CS338 Computer Security
Wednesday, 20 November 2024

+ Office Hours
- Thu 11/21, 10:00-11:30
- Fri 11/22,  9:30-11:00

+ Questions?
- kermit question
    - in real life, it would go like this
        1. somehow you get a shell as kermit
        2. kermit$ ls -l /etc/passwd
             -rw-rw-rw- root root ...
           somebody screwed up by making this writeable
        3. attacker-as-kermit does some magic with /etc/passwd,
            can thus login as root

    - to simulate this in a hostOS + Kali VM situation
        1. the kali user screws up (uses its sudo privileges
            to mis-permission /etc/passwd)
        2. (while you're kali, you might want to look
            at what's in /etc/shadow)
        3. login as kermit
        4. do the magic cited above
        5. try logging in as root

    - you can use the kali user to explore possibilities, but to really
        complete this problem, you need to be able to launch your
        attack while logged in as kermit

+ How to continue?

+ Security jobs, internships, etc.
- alumni directory
    ask me for some names
    some places our grads do security jobs
        CrowdStrike
        Sandia National Lab
        SpecterOps
        SendSafely
        Jamf
        Target
        ...
- generally
    - markets go up and down
    - randomness is part of the process
    - you're gonna get rejected and ignored a lot, and that sucks
    - those lists of requirements for a given job?
        they're a lie (or, they're "aspirational" for the company)
        in the US, women let that drive them away [don't do this]
    - persistence! thick skin!
    - work on a side project and write it up in GitHub

+ Programming
- Every time data comes from anywhere (especially
    but not only a user), sanitize it
- Don't build SQL queries with string concatenation
- Do I need this data? Does my user need me to have
    this data? Why? How long? Could I just never
    collect it? How long do I need these logs?...
- How am I going to test my code generally?
    How am I going to test its security?
- In my PL, use standard library utilities
    - to access a database
    - to sanitize data
    - to do cryptography
    - ...
- If I want to use a third-party library, why?
    Could I do the same thing with the standard library?
    What dependencies does the library have? How
    active is the library's developer community, and how
    many people are in it? Even if that all looks good,
    could I do without it?

+ Trust
- Leo's story on #mindset (plus *many* others earlier
    in the term); what if you try to fix this?

- https://www.schneier.com/books/liars-and-outliers/

- Who are we trusting, when, and for what?
  Can we eliminate the need to trust people?
  Can we shift some of our trust to software?
    and what are the associated tradeoffs?

- ...


+ Thanks for a great term!