1 Reminders

• Stack- stores local variables inside functions. Local variables and Values get destroyed after function call returns.
• Heap- new allows local variables to persist after function call. Only destroyed with delete. Only Heap cause mem leaks.

2 Examples

Code has buffer overflow due to memcpy, but you use a compiler that uses stack canaries. Which is better random canaries or terminator canaries for security?

• (GOOD) Random canaries -Attack has to guess
• (BAD) Terminator canary - Terminator canary contains NULL(0x00), CR (0x0d), LF (0x0a), and EOF (0xff) after a string . only useful for strcpy; wont help against memcpy bc memcpy can overwrite the canary. the canary.

You visit page using VPN w. passive mixed content(HTTPS loads subresources from a cdn that uses insecure HTTP). If your VPN service is evil, what exploit can they use?

• VPN service can change/replace the image.

Can VPN service inject javascipt with an onload attribute using <img src=".." onload="possibleAttack?">.

• No since onload is part of the HTTPS page which is secure from VPN attack.

Are XSS attacks affected by cookies marked secure? how about marked httponly?

• (BAD) secure: not effective
• (GOOD) httponly: blocks script access and completely stops XSS

NX pages: NX bit is security feature on processors which mark certain pages of memory as non-executable. Explain what this prevents.

• Prevents stack-based buffer overflows

Which segments is NX bit set for: stack,heap,code?

• mainly stack and sometimes heap

Does NX bit require re-compiling old code.

• No since only the kern

Does NX bit have permance penalty?

• No

Name an advanced version of the stack-based buffer overflow which can evade NX bit.

• Heap-based buffer overflow and ROP-return oriented programming which returns to your malicious library.

Suppose you build an encrypted web app which stores keys in browser local storage. You think of implementing PGP or OTR. (remember OTR offers forward secrecy but PGP does not). What can a XSS attack on your site do?

• XSS injection could read keys from local storage but OTR

Which PGP or OTR is better against this XSS attack?

• OTR is better since leaked keys can only be used to read old messages.

Some UNIX distro has a user called nobody with no access rights to file system. Bob downloaded a program foo and set it with -r-sr-xr-x 1 nobody nogroup foo. What does this do?

• The setuid bit is a linux principle that means when running an executable, system permissions are set to the user that created it(nobody) instead of the user that launched it(Bob)
• Anyone can run foo but foo wont be able to write or corrupt our file system or processes.
• Essentially this is program isolation.

What is DKIM and how does it preevnt spam?

• DKIM(Domain Key Identified Mail) adds a signature to each email message using a the email domain specified key.
• You can verify if the email really came from a gmail account by checking the email signature.

Describe ACLs vs. Capabilities

• ACL(Access Control Lists) - behaves like a bouncer that checks their DB if you are on-the-list.
  • Pro: Disallow sharing
  • Pro: Centrally manage therefore Easy to manage
  • Con: Very specific to an app or system therefore not reusable. (Bouncer can’t just use his on-the-list on the other bar across town)
• Capabilities - behaves like a metal detector
  • Pro: Anonymous access
  • Pro: Abstract broad policies making it easy to share
  • Con: Harder to revoke

3 Guide