CSCI 2951U: Topics in Software Security Introduction Vasileios (Vasilis) Kemerlis January 27, 2020 Department of Computer Science Brown University vpk@cs.brown.edu (Brown University) CSCI 2951U Spring ’20 1 / 8
Course Overview (1/2) • CFI, CPI, ... Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) 3. Data-only attacks • ... • Signal-oriented prog. (SROP) • Blind ROP (BROP) • Just-In-Time ROP (JIT-ROP) • Return-oriented prog. (ROP) • Return-to-libc ( ret2libc ) 2. Code reuse 1. Code injection Software Exploitation • BPF_SECCOMP , FORTIFY_SRC • RELRO , BIND_NOW • Stack/Heap canaries • W^X , ASLR 2. Modern defenses • ... • Pointer errors • Format string bugs • Stack/Heap smashing 1. Prevalent software defects Software Security Memory unsafe code (written in C / C++ , asm , ...) CSCI 1650 ++ State-of-the-art in software exploitation and defense 2 / 8 ▶ What is this course about?
Course Overview (1/2) Software Exploitation Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) 3. Data-only attacks • ... • Signal-oriented prog. (SROP) • Blind ROP (BROP) • Just-In-Time ROP (JIT-ROP) • Return-oriented prog. (ROP) • Return-to-libc ( ret2libc ) 2. Code reuse 1. Code injection • CFI, CPI, ... • BPF_SECCOMP , FORTIFY_SRC • RELRO , BIND_NOW • Stack/Heap canaries • W^X , ASLR 2. Modern defenses • ... • Pointer errors • Format string bugs • Stack/Heap smashing 1. Prevalent software defects Software Security Memory unsafe code (written in C / C++ , asm , ...) 2 / 8 ▶ What is this course about? ✔ State-of-the-art in software exploitation and defense ➜ CSCI 1650 ++
Course Overview (1/2) 1. Code injection Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) 3. Data-only attacks • ... • Signal-oriented prog. (SROP) • Blind ROP (BROP) • Just-In-Time ROP (JIT-ROP) • Return-oriented prog. (ROP) • Return-to-libc ( ret2libc ) 2. Code reuse • CFI, CPI, ... • BPF_SECCOMP , FORTIFY_SRC • RELRO , BIND_NOW • Stack/Heap canaries • W^X , ASLR 2. Modern defenses • ... • Pointer errors • Format string bugs • Stack/Heap smashing 1. Prevalent software defects 2 / 8 ▶ What is this course about? ✔ State-of-the-art in software exploitation and defense ➜ CSCI 1650 ++ ✘ Memory unsafe code (written in C / C++ , asm , ...) ▶ Software Security ▶ Software Exploitation
Course Overview (2/2) Why are these useful? Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) (c) why previous attempts failed (b) how exactly these attacks work (a) understand what sorts of attacks are possible mechanisms you need to: • To design efgective (and effjcient) software protection • Exploit “weaponization” defenses can be bypassed Learn how and why (certain) Ofgense mitigation techniques Familiarize with experimental argue about their efgectiveness protection mechanisms and Understand the boundaries of Defense 3 / 8 ▶ Why take this course?
Course Overview (2/2) Why are these useful? Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) (c) why previous attempts failed (b) how exactly these attacks work (a) understand what sorts of attacks are possible mechanisms you need to: • To design efgective (and effjcient) software protection • Exploit “weaponization” defenses can be bypassed mitigation techniques Familiarize with experimental argue about their efgectiveness protection mechanisms and Understand the boundaries of Defense 3 / 8 ▶ Why take this course? � Ofgense ✔ Learn how and why (certain)
Course Overview (2/2) Why are these useful? Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) (c) why previous attempts failed (b) how exactly these attacks work (a) understand what sorts of attacks are possible mechanisms you need to: • To design efgective (and effjcient) software protection • Exploit “weaponization” defenses can be bypassed mitigation techniques argue about their efgectiveness protection mechanisms and 3 / 8 ▶ Why take this course? � Defense � Ofgense ✔ Understand the boundaries of ✔ Learn how and why (certain) ✔ Familiarize with experimental
Course Overview (2/2) • To design efgective (and effjcient) software protection Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) (c) why previous attempts failed (b) how exactly these attacks work (a) understand what sorts of attacks are possible mechanisms you need to: • Exploit “weaponization” defenses can be bypassed mitigation techniques argue about their efgectiveness protection mechanisms and 3 / 8 ▶ Why take this course? � Defense � Ofgense ✔ Understand the boundaries of ✔ Learn how and why (certain) ✔ Familiarize with experimental ▶ Why are these useful?
Prerequisites Having taken the following courses is a plus, but not required: Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) We will review (most of) the important concepts • CSCI 2951E (Topics in Computer System Security) • CSCI 1660 (Computer Systems Security) • Virtual Memory • Linking and Loading • C/C++, x86 asm • Code Reuse (ROP) • Code Injection (Shellcode dev.) • Control-fmow Hijacking 4 / 8 ▶ CSCI 1650 (Software Security and Exploitation) ▶ CSCI 1670 (Operating Systems)
Prerequisites • CSCI 1660 (Computer Systems Security) Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) We will review (most of) the important concepts • CSCI 2951E (Topics in Computer System Security) • Virtual Memory • Linking and Loading • C/C++, x86 asm • Code Reuse (ROP) • Code Injection (Shellcode dev.) • Control-fmow Hijacking 4 / 8 ▶ CSCI 1650 (Software Security and Exploitation) ▶ CSCI 1670 (Operating Systems) ✔ Having taken the following courses is a plus, but not required:
Prerequisites • CSCI 1660 (Computer Systems Security) Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) • CSCI 2951E (Topics in Computer System Security) • Virtual Memory • Linking and Loading • C/C++, x86 asm • Code Reuse (ROP) • Code Injection (Shellcode dev.) • Control-fmow Hijacking 4 / 8 ▶ CSCI 1650 (Software Security and Exploitation) ▶ CSCI 1670 (Operating Systems) ✔ Having taken the following courses is a plus, but not required: ✪ We will review (most of) the important concepts
Logistics (1/2) • https://cs.brown.edu/courses/csci2951-u/ Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) Assigned readings No required textbook Study material • Readings • Lecture slides • Announcements Check the website! spring.s01@lists.brown.edu • course.csci.2951u.2020- Communication Meetings 10% Project presentation 40% Project report 20% Discussion part. 20% Paper presentations 10% Paper reviews Grading • CIT 506 • Mondays, 3PM – 5:20PM (M hour) 5 / 8
Logistics (1/2) • https://cs.brown.edu/courses/csci2951-u/ Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) Assigned readings No required textbook Study material • Readings • Lecture slides • Announcements Check the website! spring.s01@lists.brown.edu • course.csci.2951u.2020- Communication 10% Project presentation 40% Project report 20% Discussion part. 20% Paper presentations 10% Paper reviews Grading • CIT 506 • Mondays, 3PM – 5:20PM (M hour) 5 / 8 � Meetings
Logistics (1/2) • https://cs.brown.edu/courses/csci2951-u/ Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) Assigned readings No required textbook Study material • Readings • Lecture slides • Announcements Check the website! spring.s01@lists.brown.edu • course.csci.2951u.2020- 5 / 8 10% Project presentation 40% Project report 20% Discussion part. 20% Paper presentations 10% Paper reviews Grading • CIT 506 • Mondays, 3PM – 5:20PM (M hour) � Meetings � Communication
Logistics (1/2) • https://cs.brown.edu/courses/csci2951-u/ Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) Assigned readings No required textbook Study material • Readings • Lecture slides • Announcements spring.s01@lists.brown.edu • course.csci.2951u.2020- 5 / 8 10% Project presentation 40% Project report 20% Discussion part. 20% Paper presentations 10% Paper reviews Grading • CIT 506 • Mondays, 3PM – 5:20PM (M hour) � Meetings � Communication ✪ Check the website!
Logistics (1/2) spring.s01@lists.brown.edu Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) Assigned readings No required textbook Study material • Readings • Lecture slides • Announcements • course.csci.2951u.2020- • CIT 506 • https://cs.brown.edu/courses/csci2951-u/ • Mondays, 3PM – 5:20PM (M hour) 5 / 8 � Meetings � Communication ▶ Grading ✔ Paper reviews ➜ 10% ✪ Check the website! ✔ Paper presentations ➜ 20% ✔ Discussion part. ➜ 20% ✔ Project report ➜ 40% ✔ Project presentation ➜ 10%
Logistics (1/2) • https://cs.brown.edu/courses/csci2951-u/ Spring ’20 CSCI 2951U vpk@cs.brown.edu (Brown University) • Readings • Lecture slides • Announcements spring.s01@lists.brown.edu • course.csci.2951u.2020- • Mondays, 3PM – 5:20PM (M hour) • CIT 506 5 / 8 � Meetings � Communication ▶ Grading ✔ Paper reviews ➜ 10% ✪ Check the website! ✔ Paper presentations ➜ 20% ✔ Discussion part. ➜ 20% ✔ Project report ➜ 40% ✔ Project presentation ➜ 10% ▶ Study material ■ No required textbook ➜ Assigned readings
Recommend
More recommend
