Skip to content

Commit 77d8ea4

Browse files
committed
70004 & 70024: Added final software reliability and Avanced security notes
1 parent 9a0e63f commit 77d8ea4

13 files changed

+166
-8
lines changed
+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
## Description
2+
A type of [[Voice Assistant Exploit]] that attempts to invoke an assistant audibly.
3+
4+
| Type | Downside |
5+
| ---------------- | ------------------------------------------- |
6+
| Incomprehensible | Can be easily noticed by a human |
7+
| Inaudible | Requires special hardware (i.e. ultrasound) |
8+
| Hidden in music | ? |
9+
## CommanderSong
10+
Automatically embeds a set of commands into a song.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
## Main Challenges
2+
3+
| Challenge | Description |
4+
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
5+
| LAN Mistrust | Where IoT devices that rely on local network based authentication |
6+
| Environment Mistrust | When the IoT device trusts the physical environment (e.g. trust a camera is not moved, or for voice assistants that the voice speaking physically nearby is allowed) |
7+
| App Over-Privilege | Where apps can perform unauthorized/unexpected actions on multi-app platforms (e.g. ) |
8+
| Weak Athentication | For example speakers that allow anyone with bluetooth in range to connected. |
9+
| Implementation Flaws | Hardcoded credentials, [[Cross Site Scripting\|XSS]], open ports and debugging functionality, unencrypted transmission |
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
Access control decisions cannot be changed by normal users.
2-
- System wide set of enforced rukes
2+
- System wide set of enforced rules
33
- Normal (i.e. non root) users cannot change permissions ([[Control Schema]])
44
Offers stronger guarantees than [[Discretionary Access Control]] (does not trust normal users).
55

Diff for: 70004 - Advanced Computer Security/Multi-Level Security.md

+1
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,4 @@ Encodes multiple users using category field:
2020
Used for managed profiles:
2121
- parental controls (restricted profile)
2222
- company managed profiles (work accounts, samsung KNOX)
23+
revmans
+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
## Description
2+
A type of [[Voice Assistant Exploit]]. Addon apps for voice assistants such as Alexa are *skills*, by making skills likely to be activated accidentally by Alexa misinterpreting speech they can be activated in place of the intended app.
3+
- Voice equivalent of typo squatting
4+
- Predictable errors caused by homophones, and phonetic confusion (e.g. wet/what, rip/rap, been/bean)
5+
- Longest string match resulting in commands being shadowed
6+
7+
It is also possible to squat on common exit commands:
8+
- For Alexa only *exit* is caught by the OS to exit the skill, *stop* and *cancel* are captured by the skill
9+
## Defences
10+
### Competitive Invocation Names
11+
Identify suspicious variations of invocation names to detect potential squatting.
12+
- Convert names to pronunciations (e.g. using the CMU Pronouncing Dictionary) and then get the edit-distance.
13+
### Runtime Analysis
14+
Detect the skill providing responses that are like the system's (e.g. pretending to have exited an application).
15+
- Can use fuzzy matching (e.g. through encoding sentence semantics using a neural network), to quickly detect similarity
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
[[TODO]]

Diff for: 70004 - Advanced Computer Security/iOS Security.md

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
## iOS Structure
2+
3+
| Component | Description |
4+
| ------------------ | ----------------------------------------------------------------------------------- |
5+
| kernel | Based on the Mach kernel from Mac OS X |
6+
| Core OS & Services | APIs for files, network, SQLite, POSIX threads, UNIX sockets, and security services |
7+
| Media Layer | Foundational framework, object oriented collections, file management, network. |
8+
Implemented in C, Objective-C and swift.
9+
10+
## System Security
11+
Hardware Root of Trust (immutable code in the boot rom) ensures
12+
13+
| Feature | Description |
14+
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
15+
| Secure Boot Chain | All startup processes are crypto-signed by Apple to ensure integrity. Only after **chain of trust** is verified does the iOS kernel start. |
16+
| Secure Enclave Coprocessor | A secure crypto-processor (secure boot with encrypted memory) provides cryptographic functions and key storage. Processes fingerprint/face data. |
17+
| Touch ID/Face ID sensors | Data for authentication kept in secure enclave on device. |
18+
## App Security
19+
20+
| Feature | Description |
21+
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
22+
| Mandatory Code Signing | All apps must be signed with an apple-issued ID certificate |
23+
| Sandboxing | Each app executes in its own sandbox to prevent access to other application's data. 3rd party apps and the majority of iOS run under a non-privileged *'mobile'* user. Inter-app communication on facilitated through iOS APIs. |
24+
| Entitlements | Access to user information (e.g. camera, bluetooth, internet) is declared by the app (fixed, and part of the app's signature), some must be dynamically requested (e.g. location). |
25+
| Encryption | Apps can use iOS APIs to use built-in hardware encryption. |
26+
| System Extension Points | Extensions (e.g. 3rd party filter for the camera app) run as their own processes (isolated from the extended application). |

Diff for: 70024 - Software Reliability/Black-Box Fuzzing.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
## Definition
1+
its ## Definition
22
The [[SUT]] is executed in an unmodified form (no sanitizers or coverage added).
33
### Advantages
44
- Can be applied to closed source [[SUT]]

Diff for: 70024 - Software Reliability/Coverage Criteria.md

+96
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
## Definition
2+
Criteria used to measure the progress of a testing/fuzzing campaign.
3+
## Black Box Coverage
4+
Based on a specification (e.g. behaviour of a public API) without knowledge of the programs internal structure.
5+
- Works when code is unavailable (black box)
6+
- Can uncover unimplemented parts of the specification (e.g. postconditions on public library function incorrect)
7+
## White Box Coverage
8+
Based on a the code / internal knowledge (control & data flow, logic).
9+
```C
10+
int foo(int x, int y) {
11+
if (x > 0)
12+
printf("A");
13+
else
14+
printf("B");
15+
if (y < 10 || y > 20)
16+
printf("C")
17+
else
18+
printf("D")
19+
}
20+
```
21+
22+
| Coverage Measure | Description | 100% Coverage | Tests for Example 100% Coverage |
23+
| ------------------------------ | ----------------------------------------------------------------------------------------- | ------------------------------- | ------------------------------------------------------------------ |
24+
| Function | How many/which functions are called | No unreachable functions | Any test (1) |
25+
| Instruction / Statement / Line | Instructions hit during execution | No unreachable code | `(10,0)` and `(-10, 15)` to get `A,C` and `B, D` |
26+
| Branch / Decision | How many branches covered (with each side of the conditional) | No dead branches | *Same as instruction coverage* |
27+
| Path Coverage | How many possible paths are covered (can be bounded on loops, e.g. 0, 1 or >1 iterations) | verification (full, or bounded) | `(10,0)`, `(-10, 15)`, `(10, 15)`, `(-10, 0)` (all possible paths) |
28+
*Note: Cost increasing in descending order*
29+
### Condition Coverage
30+
A condition is an atomic clause in a logical predicate. Condition coverage is the number of condition outcomes exercised.
31+
```C
32+
if ( (x > y) || ( (x < 0) && (y > 0) ) ) // x > y, x < 0, y > 0 are atoms
33+
34+
// Given the tests
35+
{.x=1, .y=0}
36+
{.x=0, .y=1}
37+
```
38+
39+
| Short Circuiting | Conditions | Coverage |
40+
| ---------------- | ----------------------------------------------------------- | ------------------------------------------------------------------------------------ |
41+
| On | $\top \lor (\bot \land \bot)$, $\bot \lor(\bot \land \top)$ | $\cfrac{5}{6}$ as $x>y$ and $y>0$ both get $\top/\bot$ and $x < 0$ gets $\bot$ only. |
42+
| Off | $\top \lor (\_ \land \_ )$, $\bot \lor (\bot \land \_)$ | $\cfrac{3}{6}$ as $x>y$ gets \bot/\top$ and $x < 0$ gets $\bot$ |
43+
### Multiple Condition Coverage
44+
Take all possible combinations (in general $\approx 2^N$ for $N$ conditions).
45+
46+
| Short Circuiting | Conditions | Coverage |
47+
| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- |
48+
| On | $\top \lor (\_ \land \_)$, $\bot \lor (\bot \land \_)$, $\bot \lor (\top \land \top)$, $\bot \lor (\top \land \bot)$ | $\cfrac{2}{4}$ |
49+
| Off | $\bot \lor (\bot \land \bot)$, $\bot \lor (\bot \land \top)$, $\bot \lor (\top \land \bot)$, $\bot \lor (\top \land \top)$,$\top \lor (\bot \land \bot)$, $\top \lor (\bot \land \top)$, $\top \lor (\top \land \bot)$, $\top \lor (\top \land \top)$ | $\cfrac{2}{8}$ |
50+
### Modified Condition/Decision Coverage
51+
Decision coverage $+$ Condition Coverage $+$ Must show each atomic condition independently influences the branch outcome.
52+
$$\text{MC/DC Coverage} = \text{Percentage of conditions that meet MCDC criteria}$$
53+
In general $n+1$ tests are required for $n$ atoms, to pairs of test cases where only one atom changes, and the result of the condition changes.
54+
55+
| Test | $x$ | $y$ | $x>y$ | $x < 0$ | $y > 0$ | Branch |
56+
| ---- | --- | --- | ------ | ------- | ------- | ------ |
57+
| T1 | 1 | 1 | $\bot$ | $\bot$ | $\top$ | $\bot$ |
58+
| T2 | 2 | 1 | $\top$ | $\bot$ | $\top$ | $\top$ |
59+
| T3 | -1 | 1 | $\bot$ | $\top$ | $\top$ | $\top$ |
60+
| T4 | -1 | 0 | $\bot$ | $\top$ | $\bot$ | $\bot$ |
61+
The test cases demonstrate that each condition does independently affect the branch outcome.
62+
- T1 $\to$ T2 shows $x > y$ changes branch outcome
63+
- T3 $\to$ T4 shows $y > 0$ changes branch outcome
64+
- T1 $\to$ T3 shows $x < 0$ changes the branch outcome
65+
### Data Flow Coverage
66+
```C
67+
int foo(int x /* def(x, 1) */) {
68+
while (X > 0) { // use(x, 1)
69+
x = x - 1; // def(x, 2), use(x, 2)
70+
}
71+
}
72+
```
73+
We have the pairs:
74+
$$\begin{split}
75+
P1 : & \ def_1(x) \to use_1(x) \\
76+
P2 : & \ def_1(x) \to use_2(x) \\
77+
P3: & \ def_2(x) \to use_1(x) \\
78+
P4: & \ def_2(x) \to use_2(x) \\
79+
\end{split}$$
80+
When $x \geq 2$ we get all data flows, when $x = 1$ we only get $P1, P2, P3$, and when $x = 0$ we only get $P1$.
81+
### Mutation-Based Coverage
82+
We use a [[Mutation-Based Fuzzer]] and apply small transformations to the program.
83+
- Aim to generate a test that has different behaviour between the original and mutated programs
84+
- Can apply many mutations, on top of mutations (Higher Order Mutants)
85+
Mutants are *killed* when a test results in differing behaviour to the original.
86+
87+
| Type | Description |
88+
| --------------- | -------------------------------------------------------------------------------------------------- |
89+
| Strongly Killed | Different program outputs |
90+
| Weakly Killed | Different program states (an internal component computes a different value, but outputs unchanged) |
91+
$$\text{Mutation Coverage} = \cfrac{\text{Killed Mutants}}{\text{Total Mutants}}$$
92+
Mutants not killed are *surviving mutants*.
93+
94+
Main issues
95+
- *Equivalent Mutants* (Syntactically different, semantically identical) to the original, can never be killed. Determining if it is identical is undecidable in the general case.
96+
- *Indistinguishable Mutants* (equivalent mutants, but to another mutant rather than the original), as many can be killed, but are actually identical, this can inflate the mutation score above what it would be if *Indistinguishable Mutants* could be eliminated.

Diff for: 70024 - Software Reliability/Dynamic Analysis.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ Analysis of behaviour collected from running programs.
44
- [[70024 - Software Reliability/Symbolic Execution]]
55
- alternative to [[Static Analysis]]
66

7-
| Advantage | Description |
8-
| ---- | ---- |
9-
| Precise | No false positives - the behaviour observed **is** from the program's execution. |
10-
| Scalable | Can instrument software and deploy at scale (performance is proportional to regular execution). |
7+
| Advantage | Description |
8+
| --------- | ----------------------------------------------------------------------------------------------- |
9+
| Precise | No false positives - the behaviour observed **is** from the program's execution. |
10+
| Scalable | Can instrument software and deploy at scale (performance is proportional to regular execution). |
1111

1212
| Disadvantage | Description |
1313
| ---- | ---- |

Diff for: 70024 - Software Reliability/Mutation Testing.md

Whitespace-only changes.
+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
## Definition
22

3-
A [[fuzzer|Fuzzing]] that produces inputs by modifying or combining existing inputs.
3+
A [[fuzzer|Fuzzing]] that produces inputs by modifying or combining existing inputs. A kind of [[Mutation Testing]]

Diff for: 70024 - Software Reliability/Random Program Generation.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,5 @@ By being less conservative about [[Undefined Behaviour]] (and language semantics
3434
- Generating expressions that could contain [[Undefined Behaviour]]
3535
The weakened constraints are weighted (e.g. allow null ptr dereference in $\approx10\%$ of generated programs).
3636

37-
A volation of a short circuiting rule for modulus/ `%` was found, that required the removal of safe wrappers which included bracketing that disuaded the compiler from optimising incorrectly.
37+
A violation of a short circuiting rule for modulus/ `%` was found, that required the removal of safe wrappers which included bracketing that dissuaded the compiler from optimising incorrectly.
3838

0 commit comments

Comments
 (0)