connor can you confirm that we are live
on twitch
i guess i can confirm it but then my
computer will die
all right welcome to uh phone college
i really hope that wasn't the
uh my my headphones disconnecting that
would be unfortunate nope it seems like
they're alive um we are uh
doing
oh no sorry sorry i forgot let me let me
stream
my video i am running into
exotic problems okay we're good
all right this first time is gonna be
quite a
um so uh don't panic
all right here we go
you guys should all see my video
perfect and very obs says we are
streaming
man influencer life is is
so close okay um so we're live
uh welcome to pawn college um welcome to
csc 466 those of you
at asu um
this is going to be an interesting
experiment so when asu moved all
large classes uh such as this one
to um
asu sync zoom
i figured since we're going to be
broadcasting this from my office anyways
why not just try to broadcast it to the
world um
so we've made this decision i don't know
two weeks ago and it has been
two weeks of absolute insanity for uh
me and connor and uh you know
just just just kind of crazy so to
introduce myself i
am uh yantro tresville my
handle that i go by in certain places is
zardis
um i am a cyber security professor here
at arizona state university
um and uh connor who is the ta of this
course and the co-creator of this
the framework and everything that you'll
be using
um throughout this course is uh one of
my awesome graduate students who does
cutting edge research in cyber security
and also participates
in competitive um hacking competitions i
guess that's a
obviously the hacking competitions are
going to be competitive um
i spent uh quite quite a long time
participating in cyber security
competition still
still do sometimes i also uh now run the
world championship of um ctf which is
called
defcon ctf ctf is cyber security
competitions anyways we're getting a
little ahead of ourselves
um uh let's start
with an intro video to the course you
might have noticed
if you looked on pond.college and
followed the youtube link that this
video is already on youtube
this will be the only time in the course
where we replay a youtube video it's
just i didn't know
a good way to make sure everyone watched
this before we dove in
um so we're going to to watch it now
connor can you check real quick um
how we're doing on twitch are we are we
famous
oh hell yeah all right uh let me bring
up the chat
and get excuse me um twitch quality is
better than zoom
okay that's not what we wanted to hear
damn uh
is it soup okay no log on zoom good good
good good good this is gonna be
hopefully this works otherwise we'll
have to uh be very exotic i
at one point when we were setting this
up i had two cameras
one one for a machine connected to zoom
one for a machine connected to
to twitch but it was uh it was a
nightmare
um all right
we got uh some
um some people trolling on the zoom
let's all it's all be good
okay should i bring up the okay connor
you're monitoring the twitch chat for
any questions there
perfect let's roll all right so i'm
gonna switch over
and play you that first lecture what is
computer system security
there's also a series already online of
fundamental knowledge that you should
already possess uh
entering this course right now i'm gonna
stress that over and over and over
in this introductory uh segment um
but uh this
is going to be a very uh
um difficult course if you
don't already have that knowledge um
anyways we'll get to that in a second uh
those lectures are already up along with
this one i'm gonna pause this for some
discussion since we can
do it um live on the video i say
unfortunately you can't do the
discussion
but i forgot about the pause button all
right let's jump in
and roll
uh by the way tell me asap if you don't
hear audio coming from this video
also super weird to see my office and
then my office in the corner
but that's fine all right here we go
ah what the okay all right
well we knew this was gonna be chaos
uh can uh can someone turn off the
zoom overlay connor
someone's drawing on my screen
i'll go i'll go figure out how to do it
uh
where is the freaking setting for this
meeting
amazing
there are no okay i have an idea one
second i'm gonna join for my ipad
and i know where the settings
are from there
hold your horses where the hell is it
i'll do that
all right first things first let us
let's turn off these annotations
uh
all right people asking about my games
i'll get to that in a second
all right
play join and leave sound is now off
perfect
allow participants to share screen no
but how do we
how do we turn off these
annotations
students
zoom disable annotations
that should be right there disabled
punches and annotations
amazing it didn't work all right well
um we will uh simply
persevere with uh some
wonderful student having drawn on my
screen all right
uh but at least is not showing up to
everybody
okay
oh it is showing up god damn it
uh we can just stop sharing restart here
all right there we go let's roll
hopefully annotations are truly disabled
now
um uh we can't roll because uh the audio
capture doesn't work i tested this
that's annoying all right let's let's
let's try this one sec
oh hello there can you hear that
no great
i think we could hear it on twitch but
not on zoom
of course all right everyone you can't
just switch between switch and zoom
what is a good what is a good way to go
um can zoom
share uh
ah okay good idea if we'll
do the camera route on obs
thank you for um bearing with us
with this insanity um we'll get better
all right this is gonna work
i'm gonna stop share i'm gonna start
video here
okay now if you pin my video
can you hear that oh hello there
no no great all right hold on one more
try yeah i can't send the microphone to
the webcam okay
all right we're i mean we're
we're in trouble
uh
we have no way to share oh
hold on
i i think i just got it
okay
i think zoom is dead or gnome one of
those
okay
rust but you are frozen this meeting is
being recorded
hey hey hey which seems to be working
just fine but zoom is frozen
i have both videos up right now i'm back
don't panic
all right now i'm gonna share screen
yes all right all right i know how to do
this
there's a zoom in it's infinite wisdom
has a audio button all right here we go
three two uh
let me change this back to the default
computing man okay
oh hello there did anyone hear that
nope nothing zoom are you me
yes
no we did oh you did it was just delayed
delayed and zoom are just delayed and um
still only on twitch
you know alternatively we probably could
just use twitch for the video part
yeah um all right here's what we're
gonna do let's uh
we're gonna run the video you can view
it
in soon but you'll have to listen to it
on twitch and then
um we will uh i'll pause for discussions
and of course those of you on twitch um
you can't speak to me but you can type
connor will relay your messages
and we'll have a live discussion that
way those of you on zoom
we can um talk directly with the asu
students all right
let's roll otherwise we'll run out of
time debugging this stuff we already
stayed up to like 5 a.m yesterday doing
it anyways um
anything i forgot to do oh bring up the
chat
yes i knew i was forgetting something
all right awesome let's roll
oh hello there my name is john
and i will be talking to you today about
computer system security this course
will cover a wide range of concepts
within computer system security
from a couple different vantage points
but first
i wanted to have this sort of
introductory video
to get at the meaning of the term and
the conceptual philosophical
uh meaning um in which we'll be
operating
right um so what is computer system
security
let's deconstruct this into its
constituent parts
and then um talk about it as a whole
later in
a sort of interesting example that we'll
look at let's start with the term secure
all right security is a term with many
meanings
it can mean different things to
different people emotional security
financial security physical security
um etc right um
to us we're talking about it from the
perspective of
systems security and what the system
security mean
system security means the
security of a system with respect
to a specified
um property right
so let's uh take an example let's say we
have a system that is a vending machine
this isn't necessarily a computer system
we'll get to that later
this is a system a complex system that
has a certain
goal certain properties that that should
be maintained one of these
is that you should not be able to
receive snacks or drinks or whatnot
without putting in some um
money into the machine or that payment
right so
let's look at examples of how the
security of such machines of
such systems can be compromised usually
when
i teach this course in person this is
a discussion a back and forth q a where
we
we kind of come up with attacks come up
with defenses
unfortunately right now there's a
one-way transmission
psych it's not all right that gun is
paused
this yawn is um going to lead this
live discussion um let's uh
talk about vending machines right so
we're talking about system security
vending machine is a system that is
designed to take your money in exchange
for delicious snacks and beverages
um so
uh let's
come up with a couple of potential
attacks
against this system to violated security
so you
walk up to a vending machine there is
let's say it is a very insecure vending
machine what is the
simplest attack against a vending
machine
that you can um think of
within monopoly money put in monopoly
money all right so we have a very simple
uh that's an awesome answer by the way
that i have not heard before
um we have a very simple machine
all it does is just make sure that
there's like a
you know number one on the paper you put
in and then it's like alright that's a
dollar right so that's
obviously a machine with a bug that is a
really you know
shot like a a flaw in its
design let's say but but it it or in the
implementation
of the money um input
and it leads to a violation of the
security of this machine and that
it's going to vend you uh snacks
but you put ahead of foot and banana
money all right so
the system of the security of my system
was violated someone was
able to get all my snacks as the vendor
of the machine
or as the the operator of the machine i
am upset of course upset i go and i fix
up the security of the system so i say
okay
no more monopoly money i'm going to
install
a money uh reader that
is you know the cutting edge uh
just make sure that that that is real
money right does all of the
ir whatever crazy spectrum analysis
make sure it's real money you're putting
in what now
is the system secure
no way i can use a sledgehammer all
right
sledgehammer solution and then we have
another solution
uh on um zoom
in the chat where uh it's the bendy arm
through the entrance right so two
attacks
let's talk one by one sledgehammer
through the glass
all right um that's a quite a valid
attack that is
you know brute force attack against the
vending machine and suddenly
you get all of the goodies and the
operator again
gets no money and also has to fix a
window
um that's a problem with the design of
the machine and you'll notice that there
are vending machines
um that have a reinforced glass
right uh glassware with it with steel
reinforced in it and a two two fix
this exact security hole right so again
uh
there was a there was the money problem
then that got fixed then there was
another attack
violated the security system again that
got fixed now there's another attack the
bendy arm through the
um output right um
someone gets their hands into the the
output goes up
grabs their sodas or whatever yet
another secure attack the security of
that machine was violated again
well now we need to add more patches
fix the machine again where we have kind
of some sort of a door
that uh you know is closed until the
the candy or whatever vans and then the
door opens
and when it opens it of course has to
block off
the entrance um to the to the machine
um you kind of see it kind of like what
what this thing is
is probably that all right um
[Music]
now uh the zoom is going crazy with all
sorts of suggestions do we have anything
from twitch connor
for a follow-up attack
connor might be dead
uh one second sorry there's uh tons of
stuff in twitch so
someone says force the owner of the
machine to open it for you
okay so you uh kidnap the owner of the
machine this is a
serious security one there's an xkcd
about this where you have all of these
uh
you know security measures and then
someone just beats you with a wrench
until you tell them your password
um this is the equivalent right you you
kidnap the owner of the machine and just
beat them with a wrench until they
uh open the machine for you so now
you know this is a serious security flaw
uh
despite our awesome machine we had to uh
you know still give up all of our candy
so now of course the
some sort of fix for this would be let's
say an anonymization
of uh vending machine ownership records
vending machine operators are protected
like
you know cia operatives or something
right where it's a secret and everything
um
all right uh the vending machine
refillers
okay you raid the you do a supply chain
attack
uh there was a suggestion on zoom just
now you go and
you attack instead of the vending
machine
the people that refill the vending
machine
that is yet another uh shockingly
effective attack so we have
you know this whole system is actually
more than meets the eye it's not just
the vending machine
it is also everything in in you know
the people that make the the uh snacks
the people that load the snacks all of
this crazy stuff
right um and it's getting more and more
complex
um and then you have you know attacks
uh you you have to protect against the
kidnapping of these people the bribing
of these people and so forth right
so the point is here and we're gonna
move on now because there we can be at
this all day there's no such thing as an
impenetrable vending machine um although
the
uh supply chain attack one is great i
also haven't heard that one before
um in this exercise the point is
that uh this can all be broken quite
easily and actually rather than
lecturing myself i'm gonna let recorded
me
lecture so we're gonna pass fast forward
a little bit so
we'll have maybe some of us drink or
whatever it's designed and
i babbled from one naive way means uh
takes several different approaches you
could just have a
um some little you know capsule
um ways to to a fix
of a patch let's say right to and with a
hammer
was able to retrieve the glass
so that that bypasses our first defense
attacks like bringing in counterfeit uh
currency and now you know this uh
machine has to have a way to detect
counterfeit currency
trying to pay with um something that
that is the shape of a quarter and the
weight of a quarter
or tying a string to your quarter
and pulling it back these are all
attacks that have been performed on real
uh vending machines that uh real vending
machines now have to defend against
uh in order to be uh secure
right and vending machines nowadays of
course are more and more complex systems
there are vending machines that that
take
credit cards this opens them up to a
whole other range of attacks
there are vending machines that with
which you can
talk with your phone and so forth right
so
the complexity of these systems
is is rising and the security of these
systems is more and more complicated
right and this discussion is really
meant to highlight
one thing and that is that a chain is
only
as strong as its weakest link right the
um story of the vending machine
compromise has repeatedly been here's a
big complex system let's try to find
one clever thing we can do whether it's
putting our arms
up through the the outlet
of the merchandise or you know figuring
out that we can
break it with a hammer or tying a string
to a quarter and so forth one little
thing we can do
that takes advantage of one part of the
system one small weakness
to fully break the security to get
snacks or drinks or whatnot when we
haven't paid
right so with that in mind let's move on
and talk about computer systems right
uh computer systems are as we know
not secure uh otherwise
we wouldn't be seeing the huge amount of
um
data breaches and and and chaos
that we see in the context of computer
system security and
they're very complicated and uh not
super approachable
um they're also growing
rapidly in complexity so this graph here
is a graph of the
amount of code just amount of code in
the linux kernel
over the years and we see
over the years just this monotonic
almost growth
uh continuously
and an interesting thing that we see is
every year a bunch of code is added and
then that code is rewritten
refactored removed over time but a lot
of it stays around
so in the linux kernel even today
there's a ton of code that was added in
you know 2006. um it looks you know just
based on a rough look maybe you know a
tenth of the code in the linux kernel
is 14 years old 14 years ago
cyber security was a completely
different world
um and
cyber security practices safe
programming practices were very
different
so this is a um
interesting uh influence on the security
of these code bases and there's a lot of
old code there's a lot of code that
people might not understand
and vulnerabilities get introduced so
let's look
um once we get through these takeaways
you know that
computer systems are complex and with
these complexities
you can get vulnerabilities and as we
saw from the vending machine example
uh a single vulnerability
can break the security of the whole
system
you know the the the chain again is only
as weak as the
tweak as link and if you figure out you
know one
place to to to jam your uh
you know violation of security you can
leverage open
the whole system very frequently um so
let's look
at it this as a whole what is computer
system security
from the view of an example and the
example focuses on this character
um this is not a muppet i mean
the the picture is technically a muppet
but
the character behind the muppet the
individual behind the muppet is
responsible for a very high profile
um hack that
is really um a perfect example
of a single flaw or a small collection
of laws leveraging
open the security of an entire company
and leading to extreme real world
effects
um a lot of this uh is gleamed from an
interview
um that this individual gave um
to a reporter um for a famous online
magazine i always lifts my mind exactly
which one i think it might have been
wired
um and for real uh there was
you you could find this online this
interview of an
actual human reporter um
right there talking to
right there um a a puppet
uh and the human reporter is asking
questions and the puppet is
uh responding using you know voice
anonymization
and so forth it's super interesting to
watch um along with this
this uh hacker um
also wrote it right up there will be
links uh to it in my slides
and i highly recommend you read this for
a
example of real world you know
um actual systems compromise
um that is kind of not sanitized not
it's just you know wrong and described
as is which is super
super interesting to read um so this
hack
was pulled off uh the individual's uh
handle
is phineas fisher um it's unclear
who exactly they are they might be you
know multiple people it might be an
entire group they might be one person
um but
uh sometime in uh 2016
finance fisher took issue with the
actions of a company called hacking team
a hacking team was an italian company
that created a number of hacking tools
and phineas fisher
was unhappy about the clientele
of hacking team which allegedly uh
initially allegedly and then eventually
after this hack took place
very publicly included um oppressive
regimes and and so on
um so in uh 2016 on one sunny day
in july i'm sorry 2015 now i see from
the tweet i i
always mix up these dates um july 6 2015
uh hacking team changed their twitter
handle to hacked team
and tweeted you know since we have
nothing to hide we're publishing all of
our emails files and source code
and these files included audio
recordings of phone calls
just an enormous information
amount of information it was a brutal
disclosure
um and of course they didn't do this
willingly uh finance fisher
compromised uh hacking team's entire
cyber infrastructure and disclosed all
of this on the internet
so how did this happen how was the
security of this computer system
so thoroughly violated as to essentially
uh destroy this company a hacking team
can cease to exist in in any large
high-profile capacity
um as a result of this they
were hit with a lot of scrutiny a lot of
um
criticism controversy and so forth
because of the disclosed information and
and uh their business you know suffered
very heavily
um so let's walk through the uh
the the the steps that finance fisher
took to um hack hacking team um
i mentioned there will be
a uh link to a write-up um that's the
link down at the bottom of the slide
um these write-ups keep getting taken
down for whatever reason so that's just
kind of the latest
version that exists uh out there um
the write-up is interesting in that
finance fisher
lays out exactly the steps that they
took
to um carry out this attack it's
uh um super interesting and we'll follow
it step by step
uh step one of this compromise was
reconnaissance right so finesse fischer
decided to
attack hacking team um and
they they looked into uh what
um attack vectors are possible
um in the write-up they talk about
the different ways that you can get
information on a company
by looking through
press releases by downloading pdfs
released by that company and looking at
metadata
embedded in the pdfs by looking on
linkedin on all sorts of other
routes right but in the end using
mostly kind of internet
reconnaissance finance fisher concluded
that hacking team
was actually uh pretty good in terms of
their external
um internet-facing security that very
little
network-facing infrastructure mostly a
web server mail server a vpn endpoint
and some
routers right that's a very small
digital presence
um they had a pretty low public profile
and
professional external security practice
i mean these were professional security
engineers right
it's it's a daunting target so with this
information in mind
finaeus fisher proceeded to gain a
foothold
in their network that was the next step
right so how did they do it
they looked in one of the embedded
devices routers or
or appliances or something um finance
fisher doesn't
specify in their write-up what which
exactly device
but they took this device uh
metaphorically speaking downloaded the
um
software that runs on this device uh and
you can do this in a number of ways from
you know let's say if you have a linksys
router um you can go to linksys website
and download a firmware update unpack it
and there's
the software um so vanessa fisher
downloaded the software spent a couple
weeks analyzing
that software and found a zero day
vulnerability previously unknown to
anyone
and now unknown to anyone but finesse
fisher
so finance fisher had a you know
get into the system free card so to say
and they used it
to gain a foothold in hacking teams
network
um after that having gotten on the
network they
performed internal reconnaissance right
and then the luxury of taking it slow
and steady because again
the vulnerability that finance fisher
used
to get into the network was unknown to
anyone
but them it is as if you uh
wanted some snacks and you figured out a
new way to contort your arm
so that uh you could get past the
vending machines
uh output blocker and get some snacks
right
so until other people catch on
uh if no one sees you use this trick to
to steal
uh snacks you know you're
kind of uh sitting pretty on
on on quite a lot of stolen food
for whatever reason but uh anyways
maybe a bad analogy but that was the
situation with uh finance fisher sitting
on
hacking teams networks so they had the
luxury of taking it slow and steady they
did
initially passive network listening and
then careful slow
active network scanning to identify
several other
pieces of infrastructure on hacking
teams network internally
that were now fairly um accessible right
and that weren't
properly secured so again this is where
things start getting really bad but keep
in mind
that this is inside their network
right inside their network uh things
weren't secured from
uh people that were already inside their
network but
you know that's from my experience not a
very uncommon thing
so anyways um they found a unsecured
server that had audio recordings of the
physical security system so that's
already pretty bad
right um that was a lot of audio that
ended up in that final disclosure
um and and and that's uh
[Music]
not something that you want um around
food
aside from a lot of confidential
information getting
set over the phone or whatever with an
earshot of your cameras
there's a lot of interesting techniques
where
by using the sound of your keyboard
typing you can
recreate you know the keys that you
press
for example uh recent research has
indicated that you can use the sound
of your key going to a lock to actually
synthesize a copy of the key itself
right so this is uh maybe theoretical
sci-fi-ish attack still but but
leaking all of your audio recordings
already bad but it gets worse
right um finance fischer kept
looking and one thing that they found
was
a badly secured backup server
which is uh very bad because on this
backup server
was a backup of
the mail server and by analyzing the
backup of the mail server they were able
to extract the credentials
of the administrator of the mail server
and these credentials were still valid
on the running mail server so this is
kind of a
flaw two and three here where there was
an unsecured backup server
and on that unsecured backup server was
a backup that had a
password in it that was still active
right but when you take backups do you
remember to change all your passwords
after every backup i mean i've never
heard a policy like that but
from this perspective that would have
been a good policy
so it turns out that
having full control of the mail server
it'll come in
useful later for finance fisher but it
also
helped them spread out over the network
because they were able to
use that mail server to gain
administrative
privileges over the entire windows
domain that
hacking team had using that they
installed um
a key sniffer in the um
uh on the
sorry i'm trying a blank on the machine
of one of the
engineers one of the administrators and
was able to catch
uh a password being answered by that
administrator to unlock
an encrypted volume containing even more
passwords
and then they had basically free rein
inside the um
hacking team uh administrative network
right or the sorry the production
network the problem is
that finance needed access to
the development network as well hacking
team carefully segregated
their networks to um
maintain some best practice separation
between
the uh network that they
did their their development of their
hacking tools with that had the source
code of that hack tools etc
and the network that they did for
everyday business oops
um and
using the passwords that they recovered
from the encrypted volume
they were able to log into a monitoring
server
that had access to both networks and
using an
end day previously known but unpatched
vulnerability
in that monitoring server they were able
to gain complete access
to uh the development network
because there were reused passwords
between the development
and the production network
just a quick interjection um here i
think i i mix something up when when uh
doing the lecture uh
the reuse password was just between the
networks phineas used an
end day to get onto that monitoring
server
um and then i don't think that that
there was a password involved in that
anyways the full write-up is is linked
there it's a
pretty interesting story right this
is uh more minor things that that
hacking team did wrong
from a security perspective uh password
reuse um
and uh allowing an unpatched
vulnerability to
be present on their network but again
this was inside
their network right um
and and many companies often ignore or
or de-prioritize the security posture
inside the network all right step six of
course uh
having compromised the development
environment and gotten all the source
code and so forth and so on um
phineas bundled it all up uploaded it um
to the cloud and used their mail server
their control over um the hacking tmail
server
to request a password reset from twitter
of course they emailed that
to hacking team to that mail server
finez grabbed the link changed the the
twitter details
tweeted out this gloating blurb and
released this data to the world right um
and again the
security of hacking team from the
outside before finesse fisher started
looked pretty good right this was a
careful company
of cyber security professionals
and this whole security chain unraveled
when finesse fisher found a zero-day
vulnerability
in a device that hacking team uses
we're using um in some sense
that's not even hacking teams fault from
a security perspective
right that is uh kind of the takeaway
of of this story that computer system
security is
so difficult uh to get
right that you know as we can see
through this
and tons and tons of other disclosures
even professionals
uh get it wrong all the time um so what
went wrong
as a summary um there's a bunch of
things a couple of
different weak links but for the most
part they were all
minor right um the lack of to
factory authentication for internal um
their internal accounts but let me ask
you do you use two-factor authentication
to log into your laptop
password reuse
[Music]
everyone i know reuses passwords to some
extent
even if not on the internet then
oftentimes on their
local computer accounts um i'm going
from the bottom
up here but but it's it's a bunch of uh
different stuff right
um they didn't isolate their backup
uh system because possibly because they
didn't expect passwords to get backed up
but the passwords did get backed up um
and you know it goes all the way up to
this zero day
in the physical infrastructure or the in
the public-facing network infrastructure
that we discussed
that's a very very hard thing to avoid
i can guarantee you that most likely
whatever public racing network
infrastructure you're running
has zero days that you're not aware of
in it just because
this stuff on average is very very
insecure right um in some sense
all of the security infrastructure that
we have built up
um is just waiting for one vulnerability
to crack it all
open so the takeaway that
i'm trying to to to convey
is that it's easy to
you know think oh okay
well hacking teams screwed up and they
got hacked
but the story of computer system
security is really that
the likely scenario if that would have
been your company
things would not have gotten very
differently
um all right now
we're gonna dive into a discussion of
ethics
in computer hacking because this is a
course that's going to approach this
problem of computer system security from
an offensive
perspective i want you to understand
the types at least on on
several very concrete um approaches to
the problem the types
of vulnerabilities that arise that
compromise these entire systems
right um for that you need to be very
careful
about ethics we need to make sure that
uh
the knowledge we learn in this course
and and our general
interaction with uh cyber security
is uh ethical and and correct right so
what
are the ethics of the hacking team hack
right obviously finesse fisher broke
into a system that they were not
authorized to access
and that is essentially the digital
equivalent of course of
breaking into someone's home or business
finance fisher in their write-up
discussed that they are
doing this that they pulled off that
hack
because hacking team was uh unethically
selling
uh software to uh oppressive regimes
uh and that
complicates this discussion in an
interesting way um
but in general
as ethical computer hackers i have to
stress
very thoroughly that you should not
practice cyber security against any
targets that you are not authorized to
practice cyber security against right so
let's get into some hacking ground rules
rule number one is please do not do
anything illegal i mean that should just
be obvious but it
needs to be stated and needs to be
stressed right
approach cyber security in an ethical
careful way
what does this mean specifically it
means
if you don't have explicit permission to
hack a system
do not hack it it's not hard that's a
pretty simple thing
don't hack systems you don't have access
to um
in the same uh vein
uh don't attempt to find vulnerabilities
in systems that you don't own
or or have permission to audit right so
uh what does that mean in practice and
how do you how do you even like
become a hacker get get good and so
forth well you can
run a server for yourself to hack right
if you're interested
in finding vulnerabilities in devices
you
use your own devices
uh you can stick to software and
services that have
bug bounties believe it or not the
current state of
cyber security is that most companies
many many companies will
actually permit you to try to hack them
as long as you
promise um that they'll be the first to
know
a lot of companies will actually give
you money for that
i'll discuss some of these monetization
opportunities
in a different video most likely
you can of course become an academic
like me my colleagues
researchers working doing awesome work
in
in my lab and other labs around the
world
um and academics get some leeway we can
we can uh
you know do research um
that is is very tricky to do as a
non-academic research
into um you know for as an example
uh the security of digital rights
management um
laws such as the digital millennium
copyright act
have exceptions for uh research
or if you really want to get a lot of
awesome practice
um you can become part of the
competitive hacking
community um so believe it or not
there are uh active
uh competitions of computer hacking out
there
um i run one of the the big ones um
and i'll also discuss that in a
different video to try to get
you all moving into the competitive
cyber security world if you're
interested
all right so what are the takeaways
right
again very important to stress a chain
is only as strong as its weakest link
uh this is the attack defense asymmetry
right in order to protect themselves
hacking team or any other
group that has been recently compromised
or hasn't yet been compromised
has to block every attack that's very
hard because the attacker just has to
land one
right there's the the typical attack
defense the symmetry
uh good defenses fail hacking teams um
external network-facing infrastructure
was
good it seemed secure
but it didn't save them right um
and very very very importantly hackers
have to be careful around ethics
right our field is um
a very cutting-edge
development field with with high impact
in the modern world
uh we need to take that very seriously
uh and as you learn various ways
to identify and attack
security in computer systems
i'd encourage you to always keep this in
mind
and always stay ethical
that's uh all for this video uh
all right sorry i didn't
i muted the wrong thing i was okay
perfect
um that is all for that video as that
video said
um so the takeaways of course is this
attack defense asymmetry that security
breaks down
very very fast in in exotic ways
when you know some single failure
occurs along the chain
[Music]
can we do a quick test to make sure we
are
live on uh zoom still connor can you say
something
but can i hear you on zoom is the
question okay
awesome all right awesome stuff so
um we uh
that pre-recorded uh video i apologize
it's probably not
so exciting to watch something live
that's available on youtube
[Music]
uh how will this
class work going forward let me um
discuss this
with you right now i'm going to um
pull up some slides first of all any
questions from that video on twitch or
zoom i now have twitch open on
on my uh other device
um
all right someone said that it was a
very entertaining thing that's great
anyone on
uh dang black sure down is not nearly as
cool as blue shirt john i like it that's
good
good okay so it sounds like everyone is
pretty
pretty uh amped on that video let's move
on to this course
um let me pull it
the right slides up oh they're already
there
all right
here we go let's talk about what to
expect
in this course and how it uh it's gone
uh or it will go all right um
i uh mentioned uh earlier
that you'll need some prerequisite
knowledge to
succeed in this course uh i'm not joking
um this course expects that you know on
a relatively
deep level linux ideally python
c and x86 assembly so there are
um videos for this module where i go
through a lot of these
if you already know what i still
encourage you to watch to watch these
videos
just to um get you know
fill in any gaps that might be in your
understanding and so forth that go
fairly in depth about for example the
life cycle of a linux program
and so forth and it'll set you up
better for the rest of the course uh
regardless of what knowledge you come in
with this is a course
about learning fast right um
this course will uh
[Music]
explore an enormous amount of topics
for one semester class uh we're going to
start with
um on this introduction and fundamentals
and
and uh actually and linux um an
assignment will
uh split into groups to to start um
shortly here um then
that will last one week so assignment
will be assigned
during this class it's due at 4pm next
wednesday then um we
go with shellcoding that's live for one
week then sandboxing
binary reverse engineering uh simple
memory corruption
return oriented programming uh dynamic
allocator
misuse or heap uh flaws format strings
race conditions then we'll have a guest
lecture on
the week before um america has its
voting day so i i don't want to have an
assignment that
overlaps and especially is almost due
on voting day which is november 3rd so
if you can vote go vote um
obviously that's not like a homework
assignment or something but
don't worry about this class for that we
have a guest lecture instead to kick off
that week and then you can use the week
to
catch up on previously missed
uh homeworks and so forth i'll talk
about that in a sec
um then we'll go into kernel
exploitation that is a a big reach
last year we almost got there um but
this year we will get there and we'll
blow all the way through
to automatic vulnerability discovery
those are
the uh
um that's the game plan
those are the the the planned modules we
have two wild card slots
that we can use either for a delay if
it really hits the fan and everyone is
failing um
don't count on that um or a
uh additional topics uh potential
additional topics
web security cryptography um
maybe security and machine learning who
knows uh we'll
have something for you there and then on
the last week uh
there's there's no final to this class
actually there are no exams it's all
uh these uh um cyber security uh
challenges on the last day
we'll have a guest lecture and then
closing remarks
any questions about the the course
all right let's see
someone sent out a dot ru link where you
can vote early online
that's probably not um all right someone
asked will there be
any mercy uh i will get to that in a
second so
let's first get to what every topic will
look like uh every topic we'll have a
lecture introducing the topic and
additional lecture is going in depth
into aspects of the topic
um i'll try to work in real world
examples
uh or historical context or something
along these lines into
of course every topic that's always
interesting and then practice challenges
there are going to be tons and tons and
tons and tons and tons of practice
challenges to drive the point home
the homework that we will assign tonight
is going to have
100 practice challenges
okay that's uh to get across
it's it's it's a representative example
of um the types of uh
[Applause]
challenges and the types of assignments
that uh you will see
um these lectures with the exception of
that lecture that that i just played
will
not be played in class they will be uh
available before class and we'll use
class
itself for an extended q a
about the concept themselves and for
collaboration
i'll get to that in a second great
someone asked on
zoom if there will be any mercy um
uh the grades are very simple there's
gonna be between
like you know seven and fourteen however
many topics that we had many assignments
um each assignment will be scaled to 100
points so
this this first assignment it's very
easy one a challenge one point
every other assignment it's gonna be um
you know i don't know if there's 30
challenge problems then then
you just solve 30 you get 100 it's not
hard right
um your grade in the course is the
average of all your grades on all
assignments
period right there are no quizzes no uh
exams uh nothing you're not gonna
take an exam you know well i mean you
you will but
in in the real world but but
realistically i want you to learn
how cyber security works how all of this
um
oops let me move myself flow to the top
there
how cyber security works and et cetera
et cetera so that um
you uh
[Applause]
[Music]
uh have a good base for
your future career or your future
research or whatever it is in cyber
security or
your future nightmares whichever um
extra credit opportunities uh there
are several um the first one is super
doable right so
if we have um 10 topics let's
let's jump back and look at the look at
the plan topics here right we have one
two three four five six seven eight nine
ten eleven for sure and then
two more wild cards right so we'll
every homework is gonna be worth between
ten and
eight percent of your grade roughly
right um
and then however
uh there was some weird thing on zoom
for a second uh there's a question on
zoom
uh is this course harder than cse 340.
conor what is csc340
is it is it a very hard class i have no
idea
okay the answer is this one is harder um
okay uh there's another one
jan would you like the discord link
which discord anyways it's not we'll
deal with it later
um will 365 be enough of an intro for
this course
yes i think so um this course will be
hard regardless but i think 365
uh depending on uh
the flavor of 365 it changes slightly
should be enough
of an intro um if you have questions
specifically um
ask me connor if you could respond on
these is it harder
than x um we have now uh 355.
um you can uh there's a discord for my
course and i didn't create it
fascinating okay
is it o'connor says it's harder than any
undergrad class
so i i would i would trust them all
right um
anyways extra credit opportunity like i
said
every homework is going to be ten from
eight to ten percent of your grade
uh the extra credit opportunity is huge
every weekend
i mentioned competitive cyber security
i'm going to
show you what no hold on that's going to
be
look like um
i'm going to show you real quick
this this is ctftime.org
it is a tracker of capture the flag
competitions uh cyber security
competitions
where anyone can join and and uh do
their best
right there are tons of them there's one
uh every weekend this weekend there are
two three
next weekend already there are two
scheduled and then more coming up
um uh will that will likely be scheduled
they are open for everybody open only
for academics
um there are uh ones that you have to
pre-qualify
it's not important the point is look at
these ones that are open to everyone
and you can um
find a whole set of competitions every
weekend why am i telling you this
because every weekend you have the
opportunity to increase your
final grade by one percentage point
right so you find
between four and eight students to
participate in ctf
a minimum amount of four maximum of
eight
and you dive in to a ctf listed on ctf
time for that weekend
do your best you don't actually have to
solve anything but i highly
recommend it write a write up about what
you worked on
what you solved what you failed at what
you learned
and so on i think there are someone
asked on zoom how many uh
weekends in the semester i think it's it
should be
14 um or let's say it will be 14
starting from this weekend
onwards i think if we look at um
we extend the oh oh hold on
god damn it okay
sorry i was failing at computing uh one
two three four five six seven eight
nine ten eleven twelve thirteen fourteen
fifteen so every
um uh
wednesday there are 15 wednesdays and
how do connor how can they be 15
wednesdays
all right i guess there are 15
wednesdays um
well that's interesting so uh yeah there
are 15 wednesdays that
implies uh that it's very likely that
our 15 um saturdays
and sundays so
there are so i am actually wrong on on
the slides here i say
15 a 14 extra credit um it's actually
15.
so one per weekend um there's a question
um
oh last weekend is outside course time
well damn
14 weekends then sorry um questions from
here
um do participating cts with the pawn
devils count
yes i will give you an exception to this
eight person maximum
as long as you're right up um if you're
if you're playing with the pawn devils
or uh when they play
together with shellfish that's also fine
but your write-up needs to very clearly
convey
that you as an individual participated
and were an enthusiastic
and a valuable participant in the ctf
um if you're submitting a write-up
of a a a time played
of a ctf played with phone devils um
then i will contact also the
the leadership uh their leadership and
so forth to make sure
that you you know were presents the
whole time um
otherwise you can also play with people
outside of the course
absolutely um that's that's totally fine
just you know list their names
and uh in your write-up and everyone
should submit an individual write-up
cool um all right uh there's a second
extra credit opportunity
it no one took advantage of it last year
because i guess we're just that good
our first year we went online the the
framework uh went up and within
i'm not making this up i think like 35
minutes someone had root on our
server it was horrible it was it was uh
my screw-up of course um so that person
emailed us i i had this bug bounty um
that person emailed us and said um
listen there's this weird thing i found
um what do you think uh they got
50 points extra credit 50 percentage
points
on their um homework so
uh if you find a flaw
in pwn college itself not in like the
the homeworks tell us to discourage
obvious time wasting if um i mean honest
mistakes happen but if you start
submitting every single
security vulnerability in a challenge as
a um
as a flaw uh to us and and
taking up a lot of time that way uh we
will start penalizing points
all right final thing if uh everyone is
failing and then the course is just
crashing and burning uh
if we over corrected with the difficulty
um
we could deploy a curve don't expect
this
i don't think we deployed a curve in
previous years
right conor because uh the grading
systems were had an enormous amount of
built-in extra credit
but this year there's less extra credit
the only way other than hacking phone
college itself to get extra credit
is participating in ctfs
once per weekend all right
relevant um times in the
for this course class hours are right
now obviously wednesday is 4 30
uh to 7 15. my office hours
are uh monday 3 p.m to 4 p.m
arizona time on both zoom and twitch
same same as what's happening right now
um
conor's office hours that are tuesday
2 p.m to 3 p.m arizona time on zoom and
twitch
uh someone just asked on zoom if
powerpoint is posted on the website
uh this one isn't yet but i'll push it
uh to the website yes
um and also this whole twitch stream
is gonna oh i forgot to click start
recording but whatever we'll
put the vod from uh from twitch to
youtube um
all right homeworks will be assigned uh
during class
and homeworks are due at 4pm there
shouldn't be an approximately 4 p.m
right here it is exactly 4 p.m
all right moving on someone asked are
the
assignments um on your own uh mostly
yes so if you're trying something new
this year previous years you have said
okay you can do level one with your
friends but
this is uh unworkable we'll try to spend
the last hour of every class
for student collaboration we'll split
the zoom into groups
um i've never really used these breakout
rooms
uh functionality before but we will try
to use them i
encourage you to you know in your
breakout room turn on video
share screen go start uh uh
typing away um and uh
you can work together
conceptually you can exchange
preliminary code
you can get a first step together on the
homework
um you should not exchange completed
solutions
because um you will require uh write-ups
with every flag solution
um uh so don't get yourself into a
corner where
it's like is this person cheating or not
under no circumstances during
collaboration or any other time
in this course exchange flags no matter
what
if you exchange flags we will
go uh and and get you for academic
dishonesty don't do
it make your own solutions
all right once the class ends
so at 7 15 when i end the zoom there is
no um
further sanctioned collaboration that's
it
um
yeah that and that's all there is to it
so if you run into issues you can still
email us
post on canvas you know you make a post
we can we can decide okay
this one this question is fine we'll
make it public and so forth um
email or post on the google group
there's a google group that's linked off
of the website so canvas is of course
only for asu students
google group's accessible to the world
please
you know don't spam the google group
with solutions if you have to
shut down the google group you will
it'll be a bummer
um and uh come to office hours
uh again we have two office hours
specifically created
to be the day before this time and do
and two days before the assignment do
because from experience
that's when everyone comes to office
hours i'm going to stress
very heavily if you wait until
sunday night to start you will fail this
class i mean there's just uh
you know that's just the reality um
please start the homeworks immediately
please
um and and as soon as you have questions
post them
all right i mentioned
this is going to be a class about
learning all right um
that's what cyber security is all about
cyber security
is an interesting subfield of computer
science because it
in a way depends on every other subfield
there are security problems everywhere
there's emerging security problems in
machine learning so i have to understand
machine learning more than i ever
thought i would as a
someone that doesn't do machine learning
there are security problems and
algorithms
algorithmic attacks and so forth so i
have to understand
algorithms and runtime complexity and so
on there are
security problems in
[Music]
human computer interaction right
there's a recent paper that came out
that showed
that because of assumptions made during
the bluetooth pairing process where you
have to put in a pin and so forth
you can uh have a device that interjects
itself between the device you're pairing
the device you're pairing with
because someone didn't think through the
human computer interaction and the
security researchers did
so you have to know everything in
security
and this course encompasses an
absurd amount of uh
content so please
keep in mind that the course is about
learning on the fly
by the way um one thing i forgot to
mention
and and i it just totally slipped my
mind when writing this slide
uh there is a makeup opportunity
so you can uh at four p.m on wednesday
uh all the challenges are do homeworks
are due done
any time after that to the last day of
classes
you can submit uh solutions for unsolved
challenges for half credit
right so you can still get half credit
on challenges you don't finish i would
recommend you not to uh put that in
all the way until the end use these uh
built-in
um times uh especially that final
week of guest lecture when you have
really um
uh gotten um you know very good at
security
to go back and and earn the the points
at least make up some of the points you
missed um
[Music]
if that is not on the syllabus i don't
remember i wrote it there either i will
push it there
um shortly um
oh but don't let it get in the way of
voting make sure to vote if you can
alright this class is going to be hard
it is going to be crazy crazy crazy
crazy crazy crazy crazy hard
uh please
make sure that you are equipped to
approach this course
um if you are not please consider
dropping the course
i don't want anyone to feel
extraordinarily stressed for an entire
semester i want people to enjoy this
course
right but please make sure you're ready
a good way is look through all of those
fundamentals if there's anything that is
completely unapproachable to you
it's going to be very very very tough um
connor there's another harder than 471
question
um all right uh
one caveat here the complication i say
you know
consider whether you should be in this
course or not the drop deadline is
tonight at midnight
um that is an unfortunate thing if this
causes
major issues for you and you're really
um you know trying to figure out
what to do send me an email we'll try to
to work something
out like figure something out i just
don't know um
what can be really done in the asu
you know bureaucracy it's uh just the
way it was scheduled and
i will try to get it scheduled in a way
where the first class is earlier
all right um let's
uh oh yeah one more thing you know if
you survive
then on certain small scales you will be
somewhat proficient as a hacker
it's a good launching off point um when
i talk about the framework you build pwn
college
um to other people
i frame it as as this that phone college
is
a um
a framework that takes white belts in
security
so computer scientists that know
computer science but don't know security
and it propels them to their yellow belt
so then they can start
approaching um
those concepts someone raise their hand
go ahead
yeah so so there's this uh the question
i'll repeat it is
um what way is this course hard is it
tedious
is that are the concepts tricky um and
the answer is it's both um
there's a wide range of knowledge that
um we will be attempting to cover
a wide range their
knowledge is also very tricky right in
order to
exploit a buffer overflow which is one
of the simplest things we'll do in this
course
you need to understand how enormous
amount of things works in
computer science you need to have a
knowledge of assembly you need to have a
knowledge of
memory layout and knowledge of the
um interaction with the kernel in
regards to system calls etc etc
right um this is
uh definitely not easy um but
on top of that to make sure that you
understand and learn this
there's a lot of practice problems and
they
can be tricky in their own way and they
can take time
to get through so this will be a very
very hard class
um
then uh okay someone on zoom asked
if they don't know assembly at all uh
should they drop
i would say yes um i'm sorry but it's
it's
uh uh
you need to know assembly um the
fundamentals videos someone asked on
zoom
um where can they find them you can find
them at tone.college
in the first module link all right um
and then to answer other questions on
zoom assembly was
in 360. it should also have been a 2 2
30. it should also have been in 365. um
all right let's uh
i have not read a computer
science book in probably 24. so the
question is
um how different is this course and the
difficulty of it to uh
like a computer networking course based
on a specific book
i haven't
uh okay this class will be very
different from a computer network in
class
um we won't really talk about networking
actually
i mean unless it shows up in one of the
wild card slots
um we'll have very little
discussion of networking except for you
know the mechanics of connecting into
pawn college and so forth
it's going to be really the internals
of um of
computing the you know assembly language
what happens on that very low
level that could cause a system to go
haywire
yeah um cool
okay so that's all for this uh
uh slide deck let's um go back all right
so
connor we have um how are we on the
assignment
okay it's ready to for use because we
could also use the archived old versions
okay awesome
so um
oh also to echo something that connor
said in chat
on the zoom chat for the purpose of this
class um you should be able to learn
x86 given your mips experience i'm just
i'm not saying it's going to be
impossible if you're missing any
of the fundamental knowledge it's just
going to uh
increase the difficulty of the class for
every bit of fundamental knowledge
that you use someone else said x86 is
almost identical to mips
um that's a terrifying statement to me
but all right
anyways um let's
uh move on
um yeah
i am not syncing up the concept between
with the 365. all right the question was
right right so
the question was if someone's taken
taking 365 are they going to be okay
uh i've seen people develop enough
computer
cyber security knowledge in three weeks
to be top competitors
on you know in the competitive circuit
so you could be okay
it depends on you it's gonna be harder
and harder and harder the the more
you're missing um uh someone's saying
on zoom it sounds like no i
i mean look i don't know it depends on
your background do you
if you know uh linux at a fairly good
level if you know
some assembly if you um
if you're proficient in c maybe
if you're depending on 365 to teach you
these things
this is going to be a very uh
big shock here um
i am i know i'm it might come across
that i'm trying to scare people
uh i just don't want to see people
stressed and failing at the end right
please make sure you can
you know approach this with uh um
enough of a uh background to
you know make it um viable um
there was another yep
i think there will be more concepts um
yeah and and and some um
tweaks to a lot of a lot of them but uh
it's not
significantly different the main
difference is you know you're virtual
and um it's also open to the world so
with the other thing i want to say if
you're interested in this material
and you're not sure and you you just you
want to keep going you can always
just crash the course right
and then um be in a very good position
to
hit it hard uh when you're when you're
ready
um someone is saying on zoom
uh that i'm trolling and the course is
easy uh the course
uh might be easy for
like connor connor do you think you
could take this course right now
all right you can probably handle it
yes it's very easy if you have access to
the
back end of uh phone college all right
so we have um
18 minutes until collaborative time
starts conor do you want to demo um
phone college although how how how will
we do that that's impossible right
all right so connor's going to tell me
how to hack it's going to be good
all right so let's um
[Music]
what is this for uh what should what's
the most useful topic here this guy
all right okay
cool um
no this thing this thing went crazy
that's not even on anymore oh my god
sorry i have to
fight with
okay and then the browser
all right obs has some quirks all right
so i'm going to show off the platform if
you go to copon.college
welcome to pond college you can again
get lectures off of youtube boom these
are the fundamental series there's a
playlist of them all
including the the intro so you can just
skip the intro
um please make sure that that is mostly
uh
review um
twitch is where we're streaming uh
practice problems
boom we load up practice problems this
is the pwn.college
practice problems you can register and
we're going to have a leaderboard of asu
versus the world
i don't think conor's been made aware of
that yet but it'll be developed shortly
and this is where everyone's gonna go to
do
their homeworks and we'll launch more
and more homeworks here if you want to
by the way i don't
necessarily recommend this but if you're
bored want to take a quick look at
um past uh what we did in the past
here are all of the um all the modules
from last spring and you can also click
through
and and go to our um beta
um
site uh from from last spring so anyways
you uh have to make an account here
username
uh zardis email uh
phone all right let's answer
asu.edu password
let's do that okay submit boom
all right so right now there's just one
uh
instance of uh baby sued conor will push
more baby suit is gonna be the first
assignment and i will tell you
what it is um question here does our
username have to be rsu id
no but your email has to be your asu
email if you're taking the scores for
credit
um or also i misspoke someone said that
i said last spring i met last fall there
was some confusion on zoom
um all right
so uh baby sewed
a conor is it hard to push extra because
for the collaboration it might be nice
for them to to have a good
head start
okay maybe maybe push a couple more all
right so anyways
baby sued is um named after
the set uid bit in linux um
i'm going to send out information about
that
and and a lecture about linux file
systems and so forth after
the drop deadline i want to stress this
is knowledge you should already have on
how to use linux
um tomorrow i'll post the uh the
lecture about uh this all right so
click through um here is someone already
solved it oh look connor
solved it two hours ago um there are
gonna be a hundred of these
okay each one will be worth one point we
click through and we say
we enter a path to a binary that we're
going to attack
this is unique for this challenge um i'm
going to attack
bin cat and you'll see what this means
there is
a run button a practice button a
download button will this download been
cat connor
okay these two are broken for baby sued
we're uh trying
you know it's it's it's in progress
it'll be
these will go away um so i can i
click run challenge it tells me okay you
can connect up
using ssh with a private key and i can i
can go to settings
ssh key and set my ssh key here and
connect
to this um uh to
cse466.college with that ssh key
and it'll drop me into a terminal with
my uh
challenge running if that doesn't make
sense to you
please go and and check up on how ssh
works
all right so um
go to challenges click here i already
hit run it's ready
uh if i don't want to connect over ssh
and
more specifically here i don't want to
deal with you know
getting obs and my terminal oh i have it
anyways the other thing you can do
is click terminal and it just drops you
into the terminal right away this is
nice and easy no messing with everything
you are actually
behind the scenes connected in to our
uh infrastructure running this challenge
all right
so here is um uh
this challenge i am user ctf and
i need to leak the flag
uh conner flag is uh world readable
oh really
okay um yeah so that should be uh fixed
ideally
so anyways normally this flag
won't be uh readable uh world readable
um it's going to be uh
uh it won't have
these permissions it'll just have these
permissions so if i do cat flag
it'll something very ha similar will
happen as if i cat etsy shop
connor etsy shadow is also world
readable
oh lol you're right you're right okay
the flag is already
all right um we are having
trouble zooming in this jungle okay all
right
goddammit did my browser go nuts again
hold on
i'm going to real quick um
what's going on here okay here we go
again
um i'm gonna actually connect over ssh
because then i can zoom in easier so ssh
requires an ssh key
let's switch to my terminal to ssh
keygen
and give an output of uh phone college
that chef okay so
i have a ssh key phonecollege.pub
this is my public key for ssh i
take this and i put it here
i hit update public key has been updated
i go back to my terminal
and now i can do ssh dash i pawned
college that's the private key
um csc466.phone.college
if you're you know you want to make sure
everything works you hit dash v
and hold on uh what is a ctf at right
oh csc 466 at
okay cool i connect
it works and i am in this baby sued
but you can now read my terminal unlike
in the tunnel so
two ways to connect one is the the
terminal one is that all right
i want to show you what happens when you
specify
bin cat as um two people have raised
their hands
so one person go
yeah so you type in bin cat
then get in there and look around at
other programs that are valid conor you
filtered by elves and everything
oh okay we should we should send out a
list of valid targets
um yeah
cool okay um
someone is saying the terminal is
showing up as a plain gray screen that
likely means there's a connection error
um
oh you haven't started the challenge
okay anyways
um so
if you want to get an idea of um
the uh kind of we pushed uh the
docker image right
no yeah
okay we're going to push a docker image
so you can pull
the container it's
30 gigs if you want to pull it all right
let's go and restart this challenge
connor said he updated so the flag is no
longer readable
okay i've restarted the challenge i'm
gonna ssh back in
no what happened
connection nor search container user 43
i hit oh oh i had had the same problem
can you um pre-fill bin cat here just by
default
okay awesome
okay i'm in um
now you can see it flag is only readable
by root so say if i use the more utility
to read out the flag i get permission
denied
however i can see that cat because i
entered it
when i was launching the challenge is
set uid has to have uid permissions
this means that when it executes
regardless of the
user that's executing it'll run as root
this should be
reviewed to you that means that if i
use cat bin cat
to cat out the flag it'll work
so this is my flag do not submit this
flag get your own cat flag
um super easy you use bin cat and you
put in
the flag okay or you put in the slash
flag and you
will get the flag um
cool uh
now we can uh unless are there any
questions there is a second person
raising hands
uh there's a question on zoom how do we
know what challenges need to be done
um we'll uh post a list of
valid targets um
it's it's a
[Music]
a quick list you can use
[Music]
any binary that is an l file
boom all of these that are scrolling by
are valid targets and of course this
will all be archived on on
youtube there's a lot of targets here
you should not have any trouble
finding valid targets so as you can see
it's still scrolling
let's see how many of these were there
quite a lot
9415 at least and there might be more in
other paths and you need to find
a hundred cool okay
so um
what is uh left to talk about
cat flag um oh yeah here's the command
to find valid targets
what happens when you launch the service
it'll make
the the path that you specified set uid
so that you can
use it to read the flag and you have to
use figure out how to read the flag
it's very easy with cat cat is a linux
program this should all be review again
cat is a linux program that reads out uh
a file uh more is another one like that
so you can also
that's another free point for you but
can you get the flag
with the message a linux program that
is prints out your kernel log
if it's permitted i can
so you should be able to as well
[Music]
cool so yeah this is uh uh
the first homework please make sure i
see already some confusion on zoom
please make sure you're on csc
466.college
not over here in the old uh baby sued
archived
module i'll put a bunch more warnings
here if you go to gtf.college this is
the old
beta version these will not be scored
okay um but you can you know also
just don't don't don't get confused
csc466 that pawn
that college um all right
um we'll someone is asking how do we
solve instance one
a hundred times uh we're going to upload
instance 2 through 100
uh very shortly um instance 1 is just
your
the thing you can do for now all right
awesome um
[Music]
every instance will require you of
course to put in a
different path over here cool um
is the score auto record if you get the
flag so what happens if you get the flag
you go here
you paste it in here you hit submit
actually let me show you
so we launched it within cat oops i was
already running it kicked me out
success we cat the flag we get the flag
i um
uh i get the flag
and um i submit it
and i have the flag and it's autosport
and it turns green
boom it also tracks what you've already
solved
nice and simple i go to chal uh
scoreboard
and i see that i'm tied with a bunch of
people for one solve
and that one solve is
oh it no longer shows that's cool connor
no longer shows that that
that's great um cool
all right uh i think this is
um by the way you don't have to have
your su uh
right on your profile just your su email
address the email address is
private your profile make a cool hacker
handle try to get as cool as as
as canac or zardis right
um there's a guy how can handle fish and
what the hell that's amazing
right hello underscore world is not bad
okay
cool so um
that is it we are now going to start
actually right on time shockingly i'm
going to split everyone
into um yeah you can change your handle
in settings someone asked on zoom
go to settings change your username
super simple
coolio okay um
any final questions before i start the
group
uh the collaboration assignment
also by the way you can um register as
many accounts as you want
if you want to try out several different
um
uh instances or try out instance one
several different times
uh oh oh great you can you can even you
can try other ones so uh
just keep those flags for later when you
push instance two and so forth you can
submit it
oh those flags don't work you can redo
the solution keep track of the solution
okay um yes uh whoever just said
they entered their generated ssh key
almost certainly you entered a pri
up uh your private key upload your
public
key um will this lecture be recorded yes
um provided the twitch and youtube
integration works
properly is there a submission api for
flag submission that's a conor question
um or post it on on on canvas or send it
to the google group
we'll take a look
probably yes i mean it's it's a
customized ctfd yeah connor says yes
okay very cool um i think this
is uh now the beginning of the
collaborative um
portion i'm going to assign everyone
into
breakout groups oh wow during the course
of this lecture conor we lost
uh almost a quarter of the class
that is usually this class is about a 60
to 70 percent
um drop rate so that is normal but
please
a lot of people end up staying in and
needing to withdraw afterwards so please
make sure that you're ready okay um
breakout rooms
automatically assign um
i'm gonna assign breakout rooms so that
there are
[Music]
kind of what do you think four people
per breakout room or should we
do eight ctf team
okay seven to eight per team i'm going
to click this
some team is gonna get screwed because
uh i will jump in and then i will jump
out right away
some team will get screwed because conor
will do the same but um that's uh just
how did i'll up it so that it's
eight to nine so that you know hopefully
it's still good okay
everyone get ready warm up on college
remember you don't need to do ssh but
it'll be easier and so forth
um otherwise uh once i click this i will
stop the stream start the process of
uploading this to youtube and everything
thank you for tuning in i'm going to um
uh up um post more
kind of in the fundamentals series uh
tonight or tomorrow
um talking about linux file system
permissions and so forth which is this
first uh module um all about um
and uh then
we'll see you next week when we'll go
into shell coding
awesome stuff all right i'm about to
click create room everyone will go away
um those on twitch goodbye
um twitchers um
and see you next week