CSE 190_A Home Page
This is the class home page for CSE 190 A, Introduction to Systems
Note new due date for assn3: due 6/6 11:59pm. The
final is now available [also
PDF]; it is due on 6/11 10:00pm.
Final Exam Clarifications:
Question 8: Give the necessary conditions....
Question 9: The code for mod_exp contains a minor bug. It
big_int mod_exp(big_int b, big_int e, big_int m)
big_int x = b; /* OMITTED EARLIER */
for (i = 0, y = 1; i < MAXBITS && e != 0; i++, x = mod_mult(x,x,m), e = e / 2)
if ((e % 2) == 1) y = mod_mult(y,x,m);
The initial handout is available in postscript
Homework / Projects
- due 4/7. Write a threat model/assessment for your home.
Give the assets to be protected, attacks and skill levels involved,
etc as we discussed in class. To alleviate confidentiality concerns,
you don't have to exhaustively list your assets -- you may substitute
parts with assets with similar security requirements. Turn it in by
- due 4/19 before class. Attack the given
program. Make sure that it works on ieng9. In your
write-up, describe what you had to do, why it was needed for the
attack to succeed, and describe any tools that you had to create to
mount the attack. Also give detailed instructions on how to use your
attack tools so that I can verify that things work in my own
environment. Your tools may depend on the test program's output.
You should turn in the write-up along with all of your source code.
Do not include the original assn2.c source code, any
executables, or binary data. Turn in the assignment by the
- due 6/4 11:59pm. Identify security weaknesses and
attack this RPC system (orig).
(You may attack either the original version or the updated one;
identify which in your write-up.)
The client/server code
provided shows how this simple RPC system is used. You must modify
the client so that the server -- code unchanged -- can be made to
print "Hello world" to its standard output. Your attack code must
work in the Solaris environment. To run the client side, you'll need
the net_redir program as well.
A list of preliminary bugs (accidentally released) is
here. If you got the earlier version of the tar
file, you should modify the Makefile to include -lsocket.
Your write-up should include an exhaustive list of the security
vulnerabilities and design flaws, and describe in detail how you
mounted your attack.
Your Makefile (for Solaris) should include the line
as well as the -lsocket -lnsl for the final linking step.
Also, change the uses of mcopy in rpc.c to memcpy.
For those of you who are confused about the use of
net_redir, you compile it by:
cc -o net_redir net_redir.c -lsocket -lnsl
(The -lsocket -lnsl is needed only on Solaris.) And you run
the server as:
% ./server -p 6789 -v
in one window on a Solaris machine, say named ieng9, and
then in another window -- on any machine, as long as you have compiled
the client with the right byte-ordering conditional compilation
directives -- you run the client as:
% ./net_redir -s 6789@ieng9 -d 3 -- ./client -v
The number 6789 in both the server and the client command
lines is the TCP port number at which the service is located. (The
-s flag allows you to use service names found in
/etc/services as well.) The number that you use doesn't have
to be 6789 -- as a matter of fact, since the server will fail
to acquire that port number if somebody is already using it, you
should probably chose your own. The only restriction other than its
being unused is that it must also be above 1000, which on
Unix systems are reserved for use by system services.
There are some uape machines
configured so that the stack segment is not executable. This is very
rare. To verify that the machine you're using permits execution from
the stack, run ~/../public/stack_test. If it dumps core,
then it doesn't allow execution from the stack; if it outputs a
message, then you're okay.
Scan through the Orange book (DOD 5200.28-STD, 85)
(earlier version (CSC-STD-00l-83) also available)
summary of the differences
between it and DoD Standard 5200.28.
The Orange Book is the classical specification of multi-level security,
and deals with trusted computing bases, trusted paths, data labelling,
etc. Aka TCSEC.
Thompson's 1984 Turing Award Lecture, Reflections on Trusting Trust. A true classic.
The Protection of Information in Computer Systems (Q&A on May 10, to be continued on May 12)
Software Fault Isolation paper.
(Q&A on May 17)
(check out an hopefully fixed version with a better page 7 / figure 4, at least when previewing with gv/ghostview; you may also want to look at page 7 by itself)
The Design and Implementation of Tripwire (Q&A on May 19)
Building Diverse Computer Systems (Q&A on May 24)
Security Problems in the TCP/IP Protocol Suite
(Q&A on May 26)
Useability of Security
(Q&A on June 2)
Security Related News / Current Events
Here are some recent news items related to security
Bennet maintains a list of Web resources relating to
computer security, ranging from cryptography resources, system
security testing tools, to word compilations useful in eliminating
search CSE |
CSE home |
bsy' home page |
webster i/f |
pgp key svr |
firstname.lastname@example.org, last updated Fri Jun 4 15:08:30 PDT 1999.email bsy