Upgrade to Pro — share decks privately, control downloads, hide ads and more …

A history on security and how to win the battle

A history on security and how to win the battle

1761ecd7fe763583553dde43e62c47bd?s=128

Joshua Thijssen

August 19, 2012
Tweet

More Decks by Joshua Thijssen

Other Decks in Technology

Transcript

  1. A history on security and how to win the battle...

    Joshua Thijssen
  2. Channeling and restricting flow

  3. Sometimes channels don’t listen

  4. Failure is always an option

  5. Security is a business value

  6. Security is a business value

  7. Security is a business value

  8. Let others take care of security

  9. Let others take care of security

  10. History of (computer) security

  11. Security in the “old days”

  12. I wasn’t kidding when I said: “old days”

  13. 5.25” high density disks

  14. 5.25” high density disks

  15. Copying was a breeze

  16. Copy protection

  17. Copy protection

  18. Let’s try dongles

  19. NOPE!

  20. 8086 segmented memory layout

  21. 8086 segmented memory layout segment reg. 16-bit

  22. 8086 segmented memory layout segment reg. offset reg. 16-bit 16-bit

  23. 8086 segmented memory layout segment reg. offset reg. physical address

    16-bit 16-bit 20-bit
  24. 8086 segmented memory layout segment reg. offset reg. << 4

    physical address 16-bit 16-bit 20-bit
  25. 8086 segmented memory layout segment reg. offset reg. << 4

    + physical address 16-bit 16-bit 20-bit
  26. 07C0:0050 07C00 0050+ 07C50 8086 segmented memory layout segment reg.

    offset reg. << 4 + physical address 16-bit 16-bit 20-bit
  27. 07C0:0050 07C00 0050+ 07C50 0000:7C50 00000 07C50+ 07C50 8086 segmented

    memory layout segment reg. offset reg. << 4 + physical address 16-bit 16-bit 20-bit
  28. 07C0:0050 07C00 0050+ 07C50 0000:7C50 00000 07C50+ 07C50 007C:7490 007C0

    07490+ 07C50 8086 segmented memory layout segment reg. offset reg. << 4 + physical address 16-bit 16-bit 20-bit
  29. 8086 segmented memory layout segment reg. offset reg. << 4

    + physical address 16-bit 16-bit 20-bit
  30. 386 protected memory layout + descriptor directory entry page table

    entry physical address directory page offset cr3 gdt / ldt page directory page table page frame linear address descriptor table selector offset 32-bit 16-bit
  31. None
  32. None
  33. Ring 0 Kernel

  34. Ring 0 Kernel Ring 1 Device drivers

  35. Ring 0 Kernel Ring 1 Device drivers Ring 2 Device

    Drivers
  36. Ring 0 Kernel Ring 1 Device drivers Ring 2 Device

    Drivers Ring 3 Applications
  37. Security today

  38. The weakest link

  39. Humans

  40. it is much easier to trick someone into giving a

    password for a system than to spend the effort to crack into the system -- K. Mitnick
  41. Raising awareness on browsers

  42. It’s a trap!

  43. We’re curious

  44. People are resourceful

  45. Weird hobby’s

  46. Weird hobby’s

  47. 00710022211101015511130102359000000000

  48. 00710033308171115011231111700000000000

  49. 00710033308171115011231111700000000000 00710022211101015511130102359000000000

  50. 00710033308171115011231111700000000000 00710022211101015511130102359000000000

  51. 00710022211101015511130102359000000000 00710033308171115011231111700000000000

  52. 00710044401011200001231122359000000000

  53. None
  54. Magnetic card reader/writer: $ 250

  55. Magnetic card reader/writer: $ 250 Parking costs per night: $40

  56. Magnetic card reader/writer: $ 250 Parking costs per night: $40

    Free parking: priceless
  57. How can we cure this problem?

  58. We need to implement REAL security, not fake.

  59. How do we win the war? How do we win

    the war?
  60. If we as developers have to keep thinking about security,

    we will lose...
  61. We need to deflect *EVERY* attack, They only need *ONE*

    to win...
  62. 99.999% of all programmers are NOT trained or have the

    capability to identify security threats. The other 0.001% will not be able to identify them ALL OF THEM ALL THE TIME.
  63. A day in the life of a PHP programmer...

  64. $result = mysql_query('SELECT * FROM users WHERE username="'.$_GET['username'].'"');

  65. You should use mysql_real_escape_string!

  66. No, you shouldn’t!

  67. You just put a developer who wasn’t aware of security

    issues, in charge of security...
  68. Let others handle security (PDO)

  69. There is no (quick) solution.

  70. There is no (quick) solution. but we have to change

    the way we deal with security radically,
  71. There is no (quick) solution. but we have to change

    the way we deal with security radically, by not dealing with security...
  72. Let others take care of security

  73. Any questions (maximum 5)?

  74. Find me on twitter: @jaytaph Find me for development and

    training: www.noxlogic.nl Find me on email: jthijssen@noxlogic.nl Find me for blogs: www.adayinthelifeof.nl Thank you! http://joind.in/6853