The course staff have implemented a web-based gradebook (called TurnOut) for this course. By default, everyone is listed as getting an NR. You have two general tasks: exploit as many vulnerabilities as you can find in the system (including figuring out how to give yourself a better grade) and fix the system to prevent attacks.

There are three separate deliverables for this project, each due before the start of class (via web-Turnin) on the specified date:

• For Thursday, August 30: Attack TurnOut blackbox (ie, without looking at the source code)
• For Tuesday, September 4: Attack TurnOut whitebox (ie, with looking at the source code)
• For Friday, September 7: Submit a patched (secure) implementation

TurnOut-web is running in a virtual machine image. You can get the image from the share \\fossil.wpi.edu\cs4401\ in the turnout-web directory. You may either work on the CCC machines or on your own computer. You can use either VirtualBox or VMware player (not officially supported, but should work).

For the blackbox deadline, simply load the turnout-web image. This will start up the turnout web server automatically. A message box will come up before the login screen that gives the virtual machine's IP address. You can run the web application by visiting this IP address in a web browser. If that screen is blank, it means the machine's IP address wasn't set yet. Press right ctrl+backspace to refresh under virtualbox (more detailed virtualbox setup instructions).

Instructions to access the image contents for the whitebox and patch deadlines will be provided after the blackbox deadline.

What to Submit for the Attack Due Dates

Fill in and submit an attack summary spreadsheet. If you don't use Excel, reproduce the format of this spreadsheet in some reasonable alternative (that the TAs will be able to read and edit).

Be sure to fill in your name in cell A1.

The spreadsheet has two sections:

• Under General Strategy, describe how you went about looking for exploits. If you did something systematic (ideal), describe it. Not everything has to be systematic; just tell us how you approached the assignment.
• Under Exploits, list the attacks you tried against the system. For each attempt, briefly (few words) describe what you tried, indicate whether your attempt succeeded, and give a couple of words saying how you came up with that attempt (either a step in your systematic process or something you just thought to try). You should also provide the steps for each attack you tried. Your steps should be sufficiently concrete that someone without security experience can follow them to reproduce the attack.

Each attack you list should be qualitatively different. Multiple versions of the same attack will cost you points. Attacks are the same if they exploit the same vulnerability with the same result (ie, both use code injection with the same constructs in the same field to achieve the same goal). If you list multiple attacks that look similar but you think are not, give us a sentence or two of justification.

On the day that the whitebox tests are due, we will review some of the vulnerabilities that you found in class. You are free to draw on the attacks found by other students when you patch the code for the third deadline.

For the Patch Due Date

Submit a zip file containing edited versions of the source code and a README.txt file. For each patch you made, describe the edit at a high level (such as "added filtering to the X input"), the class of attacks that the edit is designed to prevent, and where in the code (which files and functions/definitions) you made changes to implement the patch. Your goal is to fix the code to avoid as many attacks as possible, not just the attacks that you personally identified for the first two deadlines.

Grading

In grading this assignment, we will look for:

• Whether you outlined a a good attack strategy that covered the possible holes in the system
• Whether you were able to construct concrete attacks corresponding to the vulnerabilities listed in your strategy
• Whether you identified appropriate places and methods to mitigate the potential attacks on the system

We will not announce a number of attacks that you should aim for because real-world systems don't come with this information. A comprehensive and systematic attack strategy is your best evidence for the quality of your work on this assignment (it also helps us gauge your respective abilities in identifying vulnerabilities and crafting exploits).

Course homepage