Exploit in Classic

In Japanese tradtional comedy, Rakugo, has some interesting story about vulnerability and exploit.
And I do not intend to insult a specific OS, but we sometimes see such a situation.

Transcript

1. 久保 俊平 @MC_SEC_KB / @bou_san3 @MC_SEC_KB
2. ・MENU ▪ Glossary ：Vulnerability ▪ Glossary ：Exploit ▪ Glossary ：Money/Noodle ▪ Case in Classic ：Time Noodle ▪ Illustrative example ：Time Noodle ▪ Reconsideration ：Time Noodle ▪ Vulnerability 1, 2 ：Time Noodle ▪ Countermeasures 1,2,3：Time Noodle ▪ Conclusion ：Time Noodle
3. ▪ Vulnerability is : ▪ 「Vulnerability refers to the inability (of a system or a unit) to withstand the effects of a hostile environment. A window of vulnerability (WOV) is a time frame within which defensive measures are diminished, compromised or lacking」 ▪ （From Wikipedia「Vulnerability」）
4. ▪ Exploit is : ▪ 「An exploit (from the English verb to exploit, meaning "to use something to one’s own advantage") is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized). Such behavior frequently includes things like gaining control of a computer system, allowing privilege escalation, or a denial-of-service (DoS or related DDoS) attack.」 ▪ （From Wikipedia「Exploit」）
5. ▪ In this short story, there is a name of unit of money “Mon” ▪ 1 Mon ≒ 10cent. ▪ And the name of noodle in this story is 2x8 noodle. ▪ because the price of noodle is 16 Mon.
6. ▪ Guest：Entered in noodle shop and ordered 2x8 noodle(priced 16 mon), but having only 15 Mon. So, 1 mon is short for 2x8 noodle . ▪ Guest : ( After completed meal ) How much ? ▪ Master：Fee is 16 Mon. ▪ Guest：OK. But I have only change, please count one by one. ▪ Master：OK. 1,2,3,4,5,6,7,8,,, ▪ Guest：Hey, by the way, what time is it now ? ▪ Master：Yeah, it is 9 . ▪ Guest：Oh, it’s 9. Thanks, and go ahead. ▪ Master：10,11,12,13,14,15,16… ▪ Master：Just 16 mon. Thanks you very much. ▪ Guest：Bye. ▪ Master：（Counting money again）Oh ! 1 mon is short ! Master Guest
7. Master Guest Fee is 16 Mon. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
8. Fee is 16 Mon. 9 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Master Guest
9. Fee is 16 Mon. 9 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 What time is it now ? Master Guest
10. Fee is 16 Mon. 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 What time is it now ? It is 9 . Master Guest
11. Fee is 16 Mon. 1 2 3 4 5 6 7 8 9 It is 9. Thanks, and go ahead. 9 10 11 12 13 14 15 10 11 12 13 14 15 16 Master Guest
12. Fee is 16 Mon. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 9 10 11 12 13 14 15 16 It is 9. Thanks, and go ahead. Master Guest
13. Fee is 16 Mon. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Verify the price… Master Guest
14. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Completely match ! Master Guest Fee is 16 Mon. Verify the price…
15. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Completely match ! Master Guest Just the amount . Fee is 16 Mon. Verify the price…
16. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Completely match ! Master Guest Just the amount . Bye! Verify the price… Fee is 16 Mon.
17. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Oh! 1 Mon is short !! （Counting money again…） Master Guest is gone .
18. W H Y ? Master
19. ① Fee is 16 Mon. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 9 10 11 12 13 14 15 16 Master Guest
20. ① Gue st Fee is 16 Mon. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 9 10 11 12 13 14 15 16 Inadequate variables for storing values. （Only one variables count money and time.） Master
21. ② Master Guest Fee is 16 Mon. 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 What time is it now ? It is 9 .
22. ② Master Guest Fee is16 Mon. 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 What time is it now ? It is 9 . Interruption enabled (While counting, another process can forcefully run.)
23. Master What should I do ?
24. ① Master Guest Fee is 16 Mon. 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 What time is it now ? 9 Currency Time
25. ① 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 What time is it now ? It is 9 . 9 Master Guest Fee is 16 Mon. Currency Time
26. ① 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 It is 9 . It is 9. Thanks, and go ahead. 9 Master Guest Fee is 16 Mon. Currency Time
27. ① 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 It is 9 . It is 9. Thanks, and go ahead. 9 Master Guest Fee is 16 Mon. Currency Time
28. ① 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 9 1 Mon is short ! Master Guest Fee is 16 Mon. Currency Time
29. ① Gue st 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 9 1 Mon is short ! Inadequate variables for storing values. ↓ Distinguishing between Currency and Time variables Master Fee is 16 Mon. Currency Time
30. ② Fee is 16 Mon. 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 What time is it now ? Master Guest
31. ② Fee is 16 Mon. 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 What time is it now ? Now I am counting ! Please be quiet ! Master Guest
32. ② Gue st Fee is 16 Mon. 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 What time is it now ? Interruption disabled. Now I am counting ! Please be quiet ! Master
33. ③ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Fee is 16 Mon. Master Guest
34. ③ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Fee is 16 Mon. Master Guest
35. ③ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Fee is 16 Mon. What time is it now ? Master Guest
36. ③ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 What time is it now ? Please put money ! Master Guest
37. ③ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Not enough money! Master Guest
38. ③ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 CAUTION ! Master Guest
39. ③ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 CAUTION ! Master Arrest
40. ③ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 CAUTION ! Automation Master Arrest
41. We call it Exploit to misuse the vulnerability in the system.
42. We call it Exploit to misuse the vulnerability in the system. We shouldn’t to show or overcome the weaknesses. And don't forget the other change.
43. We call it Exploit to misuse the vulnerability in the system. We shouldn’t to show or overcome the weaknesses. And don't forget the other change. You need to patch the system's vulnerability as if you patch the torn clothes.
44. We call it Exploit to misuse the vulnerability in the system. We shouldn’t to show or overcome the weaknesses. And don't forget the other change. Getting the OS ready. Don’t turn off your computer. You need to patch the system's vulnerability as if you patch the torn clothes.
45. We call it Exploit to misuse the vulnerability in the system. We shouldn’t to show or overcome the weaknesses. And don't forget the other change. We couldn’t complete the updates. Undoing changes. Don’t turn off your computer. You need to patch the system's vulnerability as if you patche the rotn clothes.