System Security - Cryptography and Network Security Video Lecture - Computer Science Engineering (CSE)

so welcome to this very important topic
on system security so we have seen in
the previous portions of this course
various discussions on cryptographic
techniques cryptographic principles
there are applications to network
security and network protocols but here
is a very important concern that is
finally after doing all these things
whether we are really secured or not
so whether do we have trust in the
machines that we are using for our
communications so we shall see that
there is a difference between actually
having strong cryptographic principles
and between actually having software in
here I mean see I mean really secured
engineering so that bridge is actually
something which is probably provided by
this important topic of encrypt non
system security so let us see what are
the topics of discussions so we shall
first of all try to address this what is
a trusted system that is what is really
maintained as trusted trusts in systems
we shall in this context discuss about
buffer overflows and malicious softwares
and about malicious programs which are
very Amin commonly known as worms and
viruses now there are various malicious
programs but which are actually
concentrated on the worms and viruses
and discuss about the differences so to
start with we know that communication is
a boon okay that is when we actually
have got a multiple when we have when we
have got a multiple networks right I
mean other distributed networks where we
are aware we actually spread across the
networks the the importance or the
interesting thing is about we know how
to solve problems in a distributed but
yet collective manner but this one
actually comes with the added problem
that we also have to enforce security
because there is a problem of trust like
there are two users who are actually in
I mean somehow connected with through a
network but they do not trust each other
all right so you can imagine like with
the amount of complications which have
there grown up in the systems building a
box free design is actually almost
impossible right so even if you want to
make a complex multiplier or maybe a
like Sinjin for cryptographic purposes
it is actually hugely complicated right
so therefore there is you cannot
actually make it completely bug free now
while for most of the applications you
can actually like when it is just
performance related you can actually
leave with some of the bugs because if
there are some bugs it may happen that
those bugs are never triggered okay but
in the context of security if you have a
slightest amount of bugs then those bugs
can be actually exploited for attacks
and therefore the entire security can be
compromised
so therefore while bugs for most of the
purposes can be actually tolerated can
we leave do it but so what as security
is concerned bugs can be absolutely
Fator okay so we will see some of these
in the our descriptions and discussions
so now first of all we have to define
what is meant by a system okay now we
will say that a system is actually a
vague entity nearly speaking okay so it
will actually comprise the total of all
the computing things like the computing
may be it could be likes networks it
could be like I mean it could be like
your computers it could be your hardware
okay so it could be the software and the
hardware which are used for computation
purposes and also along with it is the
communication environment that means the
network so the entire thing is part of
actually what we term as the system okay
so now what is the system boundary
system boundary is something which
actually demarcates this system that is
what I am trying to protect okay with
the external world which is actually
beyond the scope of my the definition of
my system okay so that the boundary is
actually what demarcates between these
two now what are the components inside a
system so there are actually three you
can vaguely say that there are three
important components one is actually
which is security relevant okay security
relevant means that which are absolutely
important that they are secure so it
could be the operating system it could
be the hardware which is actually
imperative that they are they have to be
secured the other thing could be like
you could have you can have like your
programs data terminals and models okay
so these are actually something which I
am trying to protect you can say okay so
note that this is program and not
process okay so that means it is
something which is not yet running so
therefore the
could be like with what I am trying to
protect and the security parameter
actually is kind of line of demarcation
between the security relevant systems
and the other system so you can think
that very vaguely you have got the
external world okay so you have the
external world and you have got the
system okay that is what you are
essentially what you call as like you
may have your computers and you have
your computer separated by networks okay
and then this is what is known as the
boundary okay so this is your system
boundary and even in your system they
are actually very we can broadly divide
into two parts one which is actually
very much security what we call as
security relevant right so it could be
comprising of the operating system the
hardware and these are what we actually
try to protect the others okay and it
means in between this we have something
which is known as the security parameter
okay so this is the you can kind of
pictorially we visualize the entire
scenario for systems okay so now there
are various misconceptions which
actually are there with us like this
particular statement like encryption
provides system security so you see that
while we have seen that encryption
provides data confidentiality and other
things like what we have seen previously
in previous discussions for secure
system security what we need is actually
trusting the security related component
so you can imagine like if there is an
operating system which is compromised
can we trust the result of the
encryption programs we are running on
that we cannot trust right
so therefore other methods and
principles or policies are absolutely
necessary in order to enforce what we
know as system security
okay so encryption alone doesn't
actually give them so therefore we have
to actually understand some of the
principles which will provide us an in
to end security because finally at the
end of the day we actually have to in
spite of doing all the theory and doing
all that having all that cryptographic
principles and techniques in place we
also need to develop other principles
which will give us an in to end security
the finals guarantee okay we cannot
leave a weak hole visible so so
therefore the concept of trust and
trusted systems so as we know that in a
trusted system scenario typically there
is a user who is given a trusted piece
of information should could which could
be a login or some other authentication
code through which it actually tries to
convince the particular client and the
system that it is are nothing in
authenticated server so if you remember
the Kerberos protocol so similar to that
a user actually first communicates to
the client authenticates then the client
communicates with the Kerberos server
then often communicates with the ticket
granting service and then finally
communicates with the with the service
that it wants right so therefore the
user is actually understood in by the
system through a login like could be an
authentication tag right so now
therefore if Y in any system security
notion what we assume is that the user
does not leak away this particular log
of course if you if that is leaked out
then
we can actually adopt any principle to
guarantee security right so the
assumption is that it is expected that
the user does not give over this
valuable information and the system
security should actually if the if it
may happen that the user is actually
deceived to manipulate the data which
leaks the secret then the security
measures of the system should actually
warn the user against such accidental or
unintentional leakage right so if the
leakage is actually intentional then
system security cannot do anything right
but if the leakage is unintentional or
accidental then the system security
principles or techniques should actually
warn the user against such a leakage
that's the objective okay
so therefore Trust is built in a system
using authentication area and I need
identification now the system recognizes
a public ID could be a login name etc
and what it does it it actually
associates every process with a user
okay so the violation of authentication
is serious and therefore it will break
the trust in a system so therefore the
idea is that whenever there is a
violation of authentication there is an
accidental or unintentional leakage of
the users secret then the system
security techniques should actually
enforce Shane sure that there is a
warning which is provided to the
corresponding user okay so therefore
that's the way how we build trust into a
system okay so now I mean so how do you
enforce them so therefore they enforce a
given security policy depending upon the
levels of trust okay so there are
various levels of trust which exist like
there could be some which is called as a
trusted programs which are responsible
for the security of the system okay and
it is believed to be trustworthy even if
they come in contact with that untrusted
programs okay so therefore there are
certain programs which are actually
believed to be always trusted like if
they even if they come in to contact
with untrusted programs we believe that
their trust is not compromised okay on
the other hand you have got something
which is known as benign programs now
these benign programs are actually
obtained from trusted vendors okay and
it is believed to be trustworthy as long
as they do not come in contact with the
untrusted programs okay so
they come into contact with the
untrusted programs which are actually
obtained from unknown or untrusted
sources like maybe unknown webpages then
we are not guaranteeing the security or
trust of the benign programs okay but
the trusted programs are always trusted
so it could be like the hardware ok lure
the the essentially the kernel of your
operating system ok but but on the other
hand there could be some other things
like maybe some say a particular
software which you have actually got
from somewhere so we believe that they
are benign programs but then they can be
also subjected to attacks ok and could
we actually made untrustworthy by some
other untrusted programs ok so therefore
you see that there are various levels of
trust which exists in our system and the
policy for security depends upon the
level of trust which is attributed to
them right simple C program so you
consider that in buffer 10 buffer 20 is
equal to 5 ok so this is a very common C
program so you see that a compiler will
compile this above program maybe without
any error
okay now this seemingly simple program
problem can be actually used by the
authors of malicious software to trigger
a malicious code ok so let us see first
how so therefore the first thing to be
observed is that here we have got a
buffer which has got a size of 10 into
your wave variables ok
so typically you can say that 10 into 4
will be so if we assume that you are
integers 4 bytes it will be a 40 byte
location right allocated so but when you
are writing into these 28 location you
have actually not thought about this
20th location but what you are doing is
that you are overwriting into a
something we just passed which has gone
past the the the size of the buffer
which was intended ok so now the first
thing to be observed is that this does
not give any error so this will compile
without any error ok so now in order to
understand this the the the context we
have to let us consider the process
memory region so typically when your
process runs you know there are three
important regions in the memory one is
the text the other is the data and the
other one is the stack now it generally
typically grows from the lower memory to
the higher memory and the text is
something which is used for maybe some
binary instructions and something which
is hard-coded okay so therefore the idea
is that you cannot write into this text
region because if you write into this
text region it may end up in something
like a segmentation fault and this part
like the data part is actually may be
used for allocating spaces like the
static variables okay so therefore
variables which are static in the nature
can be actually allocated space in the
data it could be initialized it could be
uninitialized as well but on the other
hand this stack is actually the other
rather than the thing which we will
focus in our discussions he is actually
used to allocate space for the dynamic
variables okay so let us see like how
essentially the the allocation in the
stack can be actually exploited for
doing unintentional objectives or
achieving unintentional objectives okay
so what is the stack so stack is
actually a contiguous block of memory
containing data which grows from the
higher memory address to a lower memory
address so this is a very typical thing
like a generally for our most common
processors this is how the stack is
being maintained that is it grows from
the high memory address to the low
memory address now the concept of any
stacks as we know is last in first out
or Lefou and the two important
operations in stacks are push and pop
that is when we insert an element into
the stack top and when we do neatly
delete from the top of the stack now
high level languages use tax to
implement function calls because
whenever there is a function call then
you save your present radio bills and
you can actually go into the new
function call and allocate space for the
new variables there okay and also store
the return address where you have to go
back after the function has been
executed right so therefore typically we
will see that there is a lot of stack
management involved when there is a
function call right so the parameters of
the function call the return address and
the local variables used in the function
are dynamically stored in the stack so
whenever there is a I mean I mean
whenever there is a function call then
the parameters of the function call the
return address that is the address where
it has to return back to where the
instruction point the points to and
therefore
and also the local variables used in the
function are dynamically stored in the
stack now the stack pointer is a
registered which is also commonly known
as the SP register it is a register to
point to the top of the stack and the
bottom of the stack is actually fixed
okay and therefore the espys and SP is
actually updated by the kernel to allow
for more and more data storage that is
whenever more data storage is required
we actually update the stack so since
the stack normally grows from the high
memory to the low memory we will
actually decriminalize that to allocate
space for next time
extra extra variables or extra space so
typically in processes like Intel spark
and MIPS the stack grows down that is
from high memory to the low memory
address now we need to update the stack
pointer okay so therefore the stack
pointer is thus decremented however the
exact reduction of the stack pointer to
allocate space depends on the compiler
and may vary from compiler to compiler
okay
so typically we have seen that in our GZ
3.3.5 for every byte variable SP is
decremented by four bytes
whereas for GC 4.1.2 the stack pointer
is decremented in multiples of 16 bytes
so these are some observations that we
can make if we run rather see the GCC
compiler and see the corresponding stack
management so further the stack is
aligned on a four byte boundary
typically sixteen bytes and thus exact
understanding of the reduction of the
stack pointer value may be quite
difficult however usually try to
understand some basic points basic ideas
okay so therefore it may not necessarily
hold on every system but we try to
understand the basic principle behind
stack based overflows a buffer overflows
so again this is a classic example so we
can consider like there are two
character buffers buffer 1 and buffer 2
or size 5 and 10 and there is a function
which is like passes 1 2 & 3 as
variables to this function so in case of
GC 3.3.5 we have seen that the stack
pointer will be decremented by 20 bytes
because buffer 1 we're needing 8 byte
and buffer 2 will need to add 12 bytes
and in case of this GC we have seen this
version of GCC
seen that a stack pointer gets
decremented by 16 bytes okay so it could
be like because 5 plus 10 is 15 and the
next multiple of 16 is 16 okay so the
other important pointer which is
maintained is known as the frame pointer
so also known as the local based pointer
and it is actually it points to a fixed
location of the stack now due to the
continuous pop and push what happens is
the relative offsets from the local
variables change and therefore the
compilers use a second register known as
the frame pointer for accessing local
variables and parameters as the distance
between them and the base pointer is
constant okay so therefore the the the
the frame pointer is something like the
base pointer so whenever there is a
function call then the then the base one
in a current stack pointer is being
updated as the base pointer and the base
that the relative distance between the
base pointer and a variable is not
changing is not variable while the the
relative distance between a variable and
the stack pointer gets continuously
updated because whenever we are doing a
push or we are doing a pop the stack
pointer is getting incremented or
decremented right so the parameters have
got positive offsets with respect to the
base pointer on the frame pointer and
the variables have got a negative offset
okay so the parameters are the function
I've got a positive offset and this the
variables have got a negative offset so
they can visualize like in a stack kind
of scenario so this could be there the
base pointer okay and your the
parameters are typically on this side
whereas your variables are typically on
this negative offset okay so therefore
this is the negative offset and this is
the positive offset that we are talking
about okay and the stack pointer is
continuously updated that is depending
upon your variable your stack pointer
moves either this side or moves other
this side so whether it depends upon
whether you are doing a push when you
are doing a push it moves this side when
you are doing a pop it moves in the
other other direction on Intel machines
this stack pointer is often denoted by
this symbol ESP and the frame pointer is
denoted by this
cymbal evb okay so so how do you store
the frame pointer now when a procedure
is called the frame pointer is saved
into the stack then the stack pointer is
saved as the current frame pointer okay
and the stack pointer is then
decremented to allocate space for the
local variables these are commonly known
as the process called as prologue and
epilogue okay so the prologue is the
code for decrementing the stack pointer
allocating a space and AP log is a step
or other code for cleaning the stack
when the procedure is exited so
therefore it's these are the two
opposite operations which are being done
so let us consider an example which is
character buffer 1 5 and character
buffer 210 and again is the function so
let us consider or see the assembly code
which has been generated by using this
particular switch ok to see the
corresponding stack management okay so
therefore I'm just giving you some
snapshots like the immediate so you can
see that the first thing which is to be
noted here is that these things needs to
be stored in stored write the variable
the the parameters are 1 2 & 3 okay so
therefore what is what we see is in our
in my machine when we have obtained
corresponding assembly then first 3 is
actually stored then 2 is stored and
then 1 is stored so this is again
derivative with respect to the current
stack pointer notation so the immediate
values indicated by so these are
actually indicated by this dollar symbol
so these are the immediate values these
are saved and the numbers before this
are actually indicating the offsets the
corresponding offsets and this stands
for the address of the stack pointer so
therefore this actually stands for the
the stack pointer address and these
stands for the corresponding offset with
respect to the stack pointer so
therefore this is our offset of 8 these
are the offset of 4 bytes and this is
and this is the place where you are
pushing it and even in this case we see
move L has been used you can also think
this to be like a push ok and the
instruction call will actually push the
instruction pointer into the stack the
saved instruction pointer is a return
address or ret to which the program
counter jumps after the call is
executed so after the call is executed
it has to go back to the old return
address therefore the instruction
pointer has to be stored so therefore
that is the first thing which is being
stored after that what we do is that we
update the frame pointer so the frame
pointer EBP is pushed into the stack and
so therefore this has been done here so
you can see that push el EBP means the
corresponding frame pointer is pushed
into and then we save this current stack
pointer as the frame pointer and then we
actually add just the stack pointer for
so in this case again 16 bytes have been
allocated so therefore we depending upon
the variable size it seems there we have
a total we have a character size of 15
so that means 15 bytes are necessary so
we allocate space for 16 bytes for both
the buffers so therefore the current
stack point is saved as the new frame
pointer so and the stack point is
decremented by 16 bytes to allocate
space for the character buffers of total
size 15 bytes so therefore pictographic
Lee this is how it will look like so you
have got this 3 to 1 and this is the 3
to 1 and this is the corresponding
return address this is the old or saved
frame pointer which has been saved
previously and the new frame pointer
actually points at this and these are
the local variables and this is the top
of the stack okay so therefore this is
the space we are actually the local
variables are actually stored are the
values of the local variables are stored
so now you see that this is the broad
arrangement of the stack and therefore
we will see that what happens when we do
an overwrite into this stack okay so so
in order to do that in order to do an
over overflow so let us see like let us
consider this example where there is a
character buffer of size 16 and what we
do is that we use a string copy so
therefore this function actually takes a
parameter of a pointer to a string and
it will actually just paste this or copy
this into this buffer now when we pass
this particular string or rather this
particular string to this function
instead of this size of 16 bytes let us
pass a larger string so let us pass a
string of size
is 256 characters and let us fill it
with the ASCII value of a and let us
write try to overwrite into this buffer
okay
so now what happens is that based upon
our previous discussion this is the
space which is therefore the buffer
right this is the space means this is
the corresponding size of the buffer
there is 16 bytes along with there is
the address of the str also because we
have seen that we have used the screen
copy so there is also again another
function call so which means that we
there is a pointer or the base pointer
of the string and there is a base
pointer of the buffer also so therefore
these are also there so this is the
address of the of the str and this is an
address of the buffer so again these are
these comprise of 4 bytes and 4 bytes
each and this is the updated point where
the stack pointer has been updated okay
so therefore now this example shows that
when we are actually right when we start
writing in this Esquivel u of a which is
actually 4 1 so then for 1 actually
writes from this point and continues and
actually goes past the end of the buffer
and may continue and modify or corrupt
this return address right so therefore
this example shows that the seemingly
innocent buffer overflow can actually
lead to a change or the return address
the return address can be corrupted
using this kind of overflow techniques
so although in this case it is an
illegal address and may happen that the
program gives a segmentation fault
but the fact is that this corruption of
return address is can be used to
actually change the flow of an existing
program ok so let us now I mean just see
one more example where it may happen
that the program actually do not end up
in a segmentation fault and actually end
up in doing something what is not
intended ok so let for consider this
simple problem seemingly simple problem
that you have got a main function where
you just update a local variable B equal
to 0 call a function which actually does
not seemingly tamper B okay and then you
again make B equal to 1 and then print
this so therefore it does not matter
whatever you do here since me is 1 we
expect that B should be printed as 1
right
but what will happen is that it may
happen that this does not end up in
getting what is intended so therefore it
may be notice that the program should
not have any effect on the output of the
printf function in main the printf
should actually display the value of the
local variable B as one
however the call function changes the
return address and makes the control of
the program to skip the assignment of X
equal to one so it may happen that so
sorry this should be actually be equal
to one okay so therefore it may happen
that the call function because what we
expect is that once this function is
called it actually returns and comes
back and execute this line B equal to
one so what may happen is that because
of an existing buffer overflow in this
function the corresponding return
address gets changed and gets changed in
such a fashion that this particular line
is skipped and we come to this print
where we print actually be equal to zero
which is the old value of B okay so now
how is this done like how is the return
address keep I mean how is the this
particular line skipped so in order to
understand that let us again see the
stack the snapshot of the stack so we
will see here that these are the twelve
bytes which is being allocated here this
is the corresponding return address four
bytes and there are four bytes here so
if we can see immediately that 12 plus 4
is 16 plus 4 is 20 so depending for I
mean relative to this you have got a we
have got an offset a positive offset of
20 bytes so therefore the buffer plus 20
actually will point to the content in
the stack where the corresponding return
address has been stored so therefore you
can see the or program now so we have
actually jumped by 5 into your location
so there were five integer means 5 into
4 is 20 and therefore we come to the
place where the return address has been
written and instead modify the content
of the return address where the content
where the point our return points to
okay so start at ret is the
corresponding value there and we update
it or increment it by 7 okay so somehow
and so let us forget right now why this
is 7 but what is important is that we
are actually changing the content of the
corresponding return value ok so
whatever is the return value here or the
return address here is that
incremented by seven okay so now y7 for
dust for that this is just a simple
snapshot of how of each of this lines
and this has been generated by the gdb
tool and we see that this is the line
which is actually what which actually
does the assignment of be equal to one
okay so we want to skip this line so
therefore in order to skip this line we
have actually to increment this pointer
or the return value because the return
value presently should be this and we
have to increment it by seven places
because that's the difference between
this memory location and this memory
location okay so it is evident from this
tool that actually the return address
needs to be incremented by a step of
seven once we increment it by seven then
this line gets skipped and we come to
the next line which actually does not do
that as I do that do the assignment of
be equal to one so therefore we are
actually skipping the this yellow line
and we therefore get the value as we
gets printed as 0 and not 1 because the
assignment of B equal to 1 was never
done ok now what we see or rather what
we learnt from this simple example is
that this ability to overflow the buffer
and change the return address provides
the attacker the power to plant
malicious programs and execute them on a
function call now the attacker it may
happen like we can consider it like the
attacker copies a large string into your
buffer without doing any bound check the
return address is thus overwritten with
the address where the malicious code is
located so therefore what we what an
attacker can do is that you can update
the return address with the address
where a malicious code is being kept and
what may happen is that this exploit can
be used other than they exploit for the
stack overflow okay so what means what
what it typically does is that the the
expert for the stack overflow rights are
corrupt and environment variable now the
environment variable is filled with the
return address which actually points to
the location of the malicious program ok
now when the actual program comes into
execution and uses the environment
variable and copies into any subs into
any string the malicious code comes into
play
now these kinds of attacks are very
commonly known as the stack smashing
attacks okay so therefore what is the
idea the idea is as follows that is you
have got and you have got you want
essentially to change the return address
to some address where a malicious
program has been planted right so in
order to do that we actually what what
the attacker can do is that it can
change some environment variable which
is being used by that by a particular
program now the environment variable is
modified in such a way that it is
actually modified and modified to
contain or it is overwritten to contain
the address of the malicious program now
when the program reads this environment
variable what may happen is that the
string corresponding to the environment
variable gets and sits into the return
address and since the environment
variable contains the address of the
malicious program now the return address
is being changed to somewhere where the
malicious program is being kept and
therefore when we run a particular
program which is supposed to maybe do
something some objective or achieve some
objective it may end up in actually
triggering a malicious program so the
malicious program could be a virus it
could be a worm or some other some other
program which is not intentional right
so these these kinds of attacks are
something which is known as the stack
smashing attacks and can be exploited
for attacks now recently there are
several safeguards modern compilers do
take strategies to prevent these kinds
of attacks the correct computation of
the return address is needed for the
attack and therefore what the compiler
tries to do is that it tries to prevent
them by using various things like stack
mail misalignment and things like that
so therefore modern compilers omit extra
codes to check for buffer overflows such
as tacks mashing attacks so it could be
like it actually adds a guard variable
to functions with variable width
vulnerable objects so this includes
functions that actually so if there is a
function like where you are using this
Aloka that means you are allocating
space to dynamic variables okay or if
you are using buffers which are larger
than 8 bytes then these guards come into
play okay now when these guards are
initialized whenever there's a function
is entered and checks when the function
is exited
okay and therefore these guards
and if this guard check fails then the
program actually does not continue and
it actually faces an error message and
the program exits okay in in the
gnu/linux my environments and later
washes I mean and versions like which
are presently available these are
actually kind of enabled by default for
C and C++ okay however in spite of these
productions stills stack smashing
remains a threat for software's and
needs to be kept in mind when we are
writing programs so the typical idea is
that when we are using functions like
say strcpy and which function calls
which actually does not do any bound
checking's so when we are writing
programs for security it is advise to
actually instead of writing them we
actually use function calls which takes
care of the bounds so that what we do is
that we actually replaced like strcpy by
things like strncpy which actually takes
care of the bounds okay so therefore is
the idea is that you replaced your
unbounded implementations with bounded
implementations even if you are doing so
you have to write or emit explicit codes
which will take care of the mounts okay
so this is a kind of thing which is to
be kept in mind when we are writing
programs for security purposes otherwise
what may happen is that we may end up in
writing a nice encryption algorithm but
may end up in being steals are being
subjected to attacks which actually do
not target the algorithm but target our
implementation so therefore we have
already come to the topic of malicious
programs because we have seen one way in
which malicious programs can be
triggered okay so remember what are
malicious programs they are actually
they are actually programs which try to
subvert the expected operation of
secured and benign Goats the two most
commonly known categories of malicious
programs are worms and viruses so
therefore we will study little bit about
worms and viruses and understand their
differences okay so now once our
programs that can actually run
independently it can propagate a full
working version of itself to other
machines on the other hand viruses are
actually programs which cannot run
independently
so it is something like which are
analogous to biological viruses so they
need to infect a host program and then
so that it runs and activates okay so
therefore the essential difference
between a virus and warm is an infection
step like wiris has to infect virus
cannot run independently it has to
infect and then only it can trigger and
work okay so therefore this is the
essential difference between worms and
viruses so talking about ones first so
we have seen like I mean there are ample
examples in literature where C functions
without bound checks have been used to
trigger worms okay now the warned
programs exposed in various cases the
security flaws of standard functions
which are provided by UNIX family of
routines invest in the standard c
library takes inputs to buffers without
checking for bounds as we have just
discussed that is we can use like things
like data scanf scanf is can if and
other such routines so we have seen that
these may be used to warren buffers
unless the user explicitly takes care of
the number of characters so careless
usage of the routines like s printf and
usage of h TR c 80 and strcpy instead of
their bounded versions may actually
cause overflows okay so therefore the
problem with these codes is that they
are functionally correct and seemingly
harmless however the usage of such codes
in networked or trusted programs can
cause exploits to work by carefully
doctoring the inputs so therefore it is
advice again that for security purposes
we actually replace these programs or
with these function calls with function
calls like this strncpy and strncmp as
an accessor come in these issues touches
are developed the first measure which
was adopted as actually to replace all
such codes by their bounded versions so
these washers accept values for bounds
on their buffer arguments okay so
therefore what is important is that you
may have an operating system and
depending upon the security of all
enables vulnerabilities which exist
several patches are being developed but
if you don't update your
patches in the operating system then
your system remains vulnerable so
therefore it is important for security
purpose to update our our operating
system patches so that the plugs are
sealed I mean the security
vulnerabilities are really plugged okay
so next all the servers and the
application should be checked for usage
of these bounded versions of course for
example considered like this is a
typical example like of the finger D
program so this is a demon right which
we run as a daemon to service to remote
requests using the finger protocol it's
a utility which allows users to obtain
information about whoever are logged
into the system right who are working in
the system
now the finger D servers used actually
the gate s call and thus we people have
to develop patches to develop I mean
rather replace these get s calls by
their unbounded versions okay so
therefore these revised versions or
programs do not make use of the original
gate s comments and they are devoid of
function calls which feel buffers
without checking for grounds okay so
therefore this is something which is
actually done to circumvent not the
functionality so there is no problem
with the original finger D protocol but
or the finger D utility but in order to
make it so that ensure that it doesn't
leak another is not vulnerable against
attacks like buffer overflows people
actually replace them by their bounded
versions and develop the patches right
so the other example which we can find
out is like the sane mail program okay
so what is the send mail program the
other way of running your form is by
targeting the sane mail program the send
mail program is actually used to the
send mail program is actually used to
run route mails in a heterogeneous
network okay so therefore if you have a
heterogeneous network then it is used to
without the mail in your heterogeneous
network now when the send mail program
operates as a daemon program the program
listens on a TCP port or 20 which is
commonly the port 25 okay in order to
deliver the Mail's using the simple SMTP
protocol okay simple message Transfer
Protocol
so the what the one actually mean one of
the ones which we have found out was
worked by Expo
the debugging option which was there in
the program the one would specify the
debug command to send mail and then
specify a set of commands instead of a
user address as a recipient of a message
so normally this is not allowed but it
was kept they allow easy testing of the
complicated send mail program so I was
you know I mean when when this
vulnerability was detected the new
versions of this program had to be
developed or released when the weather
debug option was actually disabled okay
so if it requests the user train the
route power or rather it may happen that
you either disable the debug facility or
if you want the debug facility then you
have to ensure that you are the you have
the route okay that is it has to be kind
of kept privileged it is not a normal
utility but a privileged leti okay so so
therefore in context to this we can
actually one thing which is very
important to discuss is the UNIX
password system okay so the ones the
several whomps actually attempted to or
other attempts to determine the
passwords which the users provide now
the UNIX passwords previously were
actually stored as plain text in a
password file now the system protected
the passwords by actually ensuring
access controls okay like everybody
cannot use it but I would need to
unintentional errors or wrong
programming this practice can be
dangerous okay so there was one example
where actually there were two system
admitted administrators who were working
on on the UNIX passwords on other where
they are actually working together so
while one was working on editing the
password system or password file the
other the other system administrator was
actually creating banners for the day so
banners means whenever you log into the
system you see those messages right
so therefore what happened intentionally
or rather unintentionally is that both
the files got swept so therefore it was
a case like when whenever anybody was
using they were actually able to see all
the files okay this is a typical example
were accidentally passwords keeping
passwords in plain text can be very
unsafe okay
so therefore the present-day UNIX
password system is to avoid keeping in
plain text and actually to use the
encryption so there is a
or UNIX program called crypt so what it
does is that it actually encrypts a
block of 64 zeros and uses the des
algorithm or des algorithm and creates
the corresponding cipher for the
password and stores in the file / EDG /
password
pa-pow in pas swd okay so idea is that
whenever you log into the system then
you actually give in your login and this
login is actually used to encrypt the
zero block of 64 bits and matched
corresponding ok so remember that your
password or whatever you are encrypting
is never decrypted actually so it is a
kind of a hash function entity although
we say encryption but it is a kind of
hash because you are using I mean your
key or your login is actually used as
the key for the encryption okay so the
Crypt function takes the user password
as the encryption key and uses it to
encrypt a 64-bit block of zeros the
resulting 64 bit ciphertext is then
encrypted again with the PIA password
the process being repeated around 25
times ok so the final 64 bits are
unpacked into a string of 11 printable
characters that are stored in this
particular file now whenever you change
your files I mean I mean I mean
important we actually use this utility
password P sswd to change the files now
a particular rather principle which is
known as salting is used so the reason
salting is used is to prevent actual
attacks which are known as dictionary
attacks now a dictionary attack is
actually launched based on the
assumption that when somebody or rather
uses a normal user actually you develops
or rather creates a login or I mean
creates a corresponding password the
normally the password is an alphanumeric
password and it has actually a meaning
in the English language okay so
therefore what may happen is that if an
attacker actually tries all the
available entries in a normal dictionary
and tries to see that which creates the
match ok so this attack is commonly
known as the dictionary attack ok so
that actually reduces the entropy of all
possible English language whether Roman
characters right so now in order to
prevent it the people uses something
which is known as a DES salt or a salt
which is the 12 bit number
0 & 4 0 9 5 miss lightly changes and
makes it complicated to do a dictionary
attack ok so whenever the password is
changed with this utility a salt is
selected depending on the time of the
day the salt is converted into a 2
character string and he stored in this
file along with the encrypted password
now the past purpose of the salt is thus
that the same password can be stored in
4 0 9 6 ways in the slash EDC / password
file so it just makes your job of doing
a dictionary attack more difficult ok so
so therefore this is this is a common
common way or other common principle of
actually preventing against what is
known as the dictionary attack which is
launched by the adversary by recording
possible passwords which are chosen from
say English and numbers in your files ok
so now we come to the topic of on
viruses so as I told you that wide us
has got three important parts the in the
infection mechanism the payload and the
trigger so typically a pseudo code will
look like this that is there is an
infection step if there is a trigger
then there is a payload ok so what the
infection does is actually this is
nothing but how a virus copies into
other codes modifies the code and
contains a copy of the virus so this is
sometimes called as the infection vector
of the virus also then you have got a
payload the part details what the virus
does besides spreading like it has to do
some malice so what is the malla is
specified another polite
the payload may also have some accident
dealt effects also which may have
happened due to existing bugs in the
virus code ok it may do something
unintentional damages also and there is
a tree guard so it is typically a
boolean conditions based upon which a
virus is triggered now there is
something just called as a logic bomb
now the logic bomb is a typical case of
a malicious program where there is no
infection part there is only a trigger
and there is only a payload ok so a
logic bomb could be like whenever it
could be it could also call like
something which is called as a time bomb
that is depending upon the day of the
time that comes into execution ok so so
now we will try to see what are the
classifications existing for viruses so
so we will try to classy
based on the target so these are some
many commonly known classifications so
one is called a boot sector virus so it
is actually exploits the basic boot
sequence of a computer as we know that
there are two important steps one is the
primary boot step and the other one is a
secondary boot step now in the primary
boot step is a particular step when when
the system boots up it actually detects
what is known as the boot device right
so what this particular order this
category of boot sector in fact has does
is that it actually hampers that
mastered boot block so therefore that
master blue wood block gets corrupted
and whenever the system boots up instead
of actually booting up from the master
boot block it actually gets affected by
the virus now one of the advantages
which exists on in the while in the in
this kind of virus is that till now the
operating system is not active right so
therefore the anti viruses are not
active okay so therefore the boot sector
viruses actually come before the
antivirus actually comes into play okay
but however these days these kind of
viruses are very uncommon because we
normally do not boot from things like
floppies and other things okay so this
is again but still a primitive kind of
virus but an important class of viruses
now there are some other viruses also
which is known as fire infect us now
these viruses typically target those
files which is always considers to be
executables okay so these viruses are
generally something is called as a pre
pending viruses or a pending viruses so
they are something like generally before
the virus starts or it is generally
after the virus starts so so what will
happen is that
so therefore what what may happen is
that typically you take any executable
what these kind of viruses does is that
it either happens at the beginning of
the virus or at the end of the virus but
obviously you see that there is a
problem which comes with these viruses
is that the size of the files gets
increased right and therefore they can
be detected by anti viruses so in order
to prevent them we have something which
is which is a different class of viruses
we just call the overwriting viruses
okay so the overwriting viruses actually
tries to find out the repeated values
which are they are in in a particular
file and tries to actually modify
by some Wireless values okay and
whenever the process of the damage is
over then they again replaced that by
the original text okay so that the
antivirus does not catch it and in order
to prevent the increase in the space
what is done is that it uses the thing
like page Li features like page
alignment in order to because of this
page alignment we know that often the
space which is allocated for a
particular file is more than what is
actually needed now this extra space is
kept for I mean is because of the page
alignment but this extra space is being
exploited to plant in the viruses okay
so is actually exploited to plant in the
viruses so therefore these are so
therefore these are some common
techniques about from them you have also
got something just known as companion
viruses these company and viruses are
one which is install such that it is
executed before the target code so there
I mean what may happen is that they may
you may actually give the same name but
you can actually give a different
extension which actually executed before
the original code okay so before the
original code the virus code is also is
actually triggered and Samia I mean you
can also have something is called as
macro viruses where you are using may be
a what think word editing file and you
press a maybe a save as option and that
save as option actually triggers a macro
which actually infects your while so I
mean infects your file so this is
something which is known as companion
viruses then there are several viruses
which actually uses encryption methods
and encryption techniques the encryption
techniques are generally very light
weighted because they also has to be
ensure that they are not detectable and
are not understood by the corresponding
anti viruses so based upon them you have
got three kind of viruses one is called
as illegal morphism then metamorphism
and polymorphisms okay so in this case
you have got basically you want to
change the Decrypter loops because
whenever you have got encryption used to
are viruses there has to be a decrypt a
loop right and what we would like is
where we have various Decrypter loops so
the antivirus does not catch them so but
in all ego morphisms the the thing is
that the number of possible decrypted
loops is limited okay like the memorial
virus had
maybe ninety-six Decrypter loops so it
is small but in as opposed to this in
polymorphic viruses there is an
extremely large number of decrypter
loosed maybe like 6 billions in case of
some viruses ok and the virus actually
changes the Decrypter lives by using
various mutation engines like the
techniques like which compilers uses
like instruction equivalence sequence
equal equivalence like parallelism zkn
currencies ok so you can have your OS
techniques like signal and weight kind
of things which can be exploited so that
the Decrypter loop changes and it cannot
be rejected by the anti viruses now you
also have got something like
metamorphism which is actually where
poly I mean like polymorphic but only
the actual body is actually encrypted ok
not the Decrypter loop but the actual
body of the virus ok so in this kind of
viruses you use randomly jump
instructions and most polymorphic
viruses decrypt to the same body and so
you will see that in polymorphic viruses
after you do the decryption there is a
particular time snap-snap sure of the
time when the original body of the virus
is there ok so therefore there you can
actually have things like string
matchings which you can use for
detecting your polymorphic viruses but
that you cannot do for metamorphic
viruses okay because made America
viruses are essentially there is no
particular state where essentially the
entire virus is disclosed and therefore
the antivirus techniques for metamorphic
viruses are actually quite challenged
ok so I'll end up again with thought or
in compiler a question like how do
modern compilers protects against a
cover flow you can just do a little bit
of survey on this and the other question
is like assume that the virus body has
got signatures belonging to this set
like mention here like 0 1 0 1 0 and so
on and so forth till 1 1 0 0 1 so you
can think of writing a C program to
parts of the file and printing a lot of
a signature is found okay so therefore
you can use your eyes rather implement
or visualize the rejector as a finite
state machine so this is one class of
anti viruses which are actually build up
like finite state machines which
actually detects what looks for these
signatures in the virus files ok so
people used
structures like try to detect them
actually so so these are some references
again this is a very interesting
reference this smashing I mean smashing
the stack for fun and profit by lf1 and
you can read this building a secure
computer system by Mori gasser and this
book on computer providers and malware
where you can find an excellent
depository and discussions and viruses
and malware's so in the next day we
shall discuss about firewalls and
intrusion detection schemes so and that
could be the next thing when we see
about how to tackle security issues in
networks
you