Carlos Rene's Web Space

Reading List

admin — Sun, 12 Jul 2009 22:09:05 +0000

This weekend I read ‘Foundations of Security: What every programmer needs to know’ by Neil Daswani, et al. I got the book for free from him when I answered one of the group questions. It’s a great book and great for a course on software security. The book is actually designed to be part of the Computer Security Certification curriculum at Stanford’s Center for Professional Development. What I really like about this book is that it provides you with further reading refereneces in the case f new developing technology or exploits that would be worth a look. It’s a really great teaching book.

Security Theorem #1

admin — Wed, 08 Jul 2009 20:25:58 +0000

Never allow control of your inputs! Why do you trust your users? They aren’t nice people, some are trying to break your software. So in essence don’t ever trust them. Always sanitize your inputs and verify that they conform to white-listed entries.

Problems I have with KVM

admin — Wed, 08 Jul 2009 19:16:07 +0000

The idea of leveraging Linux as a hypervisor seems nice because you can utilize Linux constructs that are not on Xen. The problem of course is that there may be bugs lurking in the kernel that we are yet unaware off.

It’s not just a matter of the core Linux kernel -eventhough I can name a couple of exploits in the ipv6 stack- there are way more exploits in the kernel modules, specifically drivers.

Basically Xen security is based on maintaining a small footprint and a limited ABI. Small footprint are beneficial in that as code grows it becomes increasingly hard to maintain as bug-free. As we know, we can’t have an exploit without an underlying bug. In order to create perfect software you would need infinite time and infinite money, neither of which a vast company like Microsoft has been able to produce -bug-free software-.

Difficulties in Operating Systems Homework #1

admin — Sat, 27 Jun 2009 23:19:14 +0000

Updated: June 28, 2009

Just a couple of clarifications for the programming & non-programming problem set

Programming Set Mistakes:

Remember that compile-time warnings are errors!

Wtar: ‘wtar *’ when given the globstar shell option. The meaning of ‘*’ according to the bash-shell manual is a pattern matching symbol that matches any string, including the null string. When the globstar shell option is enabled, and ‘*’ is used in a filename expansion context, two adjacent ‘*’s used as a single pattern will match all files and zero or more directories and subdirectories. If followed by a ‘/’, two adjacent ‘*’s will match only directories and subdirectories.

Thus your program will really be receiving as arguments: “wtar file1 file2 directory1″ that will be given to the program’s main() function as argv[][] = { “wtar”, “file1″, “file2″, “directory1″ }

Non-programming Set Mistakes:

Monolithic Kernel:

OS design in which all system services (Virtual Memory, Signals, IPC’s, Sockets, Processes, Security Mechanism ~ User ID) are implemented in one large executable binary program that runs entirely in the privileged kernel space.
Microkernel:

OS design in which a few system services (VM, IPC’s, Processes) are executed in privileged kernel space, while other system services such as (Sockets, Signals, etc..) in order to achieve reliability are run in un-privileged user-space.
Exokernel:

An OS designed only for protection and multiplexing of hardware resources, allowing applications as much access to the underlying hardware as they are allocated.
- Example is a Library-OS such as Libra. An OS design that removes redundant system services to improve application performance. For example: Java Virtual Machines provide their own threading model and memory protection, so general-purpose operating system implementations of these abstractions are redundant.

Projects for Summer/Fall 09

admin — Tue, 23 Jun 2009 22:23:18 +0000

As part of the Network Security Lab (Prof. Angelos Keromytis) I’m looking for interested Columbia Undergraduate (4901) or Masters (6901) students to work on several research projects related to either mobile computing or operating system security. This research will count as either COMS 4901/6901 Independent Research under Prof. Angelos Keromytis. Interested persons/groups are welcome to e-mail me or pass by my office (521 CSB) to talk.

Kernel Self-Healing

Use Checkpoint and Restart for securing Kernel.

Checkpoint and Restart

Feasibility of Process Migration using Checkpoint and Restart through different OS (Linux / Mac).

Mobile Computing

Context-Aware Computing Additions on iPhone:
- Camera Detection: Facial Recognition, etc…
OpenGL User Interfaces

Visualization

Table PC Visualization of IDS Information and Vulnerabilities
- Optics for Projector: to remove depth of touch screen.

I’ll be updating this page with further information as it becomes available.

Locking down Wordpress

admin — Fri, 05 Jun 2009 19:03:41 +0000

There’s been a string of breaking attempts here at Columbia, so I’ve decided to take a couple of precautions to lock down my wordpress blog. Here are a couple of useful links:

Wordpress Security Tips and Hacks

Status [June 4, 2009]

admin — Thu, 04 Jun 2009 14:07:52 +0000

iPhone doesn’t have a Layout Manager, so I’m creating one.

Palm Pre’s First Reviews

admin — Thu, 04 Jun 2009 10:44:05 +0000

Wired.com has one of the first reviews on the upcoming Palm Pre! The best part: "Now led by a CEO with a pedigree from the company it hopes to challenge (Jon Rubinstein, who headed the division that created Apple’s iPod), Palm once again claims to be a contender."

I’m watching out for this one, a new device to add to Columbia’s Mobile Computing Course!

Status [June 3, 2009]

admin — Wed, 03 Jun 2009 18:07:26 +0000

I’m happy with my progress today, so I decided to go all out describing what I’ve done.

First thing I did was add some new things to the summer OS CVN course homework. It’s not like I’m dedicating much time to it, I just enjoy the teaching aspect of TA’ing and I needed to give them the 2nd homework. So what I *quickly* did for homework 2 (already sent out) was include some Windows Kernel programming. Originally on homework 2 they learn how to use the Linux Kernel Debugger, NOW they also learn to use the WinDBG kernel debugger, where to get the Windows Kernel Symbol from MS, information and how to see what modules are loaded, how to do breakpoints (I’m applying what I learned from MSR last summer).

The idea is to have them learn as much as possible about both environments. Eventually the next homework will include information on creating a Windows Kernel Module, other homework ideas: Windows User Mode Scheduling (for scheduling homework) …etc…

For the Mobile Context-Aware Application, since I want to demo the app for Friday. I want to dedicate more time this week to get it done and off the stack. Though I have plenty of ideas that I would like to implement and eventually work on this as a long-term project that I want to add more machine learning into the phone.

*Speaker Recognition*: I added code to record and save wave PCM files and I upload them as an HTTP post to my web-server (this is the back-end web-server I created on June 1st). Ideally I would like to do the processing "on-site" on the phone, but in the interest of a speedy prototype I’m going to use an Octave/Matlab on the back-end to process that data, since matlab has really great support for representing and working with this type of data than I would have with any other mechanism on the phone. Otherwise I would also need to implement and debug on the phone: it will just take much longer and I’m more worried about the debug time, especially on a slow device and then optimizing on that device. On the other hand, on my workstation I can just be lazy about memory allocation and CPU resources. I already have the Matlab code that does some limited Speaker recognition, though I need add some wrappers for my data format (the code uses some other data format) and see what else from the Matlab code I need to change.

I’ve done some research into how the problem should be solved: The first problem is that of Segmentation (removing the stuff such as noise and data you don’t want to analyze). I’ve read about some work on using vowel sounds (as mentioned June 2, 09 email) as the easiest identifying data we can get from a speakers voice because vowels are usually easily identifiable on the frequency spectrum as a series low-freq & high amplitude waves [6 - there are some nice images of what I'm talking about here also]. Once I’ve gotten a segmentation of the vowel sounds on Matlab, I’ll be able to do an easy FFT of the vowels small window/time size and eventually compare it to a small set of training vowels sounds for N speakers. I’m decided on focusing on the vowels sounds since I would like this algorithm to eventually run on the phone itself, and a small training set is obviously better for a mobile device.

Armed with that FFT I’ll converted my raw data into an attribute/"feature" vector that I can compare to my training data using a Support Vector Machine. I don’t know if the features from the FFT will be linearly separable, but to be on the same side I’ll just use a radial basis kernel that converts it to an infinite dimensional space. Hopefully it will be separable in that new higher dimensional feature space. Running that in my back-end I can the notify the phone of new data and query the classification.

*Gesture recognition* (IMPLEMENTED, TWEAKING AND MORE TRAINING DATA, missing segmentation): As I mentioned in the last paragraph I’m using my web-server for prototype recognition code. The other sensors I’m using in the app is the accelerometer: I want to be able to distinguish what a user is doing with the phone: reading data from the screen, walking… etc…

So, like the speaker recognition problem I have to do segmentation and feature extraction on the raw accelerometer data. I found a nifty paper by [7] in which they do (I talk about segmentation below) feature extraction by visualizing two orthogonal intersecting circles with 14 uniformly distributed cluster centroids and choosing the min {distance between accel vector v. cluster centroid}. And bingo! We’ve got a nice feature extraction algorithm with magnitude appended to it. I then convert these 14 directions into a string representation (like a genetic code) and send it over to my web-server as an HTTP Post message for processing.

The benefit of converting it to a string is that there are tons, and tons of algorithms in Bio-Informatics to calculate similarities/alignment/etc of string sequences! For this case I’m using the Levenshtein distance[8] to penalize the difference between two sequences (testing v. training). With this information I’m able to classify gestures such as moving your phone in a circle fashion v. a triangle fashion. As evidence of this I’ve attached two images of recorded feature vectors in a 2-D space!!

Keep in mind that the images include pre/post noise that we don’t really want, that needs to be segmented out! BUT there is another string comparison algorithm that is based on first aligning the strings and ignoring segments that are not in both strings called Pairwise Sequence Alignment [9] this algorithm is difficult to implement and I don’t quite understand it completely (maybe future work, but not for a quick prototype). But it would definitely solve our segmentation problem.

*Mobile Storage*: I created a model for the data I’m storing in the app using an Object Relational Database to store everything. I have to backup this database to the back-end server since I currently store it on the phone’s local storage.

*Also*, I’ve decided on separating all these components into separate apps, since one major app is becoming difficult to maintain especially since I’m researching how to do these things and whenever I change something I end up messing some other code or its just to much of a big prototype code-base.

For Kernel Assure, I already mentioned that I got KernInst library (C++ instrumentation wrapper library) / kernInst daemon (instrumentation daemon) / kernInst kernel module compiled and loaded on my VM. But when I try to instrument with KPerfmon (a GUI to KernInst profiling) I get a weird error that is pretty cryptic message (which Google returns 0 results):

***

kerninstd: ../../../kerninstd/function/src/funkshun.h:862: monotone_bitwise_dataflow_fn* function_t::getLiveRegFnForAnExitEdge(uint16_t, uint16_t, const calcEffectOfCall&) const [with calcEffectOfCall = RegAnalysisHandleCall_FirstTime]: Assertion `branchDestAddr != (kptr_t)-1 && "expected basic block to end in a branch"’ failed.

***

I’ve included the full kernel log as [1]. In essence I’ve got some options:

a) send the log to mjbrim@cs.wisc.edu (Michael Brim) [4,5] (still a PhD student there) and hopefully someone is still maintaining it – though the creator Ariel Tamches[3] already graduated (he should be working at VMWare CA – from the info of his wisc webpage)

b) take a look at the inner details of the fault through reading the source code and using the authors Thesis [2] that describes on chapter 3-6 the inner details of the code/algorithm.

c) run the daemon through the GDB debugger to see what is being called and maybe there is more source documentation on where its failing. Also get the stack trace, etc…

I decided to proceed with (c) since I’m not to fond of bothering people until I’ve exhausted all possible options. If I do verbose debugging it filled my screen with 64,485 lines of debugging output. So instead I just ran it inside GDB and let it see where it faults. The *weird* thing is that when I ran it inside GDB it worked!! There is probably some race condition somewhere in which running the code slowly makes it work.

***

There are 2 modules

fillin_functionsWithKnownNumLevelsByAddr() bye: parsed 0 entries

kerninstd — finished with startup — entering main loop now

Reminder: press ^C in this window to exit kerninstd at any time…

The chosen accept port number is 32769

Kerninstd ready.

***

[9] "Pairwise Sequence Alignment" http://web.cecs.pdx.edu/~ps/CapStone03/dynvis/SimilarityApplet.html

[8] "Levenshtein Distance" http://en.wikipedia.org/wiki/Levenshtein_distance

[7] Schlomer, T., Poppinga, B., Henze, N., Boll, S. "Gesture recognition on the Wii controller" http://portal.acm.org/citation.cfm?doid=1347390.1347395

[6] http://hyperphysics.phy-astr.gsu.edu/hbase/music/vowel2.html#c3

[5] http://pages.cs.wisc.edu/~mjbrim/

[4] "KernInst User’s Guide" http://www.paradyn.org/kerninst/release-2.1.2/users_guide.pdf

[3] Ariel Tamches http://pages.cs.wisc.edu/~tamches/

[2] Tamches, A. "KernInst Thesis" http://pages.cs.wisc.edu/~tamches/mydissertation.pdf

[1] Cryptic Kernel Debug Output from KernInst profiling (I took it out since it was way long long output…)

Kernel Assure

Context-Aware Mobile Computing

Today: Simulate

Today: Research Speaker Recognition Module. Do Gesture Recognition

Tomorrow: Simulate bug and replay with VMWare Record & Replay.

Tomorrow:

Useful Links:

First step is to simulate a kernel exploit on 2.6.12.6

KernInst Hierarchy
libkerninstapi
kerninstd
kerninst [module]

Run the KernInst Daemon:

kerninstd -system_map /boot/System.map-2.6.12.6

Welcome to Kerninstd, v2.1.2

Using file /boot/System.map-2.6.12.6 as System.map

cpu0: 2663.14 MHz

Analyzing kernel image...

note: could not open skips.txt file; continuing

note: could not open returning_funcs.txt file; continuing

note: could not open function_numlevels.txt file; continuing

Found absolute jump to non-kernel segment @ 0xc010f88a to seg(0x0008):offset(00000f71)

Warning: fn kernel/init at 0xC0100288 has no exit points.