussing application of material from the previous or recent lectures Generally stuff that’s pretty timely

3. Lecture 2 Page 3 CS 236 Online Do We Really Care About Security? Security gets a lot of lip-service But is the community out there really behind it? –Particularly the industrial community that builds our software? Three recent stories suggest maybe not

4. Lecture 2 Page 4 CS 236 Online 1. Fun With Firewire Many computers have firewire interfaces –Especially laptops These interfaces allow direct access to memory –No access control –No nuthin’

5. Lecture 2 Page 5 CS 236 Online What’s That Mean? Anyone who hooks up a firewire device to your laptop doesn’t need to log in He can just read and alter the memory Proof-of-concept tool 1 allows you to own Windows machine in seconds – 1 http://www.darkreading.com/document.asp?doc_id=147713&f_src=drweekly

6. Lecture 2 Page 6 CS 236 Online What’s the Response? “Well, duh, that’s what Firewire is supposed to do” In other words, we designed your computer to let anyone take it over –If they have physical access All this login stuff is just window dressing to impress the rubes

7. Lecture 2 Page 7 CS 236 Online 2. Backdoor Processors Many devices come with complete processors “hidden” inside –Printers, routers, storage devices, etc. They’re installed with complete OSes –Often very badly configured Allowing anyone access E.g., Samsung printers had default admin account (2012)

8. Lecture 2 Page 8 CS 236 Online The Implications If attacker knows about these, And you don’t, He’s got a hidden backdoor into your system Often these processors have network capabilities And can access the CPU you already knew you had

9. Lecture 2 Page 9 CS 236 Online What’s That Mean? The people who put these processors in neither knew nor cared about security System management (the purpose of them) was more important They didn’t care enough to even mention they were there

10. Lecture 2 Page 10 CS 236 Online 3. Apple Patching Everyone knows Macs are “more secure” than Windows machines Well, they’re not Study 1 shows Apple: –Has more vulnerabilities –Takes longer to patch them –Suffers more attacks on unpatched flaws 1 http://www.techzoom.net/papers/blackhat_0day_patch_2008.pdf

11. Lecture 2 Page 11 CS 236 Online What’s That Mean? Apple wasn’t entirely honest about really caring about security They weren’t spending the money to patch flaws –And they have plenty to patch They’re talking the talk, not walking the walk

12. Lecture 2 Page 12 CS 236 Online The General Lesson Just because people say they care about security doesn’t mean they do Many decisions seem to be made without even considering security implications