This project is a C-based version of the turnout assignment.
There are three separate deliverables for this project, each due at the start of class (via web-Turnin) on the specified date:
TurnOut-C is available as another VMware image for this class; it is in the share \\fossil.wpi.edu\cs4401\ in the turnout-c directory. Log into the image as "student" with username "WormSplurt". You'll see a link to the executable on the desktop. Open a terminal window and navigate to the desktop. You can then launch the turnout application via the command line.
We will provide a password to access the source files after the blackbox deadline.
Fill in and submit an attack summary spreadsheet. If you don't use Excel, reproduce the format of this spreadsheet in some reasonable alternative (that the TAs will be able to read and edit).
Be sure to fill in your name in cell A1.
The spreadsheet has two sections:
Each attack you list should be qualitatively different. Multiple versions of the same attack will cost you points. Attacks are the same if they exploit the same vulnerability with the same result (ie, both use code injection with the same constructs in the same field to achieve the same goal). If you list multiple attacks that look similar but you think are not, give us a sentence or two of justification.
On the day that the whitebox tests are due, we will review some of the vulnerabilities that you found in class. You are free to draw on the attacks found by other students when you patch the code for the third deadline.
Each attack you list should be qualitatively different. Multiple versions of the same attack will cost you points. Attacks are the same if they exploit the same vulnerability with the same result (ie, both use code injection with the same constructs in the same field to achieve the same goal). If you list multiple attacks that look similar but you think are not, give us a sentence or two of justification.
Submit a zip file containing edited versions of the source code and a README.txt file. Your README should describe each edit you made at a high level (such as "added filtering to the X input") and the class of attacks that edit is designed to mitigate. Your goal is to fix the code to avoid as many attacks as possible, not just the attacks that you personally identified for the first two deadlines.
In grading this assignment, we will look for:
We will not announce a number of attacks that you should aim for because real-world systems don't come with this information. A comprehensive and systematic attack strategy is your best evidence for the quality of your work on this assignment (it also helps us gauge your respective abilities in identifying vulnerabilities and crafting exploits).