3/10/07acm sigcse'071 seed: a suite of instructional laboratories for computer security...
TRANSCRIPT
3/10/07 ACM SIGCSE'07 1
SEED: A Suite of Instructional Laboratories for Computer SEcurity EDucation
Wenliang (Kevin) DuZhouxuan Teng & Ronghua Wang
Department of Electrical Engineering & Computer Science
Syracuse University
3/10/07 ACM SIGCSE'07 2
Objectives
• Improve experiential learning in computer security education • Undergraduate & Graduate
• Develop effective labs (or course projects) for security courses
• Evaluate the effectiveness of these labs
3/10/07 ACM SIGCSE'07 3
About SEED Project
• Funded by the NSF CCLI Program • Phase I ($75K) was funded in 2002
• Phase II ($450K) was funded in 2007
• Four years of experience and development• Four universities involved• Web page for all the developed labs
• http://www.cis.syr.edu/~wedu/seed/
3/10/07 ACM SIGCSE'07 4
Teaching Philosophy
• Computer security education should focus on: • fundamental security principles
• Students should be given opportunities to experience, apply, to integrate, and to experiment with these principles.
3/10/07 ACM SIGCSE'07 5
Labs Environment
• One environment that supports all labs• Desired properties
• Low cost• No physical lab space is needed: we focus on
software security• Repeatable
3/10/07 ACM SIGCSE'07 6
Lab Environment
Labs
Minix Linux
Virtual Machine(e.g. vmware)
Host OS (Windows, Linux, etc.)
3/10/07 ACM SIGCSE'07 7
Instructional OS (Minix)
• Widely used by many courses, e.g., Operating Systems, Networking, etc.
• Advantage:• Real OS, not a toy program• Much smaller than production OS• Less secure than production OS• Easy to understand and modify
• Disadvantage:• Lack of tools• Lack of advanced security features
3/10/07 ACM SIGCSE'07 8
Labs
• Three types of Labs• Design/Implementation Labs
• Exploration Labs
• Vulnerability Labs
3/10/07 ACM SIGCSE'07 9
Design/Implementation Labs
Design/ImplementationLabs
Minix
Virtual Machine(e.g. vmware)
3/10/07 ACM SIGCSE'07 10
Design Labs
Students’ Tasks
Existing Components
Capability
Access Control List
SandboxEncrypted
File System
Properties of this design:• Focused on targeted principles • Each lab takes 2-6 weeks• Difficulties can be adjusted
RBAC
MAC
IPSec Firewall IDS
Minix OS
SystemRandomization
3/10/07 ACM SIGCSE'07 11
Exploration Labs
ExplorationLabs
Minix Linux
Virtual Machine(e.g. vmware)
3/10/07 ACM SIGCSE'07 12
Exploration LabsMinix/Linux OS
Security Component
Other Components
Guided Tour:• Small experiments• Guided activities• Interact with security components• Observe• Explain the observations
“tour”
Set-UIDPAM: Pluggable
Authentication ModuleReference
Monitor
All the design labs can be transformed to exploration labs
Intel 80x86 ProtectionMode
SYNCookie
3/10/07 ACM SIGCSE'07 13
Vulnerability/Attack Labs
Vulnerability/AttackLabs
Minix Linux
Virtual Machine(e.g. vmware)
3/10/07 ACM SIGCSE'07 14
Vulnerability/Attack Labs
Linux/Minix OS
User Space
Kernel Space
Real-World Vulnerabilities
Fault Injection
Students’ Tasks:1. Find out those vulnerabilities2. Exploit the vulnerabilities3. Fix the vulnerabilities4. Design countermeasures
3/10/07 ACM SIGCSE'07 15
Vulnerability Laboratories
• Buffer-overflow Lab• Race-condition Lab• Format-string Lab• Sandbox(chroot)Lab• Attack Lab on TCP• Attack Lab on ARP, IP,
ICMP• Attack Lab on DNS
• Integer overflow• SQL injection attack Lab• Set-UID vulnerability Lab• Lab on various OS kernel
vulnerabilities
3/10/07 ACM SIGCSE'07 16
Example: Capability Lab (1)• Learning objectives:
• Capability-based access control
• Principle of least privilege
• Reference monitor
• Lab Tasks• 5 capabilities
• Capability management functionalities (enabling, disabling, deleting, delegating, revoking capabilities)
• Time: 4-6 weeks
3/10/07 ACM SIGCSE'07 17
Capability Lab (2)
• An actual capability system is very complicated• Simplification: 5 capabilities (Solaris has 80)
• CAP_READ, CAP_KILL, etc.
• Supporting materials: • Identify time-consuming places
• Analyze whether they are security relevant or not
• If not, tell students how to do those
3/10/07 ACM SIGCSE'07 18
(Crypto + System) Labs
• Encrypted File System Lab• Integrate crypto technologies with file systems• 4-5 weeks• Can also be used for Operating System course
• IPSec Lab• Integrate crypto technologies with TCP/IP• 4-6 weeks• Can also be used for Networking course
• Key management issues: key agreement, key storage, key update, etc.
3/10/07 ACM SIGCSE'07 19
Set-UID Exploration Lab
• “Play” with the Set-UID mechanism in both Minix and Linux, and answer:• How is it implemented?
• Why is it necessary?
• Why is it dangerous?
• How to make Set-UID programs more secure?
• Why does Linux appear more secure than Minix against vulnerable Set-UID programs.
3/10/07 ACM SIGCSE'07 20
Buffer-Overflow Lab• Students are given:
• A vulnerability program: stack.c• Shell code (binary code)• Partially implemented exploit program: exploit.c
(shell code is also given)• Students need to:
• Finish exploit.c• Construct a string that can be used to overflow the buffer
in the vulnerable program• Invoke root shell.
• Time: 1 week
3/10/07 ACM SIGCSE'07 21
Evaluation
• Survey Questionnaires• The quality of lab design and supporting
materials• Students’ perspective in the labs:
• How interested they are• Whether the labs are worthwhile• Whether the labs spark their interests in security
• Participants: 30 students on average
3/10/07 ACM SIGCSE'07 22
Evaluation Results (1)
A: Strongly disagree B: Disagree C: Neutral D: Agree E: Strongly agree
Survey: Your level of interest in this lab is high.
Set-UID Lab Capability Lab IPSec Lab
3/10/07 ACM SIGCSE'07 23
Evaluation Results (2)
A: Strongly disagree B: Disagree C: Neutral D: Agree E: Strongly agree
Set-UID Lab Capability Lab IPSec Lab
Survey: The lab is a valuable part of this course.
3/10/07 ACM SIGCSE'07 24
Evaluation Results (3)
A: Strongly disagree B: Disagree C: Neutral D: Agree E: Strongly agree
Set-UID Lab Capability Lab IPSec Lab
Survey: The lab sparks your interest in computer security.
3/10/07 ACM SIGCSE'07 25
Summaries
• SEED lab environment is low-cost, portable, easy to use
• We have developed 15 labs• We have used them during the last 4 years
• Some other universities are also using them
• Anyone interested are free to use them
• Evaluation results are encouraging
3/10/07 ACM SIGCSE'07 26
NSF CCLI Showcase
• Time: 10:30 - 12:00• Place: Exhibit Hall• I will handout hardcopies of all our labs• Project web site:
• http://www.cis.syr.edu/~wedu/seed
• or google: wedu seed