1. COMPUTER SECURITY MIDTERM REVIEW CS161 University of California BerkeleyApril 4, 2012

2. Midterm Announcements  Wednesday April 11 in class  No cheat sheet Material 1. Video Lectures “Control hijacking attacks and defense(I)" until "Cross Site Scripting (31 min) (Due Apr 3)". 2. Labs 1-4 3. Required in-class lectures 1. Mobile Security 2. Program Analysis & Verification 4. Required crypto notes

3. Survey!  Please fill out the surveys which we sent out over break!  These help us improve the class.

4. CONTROL HIJACKING

5. Control Hijacking Attacks  Buffer Overflows  Heap Overflows  Double Free  Function Pointer Clobbering  Arc Injection  Format Strings

6. Control Hijacking Defenses  Stack Canaries  Address Randomization  Executable Space Protection (W xor X)  JMP target verification  Return address stack

7. ISOLATION AND LEAST PRIVILEGE

8. Isolation and Least Privilege  chroot  Reference Monitor  Software Fault Isolation  Virtual Machines  Process Isolation  Capabilities  Access Control  Principle of Least Privilege  Confinement Principle

9. MOBILE COMPUTING

10. Mobile Computing  iOS/Android/Windows phone 7 security models  Isolation  Privilege management

11. FUZZING AND PROGRAM ANALYSIS

12. Reasoning on programs  Preconditions  Postconditions  Loop invariants  Memory allocation and memory safety  When/how are variables allocated in the heap/stack?  When/how do access violations occur on read/write?  Corner cases  Bitvector arithmetic  Type casting  Two’s complement representation of signed variables

13. Program Analysis  Program analysis  Soundness & Completeness of techniques  Symbolic execution and dynamic symbolic execution  Generate path conditions through SSA conversion  Solving path constraints for input values  Negation of branch conditions to go explore new paths  merging branch conditions into path constraints in purely static analysis  Fuzzing  whitebox and blackbox

14. TRUSTED COMPUTING AND HARDWARE ISOLATION

15. Trusted Computing  Trusted Platform Module (TPM)  Platform Configuration Registers  Virtual TPM  Trusted Boot  Dynamic Root of Trust  BitLocker  Windows 8 Secure Boot

16. CRYPTOGRAPHY

17. Cryptography  Symmetric and Asymmetric  encryption and decryption  Message Authentication Codes  Cryptographic hashes  Digital signatures  Understand what primitives are important for a given scenario.

18. Cryptography  Integrity, authenticity, authorization, privacy.  Cryptographic hardness  What is it? Where does it come from?  Certificates and certificate authorities  RSA algorithm

19. WEB SECURITY

20. Know your threats!  Web attacker  Control malicious site, which we may call “attacker.com”  Can obtain SSL/TLS certificate for attacker.com  User visits attacker.com Or: runs attacker’s Facebook app, site with attack ad, …  Network attacker  Passive: Wireless eavesdropper  Active: Evil router, DNS poisoning  Malware attacker  Attacker escapes browser isolation mechanisms and run separately under control of OS

21. Browser Operation  Understand the basics of how the browser works  Protocols, rendering, frames, etc.  Inter-domain communication  Browser isolation policies  Same Origin Policy

22. Web Session Management  How are sessions represented?  Cookies store session tokens  Unpredictability, randomness

23. Web Application Security  Know your injections  Command Executing system code  SQL Executing database queries  XSS Executing scripts in a browser as another web site  Note: No CSRF