CSCI 1650: Software Security and Exploitation Introduction - PowerPoint PPT Presentation

CSCI 1650: Software Security and Exploitation Introduction Vasileios (Vasilis) Kemerlis September 09, 2020 Department of Computer Science Brown University vpk@cs.brown.edu (Brown University) CSCI 1650 Fall ’20 1 / 6

Course Overview (1/2) • BPF_SECCOMP, FORTIFY_SRC Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) • ... • Just-In-Time ROP (JIT-ROP) • Return-oriented prog. (ROP) • Return-to-libc ( ret2libc ) 2. Code reuse 1. Code injection Software Exploitation • ... • RELRO, BIND_NOW • Stack/Heap canaries • W^X, ASLR 2. Modern defenses • ... • Pointer errors • Format string bugs • Stack/Heap smashing 1. Prevalent software defects Software Security Control-fmow hijacking Memory unsafe code (written in C / C++ , asm , ...) 2 / 6 ▶ What is this course about?

Course Overview (1/2) • BPF_SECCOMP, FORTIFY_SRC Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) • ... • Just-In-Time ROP (JIT-ROP) • Return-oriented prog. (ROP) • Return-to-libc ( ret2libc ) 2. Code reuse 1. Code injection Software Exploitation • ... • RELRO, BIND_NOW • Stack/Heap canaries • W^X, ASLR 2. Modern defenses • ... • Pointer errors • Format string bugs • Stack/Heap smashing 1. Prevalent software defects Control-fmow hijacking 2 / 6 ▶ What is this course about? ✘ Memory unsafe code (written in C / C++ , asm , ...) ▶ Software Security

Course Overview (1/2) • BPF_SECCOMP, FORTIFY_SRC Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) • ... • Just-In-Time ROP (JIT-ROP) • Return-oriented prog. (ROP) • Return-to-libc ( ret2libc ) 2. Code reuse 1. Code injection • ... • RELRO, BIND_NOW • Stack/Heap canaries • W^X, ASLR 2. Modern defenses • ... • Pointer errors • Format string bugs • Stack/Heap smashing 1. Prevalent software defects 2 / 6 ▶ What is this course about? ✘ Memory unsafe code (written in C / C++ , asm , ...) ✘ Control-fmow hijacking ▶ Software Security ▶ Software Exploitation

(plus objdump , readelf , ..., etc.) Course Overview (2/2) Using only gdb ! Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) (b) how exactly these attacks work (a) understand what sorts of attacks are possible • To protect software (against certain threats) you need to: Why are these useful? • Binary exploitation • Code “weaponization” • Exploit development Learn how to break software Ofgense argue about their efgectiveness protection mechanisms and Understand the boundaries of Defense 3 / 6 ▶ Why take this course?

(plus objdump , readelf , ..., etc.) Course Overview (2/2) Using only gdb ! Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) (b) how exactly these attacks work (a) understand what sorts of attacks are possible • To protect software (against certain threats) you need to: Why are these useful? • Binary exploitation • Code “weaponization” • Exploit development argue about their efgectiveness protection mechanisms and Understand the boundaries of Defense 3 / 6 ▶ Why take this course? � Ofgense ✔ Learn how to break software

Course Overview (2/2) (plus objdump , readelf , ..., etc.) Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) (b) how exactly these attacks work (a) understand what sorts of attacks are possible • To protect software (against certain threats) you need to: Why are these useful? • Binary exploitation • Code “weaponization” • Exploit development argue about their efgectiveness protection mechanisms and Understand the boundaries of Defense 3 / 6 ▶ Why take this course? � Ofgense ✔ Learn how to break software ✪ Using only gdb !

Course Overview (2/2) (plus objdump , readelf , ..., etc.) Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) (b) how exactly these attacks work (a) understand what sorts of attacks are possible • To protect software (against certain threats) you need to: Why are these useful? • Binary exploitation • Code “weaponization” • Exploit development argue about their efgectiveness protection mechanisms and 3 / 6 ▶ Why take this course? � Defense � Ofgense ✔ Understand the boundaries of ✔ Learn how to break software ✪ Using only gdb !

Course Overview (2/2) (plus objdump , readelf , ..., etc.) Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) (b) how exactly these attacks work (a) understand what sorts of attacks are possible • To protect software (against certain threats) you need to: • Binary exploitation • Code “weaponization” • Exploit development argue about their efgectiveness protection mechanisms and 3 / 6 ▶ Why take this course? � Defense � Ofgense ✔ Understand the boundaries of ✔ Learn how to break software ✪ Using only gdb ! ▶ Why are these useful?

Prerequisites CSCI 0300 (Fundamentals of Computer Systems) • C/C++, x86 asm • Virtual memory • Linking and loading • Memory management Having taken the following courses is a plus, but not required: • CSCI 1660 (Computer Systems Security) • CSCI 2951E (Topics in Computer System Security) We will review (most of) the important concepts vpk@cs.brown.edu (Brown University) CSCI 1650 Fall ’20 4 / 6 ▶ CSCI 0330 (Introduction to Computer Systems) ▶ CSCI 1670 (Operating Systems)

Prerequisites CSCI 0300 (Fundamentals of Computer Systems) • C/C++, x86 asm • Virtual memory • Linking and loading • Memory management • CSCI 1660 (Computer Systems Security) • CSCI 2951E (Topics in Computer System Security) We will review (most of) the important concepts vpk@cs.brown.edu (Brown University) CSCI 1650 Fall ’20 4 / 6 ▶ CSCI 0330 (Introduction to Computer Systems) ▶ CSCI 1670 (Operating Systems) ✔ Having taken the following courses is a plus, but not required:

Prerequisites CSCI 0300 (Fundamentals of Computer Systems) • C/C++, x86 asm • Virtual memory • Linking and loading • Memory management • CSCI 1660 (Computer Systems Security) • CSCI 2951E (Topics in Computer System Security) vpk@cs.brown.edu (Brown University) CSCI 1650 Fall ’20 4 / 6 ▶ CSCI 0330 (Introduction to Computer Systems) ▶ CSCI 1670 (Operating Systems) ✔ Having taken the following courses is a plus, but not required: ✪ We will review (most of) the important concepts

• Hacking: The Art of Exploitation, 2nd Edition. Jon Erickson. Logistics Check the website! Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) No Starch Press, 2008, ISBN 1593271441 Optional textbook: Lecture slides/code & assigned readings No required textbook Study material • Assignment descriptions • Readings • Lecture slides/code • Announcements • Piazza | cs1650tas@lists.brown.edu Meetings • https://cs.brown.edu/courses/csci1650/ Communication 0% Final 0% Midterm • 4x CTF-like write-ups 90% Assignments 10% (Piazza) Participation Grading • Asynchronous • Online 5 / 6

• Hacking: The Art of Exploitation, 2nd Edition. Jon Erickson. Logistics Check the website! Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) No Starch Press, 2008, ISBN 1593271441 Optional textbook: Lecture slides/code & assigned readings No required textbook Study material • Assignment descriptions • Readings • Lecture slides/code • Announcements • Piazza | cs1650tas@lists.brown.edu • https://cs.brown.edu/courses/csci1650/ Communication 0% Final 0% Midterm • 4x CTF-like write-ups 90% Assignments 10% (Piazza) Participation Grading • Asynchronous • Online 5 / 6 � Meetings

• Hacking: The Art of Exploitation, 2nd Edition. Jon Erickson. Logistics Check the website! Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) No Starch Press, 2008, ISBN 1593271441 Optional textbook: Lecture slides/code & assigned readings No required textbook Study material • Assignment descriptions • Readings • Lecture slides/code • Announcements • Piazza | cs1650tas@lists.brown.edu • https://cs.brown.edu/courses/csci1650/ 0% Final 0% Midterm • 4x CTF-like write-ups 90% Assignments 10% (Piazza) Participation Grading • Asynchronous • Online 5 / 6 � Meetings � Communication

• Hacking: The Art of Exploitation, 2nd Edition. Jon Erickson. Logistics • Announcements Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) No Starch Press, 2008, ISBN 1593271441 Optional textbook: Lecture slides/code & assigned readings No required textbook Study material • Assignment descriptions • Readings • Lecture slides/code • Piazza | cs1650tas@lists.brown.edu • https://cs.brown.edu/courses/csci1650/ 90% • Online • Asynchronous Grading Participation 10% (Piazza) Assignments • 4x CTF-like write-ups Midterm 0% Final 0% 5 / 6 � Meetings � Communication ✪ Check the website!

• Hacking: The Art of Exploitation, 2nd Edition. Jon Erickson. Logistics • Lecture slides/code Fall ’20 CSCI 1650 vpk@cs.brown.edu (Brown University) No Starch Press, 2008, ISBN 1593271441 Optional textbook: Lecture slides/code & assigned readings No required textbook Study material • Assignment descriptions • Readings • Announcements • Piazza | cs1650tas@lists.brown.edu • https://cs.brown.edu/courses/csci1650/ • 4x CTF-like write-ups • Asynchronous • Online 5 / 6 � Meetings � Communication ✪ Check the website! ▶ Grading ✔ Participation ➜ 10% (Piazza) ✔ Assignments ➜ 90% ✔ Midterm ➜ 0% ✔ Final ➜ 0%