Lab 2 (due 3/11/09)
Ok, this is what I have done so far with lab2.
1) downloaded all files for lab2
2) combed thru lab2exploit.c program
3) combed thru server2.c program
4) updatd lab2exploit.c with new order of assembly commands
5) guessed a number to use for the string size which is larger than 32768 and less than 65536
6) ssh to shasta and passwd
7) ssh to Aleph and passwd (noticed I don't have a user space for diabloo)
8) on Aleph, played with: >% nc 10.0.0.2 8084
Some issues I have had up to this point are:
1) shasta and Aleph have been down almost every time I've tried to log onto them.
2) I'm not sure what the magic number should be. I know the concept of the exploit and the number being too large will be seen as a negative number with a short int variable and thus passes the if validation. Then when the buffer is filled it will be filled passed capacity, upto the return address for when the function finishes its operation. I'm just not sure what value to use to reach this area, and when reached, should this area be filled with another address where the actual asm code is located or should the asm code occupy this area (where the RA is located)?
Wednesday, March 11, 2009
Wednesday, March 4, 2009
CS591 ST 008
Lab 1.5 (due 3/4/09)
After reading Aleph One's paper "Smashing The Stack For Fun And Profit", it seems that the buffer overflow problem can teach us much about exploits in general.
Looking at The Basic Principles of Information Protection by Saltzer and Schroeder, one design principle in particular sticks out: Economy of Mechanism. This single rule seems to play a reverse role in exploits such as Buffer Overflows. High level languages such as C, have been designed to make programming easier for the user. Libraries with functions such as strcpy() were designed to make certain tasks as easy as possible (less complication), not knowing that this will actually cause more problems than it solves.
The lessons from Saltzer and Schroeder isn't that it is good enough to implement a few of these principles but all are very important. Yes, it is important to make your implementation as least complicated as possible but it must be cognizant of underlining issues.
So how does this lesson apply to other or all/most exploits. Most exploits are played off of the idea that something is being done that was not protected against and probably never thought about. I really liked the "Puzzle for February 15, 2006" about how General William T. Sherman used the act of surprise to fight his foes. With program vulnerability, the same follows true. Programs must be written to expect the unexpected. It is never possible to make a 100% full proof program, especially as the complexity and size grows, but it should be possible to ensure the Basic Principles are being implemented to the best of the programmer's abilities.
In my own personal opinion/experience, these principles should be part of every programmer's check list or programming standards. Coding tools (ie. valgrind) should be used to automatically check for the obvious errors (eg. strcpy() vs strncpy()) and other deprecated interfaces. Sometimes, a programmer needs the experience to be able to prevent exploits in his/er code. It is often the case that this experience is not available in a team and code is written without detail knowledge of what is really happening (eg. race conditions, dead locks, etc..).
It makes me cringe when I think about defects from a peer review I have performed were rejected, with the response "...it will just take too long..". This seems to be the attitude and direction many large companies instill in their workers...at least until they get audited...? (stepping down from soap box)
After reading Aleph One's paper "Smashing The Stack For Fun And Profit", it seems that the buffer overflow problem can teach us much about exploits in general.
Looking at The Basic Principles of Information Protection by Saltzer and Schroeder, one design principle in particular sticks out: Economy of Mechanism. This single rule seems to play a reverse role in exploits such as Buffer Overflows. High level languages such as C, have been designed to make programming easier for the user. Libraries with functions such as strcpy() were designed to make certain tasks as easy as possible (less complication), not knowing that this will actually cause more problems than it solves.
The lessons from Saltzer and Schroeder isn't that it is good enough to implement a few of these principles but all are very important. Yes, it is important to make your implementation as least complicated as possible but it must be cognizant of underlining issues.
So how does this lesson apply to other or all/most exploits. Most exploits are played off of the idea that something is being done that was not protected against and probably never thought about. I really liked the "Puzzle for February 15, 2006" about how General William T. Sherman used the act of surprise to fight his foes. With program vulnerability, the same follows true. Programs must be written to expect the unexpected. It is never possible to make a 100% full proof program, especially as the complexity and size grows, but it should be possible to ensure the Basic Principles are being implemented to the best of the programmer's abilities.
In my own personal opinion/experience, these principles should be part of every programmer's check list or programming standards. Coding tools (ie. valgrind) should be used to automatically check for the obvious errors (eg. strcpy() vs strncpy()) and other deprecated interfaces. Sometimes, a programmer needs the experience to be able to prevent exploits in his/er code. It is often the case that this experience is not available in a team and code is written without detail knowledge of what is really happening (eg. race conditions, dead locks, etc..).
It makes me cringe when I think about defects from a peer review I have performed were rejected, with the response "...it will just take too long..". This seems to be the attitude and direction many large companies instill in their workers...at least until they get audited...? (stepping down from soap box)
Monday, February 23, 2009
CS591 ST 008
Lab 0 (due 2/25/09)
Puzzle for January 4, 2006
A student discovers a flaw in the department's computer system. To ensure that the flaw really exists, she exploits it to gain extra privileges on the system. These privileges allow her to read any file on the system, whereas without the privileges, there are files that the student cannot read.
1)Given that there were files she was not supposed to be able to read, did the student act ethically in exploiting the flaw?
2)The computer system did not provide sufficient mechanisms to prevent the student from obtaining the additional privileges. Did she "break in" (that is, breach security) or was her action not a violation of security?
3)The student reports the problem to the department chairperson, who promptly files charges against the student for breaking in. Assuming that what the student did was a violation of security, did the chairperson act ethically?
Answer(s):
1) When this student exploited the system it made her indistinguishablefrom any other hacker/threat. Her actions are considered unethical.
2) This is the common explanation for many unethical action that are computer and non computer related. The idea that "not enough" protection gives one the right to break the weak protection and possibly steal, alter, etc procted data is wrong. There may never be 100% full proof protection for computers (or other entities for that matter). When the flaw was discovered, she should have reported immediately to the system administrator. It is not her responsibility to "check" the security up to the point of criminal actions.
3) This answer to this question was a bit more difficult for me to answer. I had to look up the formal definition of "ethical". It seems to be more about what is considered right and what is considered wrong in a professional. Although this could apply to our goverened laws, it deals more with social acceptable behaviour in a particular society. I would have to say that the chairperson responded rashly and unethical. When the student approached the chairperson, he/she must have thought that this was in good faith, and probably didn't require legal action.
Puzzle for March 10, 2006
A large software company has decided to develop a secure computer system. They have requested their top designers and programmers to create a viable design, and implement it. However, sensing a large market, the president of the company has asked that the product be completed as soon as possible without sacrificing quality. The marketing folks have been presenting the design of the system under development to major corporations and government agencies, all of whom have reacted enthusiastically. All have been promised a firm ship date.
To meet this date, the programmers must complete the product quickly so it can be tested. The programming is taking more time than was initially thought, and the testing time is being reduced to enable the product to be completed and shipped on time.
The president is beginning to get nervous about the quality of code and the design of the product. You are brought in as an independent consultant, and asked to check the work done so far, and if there are problems recommend changes. You check the design, which is clearly aimed at securing network communications, and then you check the code. There are no comments, and the code is not well modularized at all. When you speak with the programmers, they complain about pressure to write code quickly and the lack of time they feel they need.
1) Given what you know from the above, what questions would you raise about the design of the secure system?
2) What would you report as being the most serious impediment to getting this product out the door? In other words, what would your report identify as being the main security concerns here?
Answer(s):
1) If the design is well formed then the code should follow to also be well formed and modularized. This means the reduction of coupling and increase of cohesion. When designing. Saltzer/Schroeder's Design Principles should be used. This can include but not limited to, Economy of Mechanism, Complete Mediation and Fail Safe. I believe that the majority of time should be spent up front on the design. This time can be from the actual implementation, but also in the reviews and verification/validation of the design. Some design tools can also take a detail design and produce a good portion of the code needed. This can help to reduce time needed in the coding phase.
2) There is always concern when only one person has a particular knowledge. It is the case that employees move on to other programs or companies. It would be benefical, to help reduce future work from different developers, to write code with well documented comments and to use a well modularized code design. Also, if possible to use an Extreme Programming style to which 2 programmers are working together. While one codes the other "shoulder browses" to ensure errors are not made. This seems to work very well, but requires that both persons be on-board at the same time.
Puzzle for February 15, 2006
Saul Alinsky illustrated one of his rules of tactics for an organizer with the following example:
“The third rule is: Whenever possible go outside of the experience of the enemy. Here you want to cause confusion, fear, and retreat.
General William T. Sherman, whose name still causes a frenzied reaction throughout the South, provided a classic example of going outside the enemy's experience. Until Sherman, military tactics and strategies were based on standard patterns. All armies had fronts, rears, flanks, lines of communication, and lines of supply. Military campaigns were aimed at such standard objectives as rolling up the flanks of the enemy army or cutting the lines of supply or lines of communication, or moving around to attack from the rear. When Sherman cut loose on his famous March to the Sea, he had no front or rear lines of supplies or any other lines. He was on the loose and living on the land. The South, confronted with this new form of military invasion, reacted with confusion, panic, terror, and collapse. Sherman swept on to inevitable victory. It was the same tactic that, years later in the early days of World War II, the Nazi Panzer tank divisions emulated in their far-flung sweeps into enemy territory, as did our own General Patton with the American Third Armored Division.”
What does this have to do with computer security?
The passage is from pages 127–128 of Saul Alinsky’s book Rules for Radicals, published by Randmm House, Inc., New York, NY, copyright 1972.
Answer(s):
This has everything to do with computer security. Attacks are made almost solely on this idea. When security is enforced, it is based on what one would expect to be performed by their attackers. In order for most attacks to be successful, it helps to perform a task, or tasks, that was completely unexpected by the security enforcers. When an attack is not anticipated, then it is hard, nearly impossible, to protect your system against it.
Puzzle for January 4, 2006
A student discovers a flaw in the department's computer system. To ensure that the flaw really exists, she exploits it to gain extra privileges on the system. These privileges allow her to read any file on the system, whereas without the privileges, there are files that the student cannot read.
1)Given that there were files she was not supposed to be able to read, did the student act ethically in exploiting the flaw?
2)The computer system did not provide sufficient mechanisms to prevent the student from obtaining the additional privileges. Did she "break in" (that is, breach security) or was her action not a violation of security?
3)The student reports the problem to the department chairperson, who promptly files charges against the student for breaking in. Assuming that what the student did was a violation of security, did the chairperson act ethically?
Answer(s):
1) When this student exploited the system it made her indistinguishablefrom any other hacker/threat. Her actions are considered unethical.
2) This is the common explanation for many unethical action that are computer and non computer related. The idea that "not enough" protection gives one the right to break the weak protection and possibly steal, alter, etc procted data is wrong. There may never be 100% full proof protection for computers (or other entities for that matter). When the flaw was discovered, she should have reported immediately to the system administrator. It is not her responsibility to "check" the security up to the point of criminal actions.
3) This answer to this question was a bit more difficult for me to answer. I had to look up the formal definition of "ethical". It seems to be more about what is considered right and what is considered wrong in a professional. Although this could apply to our goverened laws, it deals more with social acceptable behaviour in a particular society. I would have to say that the chairperson responded rashly and unethical. When the student approached the chairperson, he/she must have thought that this was in good faith, and probably didn't require legal action.
Puzzle for March 10, 2006
A large software company has decided to develop a secure computer system. They have requested their top designers and programmers to create a viable design, and implement it. However, sensing a large market, the president of the company has asked that the product be completed as soon as possible without sacrificing quality. The marketing folks have been presenting the design of the system under development to major corporations and government agencies, all of whom have reacted enthusiastically. All have been promised a firm ship date.
To meet this date, the programmers must complete the product quickly so it can be tested. The programming is taking more time than was initially thought, and the testing time is being reduced to enable the product to be completed and shipped on time.
The president is beginning to get nervous about the quality of code and the design of the product. You are brought in as an independent consultant, and asked to check the work done so far, and if there are problems recommend changes. You check the design, which is clearly aimed at securing network communications, and then you check the code. There are no comments, and the code is not well modularized at all. When you speak with the programmers, they complain about pressure to write code quickly and the lack of time they feel they need.
1) Given what you know from the above, what questions would you raise about the design of the secure system?
2) What would you report as being the most serious impediment to getting this product out the door? In other words, what would your report identify as being the main security concerns here?
Answer(s):
1) If the design is well formed then the code should follow to also be well formed and modularized. This means the reduction of coupling and increase of cohesion. When designing. Saltzer/Schroeder's Design Principles should be used. This can include but not limited to, Economy of Mechanism, Complete Mediation and Fail Safe. I believe that the majority of time should be spent up front on the design. This time can be from the actual implementation, but also in the reviews and verification/validation of the design. Some design tools can also take a detail design and produce a good portion of the code needed. This can help to reduce time needed in the coding phase.
2) There is always concern when only one person has a particular knowledge. It is the case that employees move on to other programs or companies. It would be benefical, to help reduce future work from different developers, to write code with well documented comments and to use a well modularized code design. Also, if possible to use an Extreme Programming style to which 2 programmers are working together. While one codes the other "shoulder browses" to ensure errors are not made. This seems to work very well, but requires that both persons be on-board at the same time.
Puzzle for February 15, 2006
Saul Alinsky illustrated one of his rules of tactics for an organizer with the following example:
“The third rule is: Whenever possible go outside of the experience of the enemy. Here you want to cause confusion, fear, and retreat.
General William T. Sherman, whose name still causes a frenzied reaction throughout the South, provided a classic example of going outside the enemy's experience. Until Sherman, military tactics and strategies were based on standard patterns. All armies had fronts, rears, flanks, lines of communication, and lines of supply. Military campaigns were aimed at such standard objectives as rolling up the flanks of the enemy army or cutting the lines of supply or lines of communication, or moving around to attack from the rear. When Sherman cut loose on his famous March to the Sea, he had no front or rear lines of supplies or any other lines. He was on the loose and living on the land. The South, confronted with this new form of military invasion, reacted with confusion, panic, terror, and collapse. Sherman swept on to inevitable victory. It was the same tactic that, years later in the early days of World War II, the Nazi Panzer tank divisions emulated in their far-flung sweeps into enemy territory, as did our own General Patton with the American Third Armored Division.”
What does this have to do with computer security?
The passage is from pages 127–128 of Saul Alinsky’s book Rules for Radicals, published by Randmm House, Inc., New York, NY, copyright 1972.
Answer(s):
This has everything to do with computer security. Attacks are made almost solely on this idea. When security is enforced, it is based on what one would expect to be performed by their attackers. In order for most attacks to be successful, it helps to perform a task, or tasks, that was completely unexpected by the security enforcers. When an attack is not anticipated, then it is hard, nearly impossible, to protect your system against it.
Tuesday, February 17, 2009
CS591 ST 008
Lab 1 (due 2/25/09) 2nd week
I have talked with the professor about how to solve the 16 bit k3 key in this lab.
I have written up a pseudo code to help me gather my thoughts.
Email sent back to professor with my pseudo code example.
Sent this pseudo code to the chat mail list to get feedback.
Read chapters in book dealing with DES; not helpful.
I need to spend more time looking at linear.cpp for how this is done.
Used professor's new S-boxes in code.
I think I now finally understand what I need to do to find the key, the only part that seems difficult is the linear equations.
I still don't understand how a linear equation that is correct a high percent of the time means I have a potential K3? And what good is K3 going to do us without K1 and K2. We cannot decipher the secret.ciphertext without all the keys.
I have started putting the pseudo code into a C++ program. I'm trying to reuse most of sdes16v2.cc.
I have talked with the professor about how to solve the 16 bit k3 key in this lab.
I have written up a pseudo code to help me gather my thoughts.
Email sent back to professor with my pseudo code example.
Sent this pseudo code to the chat mail list to get feedback.
Read chapters in book dealing with DES; not helpful.
I need to spend more time looking at linear.cpp for how this is done.
Used professor's new S-boxes in code.
I think I now finally understand what I need to do to find the key, the only part that seems difficult is the linear equations.
I still don't understand how a linear equation that is correct a high percent of the time means I have a potential K3? And what good is K3 going to do us without K1 and K2. We cannot decipher the secret.ciphertext without all the keys.
I have started putting the pseudo code into a C++ program. I'm trying to reuse most of sdes16v2.cc.
Wednesday, January 21, 2009
CS591 ST 008
Lab 0 (due 2/4/09)
Alright, after re-reading the instructions provided by Jed, I realized that I need to write something about my experience with this CITI course.
Ok, first of all, I finished this drudgery course. I cannot for the life of me understand how learning about co-authoring applies to the Security and Privacy course. The videos provided were comical and almost worthless, but the text explanations were very well written. It did seem like they would reiterate the same thing more than needed.
Also, Peer Review and Mentoring? Really? It was good reading, since it had close ties to work I do professionally...but not sure this has much use for our class.
Some of the questions in the quizzes just seemed "off".
I think there should be a more appropriate training available.
Lab 1 (due 2/25/09) 1st week
I have taken time to study the DES structure and in detail how the F function works.
I have looked over the 8 bit DES program given to us by our instructor trying to understand exactly how it works.
I have built this program and generated my own cipher text using the plain text pdf file.
I'm really starting to appreciate the DES Feistel structure. It reminds me of the guys on the street that move the 3 cards around and ask you to pick the Ace. There is a lot of bit "shuffling", duplication and remapping.
The area I'm confused with is how do we determine a "good" choice for K3? When do you know you have a good selection? I know Jed mentioned that when we use this key with the Q value and somehow we get a 50+% parity bit of 0, then it is good? Not too sure. I'll need to come in to Jed's office hours and just do an example by hand.
NOTE: Looking at linear.cpp I realized that it wants you to run the pc.cpp file as input to it...not using a file (unless you want to "linear.out < pc_outfile.txt").
Here is the result from running the linear program using the example key of 22B8FA:
Likely candidates for subkey K3:
Subkey Deviation
-----------------
da 346
fa 346
92 258
b2 258
ea 228
NICE! FA was my key3 and it has it listed at the top.
Alright, after re-reading the instructions provided by Jed, I realized that I need to write something about my experience with this CITI course.
Ok, first of all, I finished this drudgery course. I cannot for the life of me understand how learning about co-authoring applies to the Security and Privacy course. The videos provided were comical and almost worthless, but the text explanations were very well written. It did seem like they would reiterate the same thing more than needed.
Also, Peer Review and Mentoring? Really? It was good reading, since it had close ties to work I do professionally...but not sure this has much use for our class.
Some of the questions in the quizzes just seemed "off".
I think there should be a more appropriate training available.
Lab 1 (due 2/25/09) 1st week
I have taken time to study the DES structure and in detail how the F function works.
I have looked over the 8 bit DES program given to us by our instructor trying to understand exactly how it works.
I have built this program and generated my own cipher text using the plain text pdf file.
I'm really starting to appreciate the DES Feistel structure. It reminds me of the guys on the street that move the 3 cards around and ask you to pick the Ace. There is a lot of bit "shuffling", duplication and remapping.
The area I'm confused with is how do we determine a "good" choice for K3? When do you know you have a good selection? I know Jed mentioned that when we use this key with the Q value and somehow we get a 50+% parity bit of 0, then it is good? Not too sure. I'll need to come in to Jed's office hours and just do an example by hand.
NOTE: Looking at linear.cpp I realized that it wants you to run the pc.cpp file as input to it...not using a file (unless you want to "linear.out < pc_outfile.txt").
Here is the result from running the linear program using the example key of 22B8FA:
Likely candidates for subkey K3:
Subkey Deviation
-----------------
da 346
fa 346
92 258
b2 258
ea 228
NICE! FA was my key3 and it has it listed at the top.
Thursday, January 1, 2009
New TV Stand
Ok....if you have been to my house in the last few months, you have probably noticed the ice chest that held my TV. I have been given grief about it from time to time with good reason. I have been looking under Craigslist and on-line. I finally decided to use my Christmas gift cards to finally buy one that I can be proud of.
This TV stand I bought from Best Buy. It was kinda expense but well designed and uses nice materials (solid wood). It also has a TV high mount that allows the TV to swivel. The nice part of this swivel is that the pivot point is protruded out far enough to prevent the edge of my TV from hitting the wall.
Here is the link if you want to read more about it.
Monday, December 29, 2008
Lucky me, MRI
I'm at Loveless hospital for an MRI For the first time in a long time I was able to play tennis with no pain. I played my chiropractor yesterday. This game was a rematch from when he beat me but when my back was at it's worst. Final score was 6-2,6-1,6-1 mine :-D.
OK. Finished with my MRI, and have to say I almost flipped out when I was in that machine. I guess I never realized just how clostophobic I really am. It took about 30 min to complete all the tests. The machine is very loud, but they give you ear plugs to use. It sounded like a video game. I can't describe what it looked like inside, as I kept my eyes closed trying to get myself to stay calm...didn't work too good, I was breathing very fast.
OK. Finished with my MRI, and have to say I almost flipped out when I was in that machine. I guess I never realized just how clostophobic I really am. It took about 30 min to complete all the tests. The machine is very loud, but they give you ear plugs to use. It sounded like a video game. I can't describe what it looked like inside, as I kept my eyes closed trying to get myself to stay calm...didn't work too good, I was breathing very fast.
Subscribe to:
Posts (Atom)
