ECE-422

Lecture1: Introduction

• 4*2 Homework
• 2 person team
• Online Exams with books open

Lecture2: Moral

Lecture3: Buffer Overflow

By the end of this chapter you should:

• Recall stack, calling convention basics
• Be able to demonstrate simple buffer overflow attacks
• Be able to build shellcode

Assembly

Buffer overflow FTW

• Success! Program crashed!
  • Exploit: any string longer than buffer size
• Success! Execute arbitrary code!
  • Exploit: injected code + address of buffer
• Success! Open a shell!
  • Exploit: nop sled + shellcode + guesses of buffer

First lesson: avoid unsafe functions

• Unsafe functions:
  • strcpy and friends (str*)
  • sprintf
  • gets
• Safe versions:
  • strncpy and friends (strn*)
  • snprintf
  • fgets
• Does not solve all problem

First lesson: avoid unsafe functions

• Unsafe functions:
  • strcpy and friends (str*)
  • sprintf
  • gets
• Safe versions:
  • strncpy and friends (strn*)
  • snprintf
  • fgets
• Does not solve all problem

Lecture 4: Control Flow Hijacking

Hack detect

1. push $CANARY in stack
2. check the position
3. If the 0(position) is not $CANARY, Congratulations!

Control Flow Hijacking

(Screenshot from Compiler Principle)

可以注意到，如果替换 function address, 或者说,想办法改变 PC 的值，就可以想干什么干什么，这就是 Control Flow Hijacking

CounterAttack

1. distinguish code and data - Data should not be executable, Code need not be writable
   • W^X (write xor execute)

Return-to-libc Attacks

借刀杀人

Return-Oriented Programming (ROP)

• Workflow
  • Dump executable portions of target program
  • Identify byte sequences ending in 0xC3 (ret)
• Such a code fragment is called a gadget
  • Figure out what each gadget does — use a dissembler, e.g., https://onlinedisassembler.com/
  • Chain together useful gadgets

-fPIE

地址偏移的安全加固

漏洞:

• 一个个实验 (i386)
• 狂喷
  • 浏览器是重灾区

Lecture 6: Malware Defenses

Security By Design Principles

• Minimize the Trusted Computing Base (TCB)
• Minimize the Attack Surface
• Principle of Least Privilege
• Principle of Defense in Depth
• Fail Secure
• Avoid Security by Obscurity
• Keep Security Simple

INTRUSION DETECTION

• Signatures
• Polymorphic Code
• Metamorphic Code
• Detecting Metamorphic Viruses
• …
• N-Grams: Building the Model by Training

Chapter 07 – Web Security

CORS & CSRF & XSS