diff --git a/.gitignore b/.gitignore index 3b7ff08..7b89ca9 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,8 @@ *.aux *.blg *.gz +*.out +*.snm +*.toc +*.vrb +*.nav diff --git a/SemSEpresentation/TU_Logo.pdf b/SemSEpresentation/TU_Logo.pdf new file mode 100644 index 0000000..179eed5 Binary files /dev/null and b/SemSEpresentation/TU_Logo.pdf differ diff --git a/SemSEpresentation/TU_Logo_white.pdf b/SemSEpresentation/TU_Logo_white.pdf new file mode 100644 index 0000000..fd75c24 Binary files /dev/null and b/SemSEpresentation/TU_Logo_white.pdf differ diff --git a/SemSEpresentation/TU_Signet.pdf b/SemSEpresentation/TU_Signet.pdf new file mode 100644 index 0000000..aff2a48 Binary files /dev/null and b/SemSEpresentation/TU_Signet.pdf differ diff --git a/SemSEpresentation/beamerthemetuw.sty b/SemSEpresentation/beamerthemetuw.sty new file mode 100644 index 0000000..6641bc8 --- /dev/null +++ b/SemSEpresentation/beamerthemetuw.sty @@ -0,0 +1,305 @@ +%% +% @file beamerthemeTUW.sty +% @date 2016-08-30 +% @author Wolfgang Puffitsch, Denise Ratasich +% +% @brief Beamer LaTeX template matching the corporate design of TU Wien. +%% + +\NeedsTeXFormat{LaTeX2e} +\ProvidesPackage{beamerthemeTUW}[2016/08/30 Beamer template that fits the TU Wien corporate design (adopted styles from powerpoint presentation template in CD manual)] + +\RequirePackage{graphicx} +\RequirePackage{tikz} + +\def\beamer@tuwDefault{default} +\def\beamer@tuwPlain{plain} +\def\beamer@tuwSidebar{sidebar} +\def\beamer@tuwHelvetica{helvetica} +\def\beamer@tuwNoImage{none} +\def\beamer@tuwLogo{TU_Logo} +\def\beamer@tuwLogoWhite{TU_Logo_white} + +%%% options +% The user may choose other fonts (TU Wien CD says to use helvetica). +\DeclareOptionBeamer{font}{\def\beamer@tuwFont{#1}} +% Another outer theme may be chosen, however it may not fit the TU Wien colors. +\DeclareOptionBeamer{outer}{\def\beamer@tuwOuter{#1}} +% Width of the sidebar. +\DeclareOptionBeamer{width}{\def\beamer@tuwWidth{#1}} +% Background image of TU Wien building on title page. +\newif\ifbeamer@tuwBackground +\DeclareOptionBeamer{tuw_background}{\beamer@tuwBackgroundtrue} +% Individual background image on title page. +\DeclareOptionBeamer{tuw_image}{\def\beamer@tuwImage{#1}} +% White logo (if tuw_image is dark the logo should be set to be white). +\newif\ifbeamer@tuwWhiteLogo +\DeclareOptionBeamer{tuw_whitelogo}{\beamer@tuwWhiteLogotrue} +% Print frame title beside the logo to save space. +\newif\ifbeamer@tuwFrametitleToTop +\DeclareOptionBeamer{tuw_frametitletotop}{\beamer@tuwFrametitleToToptrue} + +% defaults +\ExecuteOptionsBeamer{outer=default} +\ExecuteOptionsBeamer{width=1.6cm} +\ExecuteOptionsBeamer{font=\familydefault} +\beamer@tuwBackgroundfalse +\ExecuteOptionsBeamer{tuw_image=none} +\beamer@tuwWhiteLogofalse +\beamer@tuwFrametitleToTopfalse + +\ProcessOptionsBeamer + +\ifx\beamer@tuwFont\beamer@tuwHelvetica +\RequirePackage{helvet} +\fi + +\mode + +%%% colors +% For some reason the logo is not in TU-blue (0,102,153). The powerpoint +% presentation has TU-blue as background and the logo with a different color +% (doesn't look nice). We align the TU-blue to the logo, like in the CD manual. +\definecolor{tuwBlue}{RGB}{0,116,178} +\definecolor{tuwGray}{RGB}{102,102,102} +\definecolor{iceBlue}{RGB}{222,231,236} + +\def\tuwBlue{tuwBlue} +\def\tuwGray{tuwGray} +\def\iceBlue{iceBlue} +\def\tuwLightBlue{tuwBlue!20!white} +\def\tuwMediumBlue{tuwBlue!45!white} +\def\tuwDarkBlue{tuwBlue!70!black} +\def\alertred{red!50!black} + +% content page +\setbeamercolor{normal text}{fg=black,bg=white} +\setbeamercolor{alerted text}{fg=\alertred} +\setbeamercolor{structure}{fg=\tuwBlue} +\setbeamercolor{frametitle}{fg=black} + +\setbeamercolor{palette primary}{fg=\tuwDarkBlue,bg=\tuwLightBlue} +\setbeamercolor{palette secondary}{fg=\tuwBlue!50!black,bg=\tuwMediumBlue} +\setbeamercolor{palette tertiary}{fg=white,bg=\tuwBlue} + +\setbeamercolor{section in toc}{parent=normal text} +\setbeamercolor{subsection in toc}{parent=section in toc} + +\setbeamercolor{block title}{fg=white, bg=\tuwBlue} +\setbeamercolor{block title example}{fg=white, bg=\tuwBlue} +\setbeamercolor{block title alerted}{fg=white, bg=\alertred} +\setbeamercolor{block body}{bg=\iceBlue} +\setbeamercolor{block body example}{parent=block body} +\setbeamercolor{block body alerted}{parent=block body, fg=\alertred} + +\setbeamercolor{title in head/foot}{fg=\tuwBlue} +\setbeamercolor{page number in head/foot}{fg=\tuwBlue} +\setbeamercolor{footline}{fg=\tuwBlue} + +% color difference of default and other outer styles +\ifx\beamer@tuwOuter\beamer@tuwDefault +% default style - this is the CD of TU Wien +% title page +\setbeamercolor{title}{fg=white} +\setbeamercolor{subtitle}{fg=white} +\setbeamercolor{author}{fg=white} +\setbeamercolor{institute}{fg=white} +\setbeamercolor{date}{fg=white} +% content page +% keep defaults (black) +\else +% other outer styles (e.g., sidebar) +% title page +\setbeamercolor{title}{fg=\tuwGray} +\setbeamercolor{subtitle}{fg=\tuwGray} +\setbeamercolor{author}{fg=black} +\setbeamercolor{institute}{fg=black} +\setbeamercolor{date}{fg=black} +% content page +\setbeamercolor{frametitle}{fg=\tuwGray} +\setbeamercolor{headline}{fg=\tuwGray} +\setbeamercolor{footline}{fg=\tuwGray} +\fi + +% sidebar +\setbeamercolor{sidebar}{bg=\tuwBlue,fg=white} +\setbeamercolor{palette sidebar primary}{fg=\tuwDarkBlue,bg=\tuwLightBlue} +\setbeamercolor{palette sidebar secondary}{fg=\tuwDarkBlue,bg=\tuwLightBlue} +\setbeamercolor{palette sidebar tertiary}{fg=white,bg=\tuwBlue} +\setbeamercolor{title in sidebar}{fg=white,bg=\tuwBlue} +\setbeamercolor{section in sidebar}{fg=\tuwDarkBlue} +\setbeamercolor{section in sidebar shaded}{fg=white,bg=\tuwBlue} +\setbeamercolor{subsection in sidebar}{fg=\tuwDarkBlue} +\setbeamercolor{subsection in sidebar shaded}{fg=white,bg=\tuwBlue} + +%%% fonts + +% font weight +\setbeamerfont{title}{series=\bfseries} +\setbeamerfont{author}{series=\mdseries} +\setbeamerfont{institute}{series=\mdseries} +\setbeamerfont{date}{series=\mdseries} +\setbeamerfont{frametitle}{series=\mdseries} +\setbeamerfont{headline}{series=\mdseries} +\setbeamerfont{footline}{series=\mdseries} + +% font size difference of default and other outer styles +\ifx\beamer@tuwOuter\beamer@tuwDefault +% default style - this is the CD of TU Wien +\setbeamerfont{title}{size=\huge} +\setbeamerfont{author}{size=\normalsize} +\setbeamerfont{institute}{size=\normalsize} +\setbeamerfont{date}{size=\normalsize} +\setbeamerfont{frametitle}{size=\Large} +\setbeamerfont{framesubtitle}{size=\large} +\setbeamerfont{headline}{size=\scriptsize} +\setbeamerfont{footline}{size=\scriptsize} +\else +% other outer styles (e.g., sidebar) +% keep defaults +\fi + +\setbeamerfont{section in toc}{parent=normal text} +\setbeamerfont{subsection in toc}{parent=section in toc} + +% sidebar +\setbeamerfont{title in sidebar}{series=\bfseries} +\setbeamerfont{section in sidebar}{series=\bfseries,size=\tiny} +\setbeamerfont{subsection in sidebar}{size=\tiny} + +%%% outer +\setbeamersize{text margin left=1.2cm} +\setbeamersize{text margin right=1.5cm} +\beamertemplatenavigationsymbolsempty + + +\ifx\beamer@tuwOuter\beamer@tuwDefault +% default outher theme - this is the CD of TU Wien + +% background +\setbeamertemplate{background}{ + \begin{tikzpicture} + \useasboundingbox (0,0) rectangle(\the\paperwidth,\the\paperheight); + % title page + \ifbeamer@tuwBackground % tu building background selected + \node[anchor=south west] (background) at (-0.15cm,-0.15cm) {\includegraphics[width=1.01\paperwidth]{TU_Background}}; + \else\ifx\beamer@tuwImage\beamer@tuwNoImage % no background image specified + \fill[white] (0,0) rectangle (\the\paperwidth,\the\paperheight); + \else % individual background image + \node[anchor=north west] (background) at (-0.15cm,-0.15cm) {\includegraphics[width=1.01\paperwidth]{\beamer@tuwImage}}; + \fi\fi + \fill[\tuwBlue, rounded corners=0.5cm] (-1cm,-1cm) rectangle (\paperwidth-0.5cm,\paperheight-3cm); + \ifbeamer@tuwWhiteLogo % white logo option specified + \node[anchor=north west] (logo) at (0.3cm,\paperheight-0.1cm) {\includegraphics[height=2cm]{\beamer@tuwLogoWhite}}; + \else + \node[anchor=north west] (logo) at (0.2cm,\paperheight-0.2cm) {\includegraphics[height=2cm]{\beamer@tuwLogo}}; + \fi + % content page + \ifnum\thepage>1\relax% + \fill[\iceBlue] (0,0) rectangle (\the\paperwidth,\the\paperheight); + \fill[white, rounded corners=0.5cm] (-1cm,-1cm) rectangle(\paperwidth-0.4cm,\paperheight-0.8cm); + \node[anchor=west] (logo) at (0.3cm,\paperheight-0.4cm) {\includegraphics[height=0.5cm]{TU_Signet}}; + \fi + \end{tikzpicture} +} + +% title page +\def\beamer@titlepageLeft{1.6cm} +\setbeamertemplate{title page}{ + \vskip 4cm% + \begin{beamercolorbox}[leftskip=\beamer@titlepageLeft]{title}% + \usebeamerfont{title}\inserttitle% + \end{beamercolorbox}% + \vskip 0.5cm% + \begin{beamercolorbox}[leftskip=\beamer@titlepageLeft]{subtitle} + \usebeamerfont{subtitle}\insertsubtitle% + \end{beamercolorbox} + \vskip 0.25cm% + \vfill% + \begin{beamercolorbox}[leftskip=\beamer@titlepageLeft]{author} + \usebeamerfont{author}\insertauthor% + \end{beamercolorbox} + \begin{beamercolorbox}[leftskip=\beamer@titlepageLeft]{date} + \usebeamerfont{date}\insertdate% + \end{beamercolorbox} +} + +% frametitle +\setbeamertemplate{frametitle} +{% + \ifbeamer@tuwFrametitleToTop % frametitle should be printed beside the logo + % vbox to keep the baseline + \vbox{}\vskip -0.43cm% + \else + \vbox{}\vskip 0.7cm% + \fi + \begin{beamercolorbox}[leftskip=0cm]{frametitle} + \usebeamerfont{frametitle}\insertframetitle% + \ifbeamer@tuwFrametitleToTop + \vbox{}\vskip 0.3cm% + \else + \vbox{}\vskip 0.2cm% + \fi + \usebeamerfont{framesubtitle}\insertframesubtitle% + \end{beamercolorbox} +} + +% footline +\setbeamertemplate{footline}{% + \vspace{0.1cm} + \ifnum\thepage>1 + \begin{beamercolorbox}[wd=\paperwidth,ht=2.25ex,dp=1ex]{footline} + \hskip 1.2cm% + \usebeamerfont{footline}\insertshortdate% + \hfill% + \insertshorttitle, \insertshortauthor% + \hfill% + \insertframenumber\:/\:\inserttotalframenumber% + \hspace*{1.5cm}% + \end{beamercolorbox} + \else + \begin{beamercolorbox}[wd=\paperwidth,ht=2.25ex,dp=1ex,center]{}% + % empty environment to raise height + \end{beamercolorbox} + \fi + \vspace{0.1cm} +} + +\else\ifx\beamer@tuwOuter\beamer@tuwSidebar +% sidebar outer theme +\useoutertheme[width=\beamer@tuwWidth,height=0pt]{\beamer@tuwOuter} + +% footline +\setbeamertemplate{footline}{ + \ifnum\thepage>1 + \vspace{-1cm} + \hfill{\scriptsize\insertframenumber\:/\:\inserttotalframenumber~~} + \vspace{0.1cm} + \fi +} +\else +\useoutertheme{\beamer@tuwOuter} +\fi\fi % if outer=default or outer=sidebar + + +%%% inner +\ifx\beamer@tuwOuter\beamer@tuwDefault +\setbeamertemplate{itemize items}[circle] +\else +% defaults +\fi % if outer=default + +\setlength{\parskip}{6pt} + +% blocks +\setbeamertemplate{blocks}[rounded] +\pgfdeclareverticalshading{bmb@transition}{\the\paperwidth}{color(0pt)=(\iceBlue); color(3.0pt)=(\iceBlue)} + +\setbeamercovered{invisible} + +% emphasize +\renewcommand<>{\emph}[1]{{\only#2{\color{\tuwBlue}}#1}} + +\hypersetup{colorlinks=true,linkcolor=fg,citecolor=\tuwGray,urlcolor=\tuwGray} + +\mode diff --git a/SemSEpresentation/slides.pdf b/SemSEpresentation/slides.pdf new file mode 100644 index 0000000..4b04574 Binary files /dev/null and b/SemSEpresentation/slides.pdf differ diff --git a/SemSEpresentation/slides.tex b/SemSEpresentation/slides.tex new file mode 100644 index 0000000..a8d7e7c --- /dev/null +++ b/SemSEpresentation/slides.tex @@ -0,0 +1,251 @@ +\documentclass{beamer} +%\documentclass[aspectratio=169]{beamer} + +% You have to install the theme first! + +% corporate design of TU Wien +\usetheme[font=helvetica]{tuw} +% background "TU main building" on title page +%\usetheme[tuw_background]{tuw} +% individual background on title page +%\usetheme[tuw_image=TU_Background]{tuw} +% white logo if you have a dark background image +%\usetheme[tuw_image=TU_Background,tuw_whitelogo]{tuw} +% sidebar (not in TU Wien CD! but nice for long presentations) +% width of the sidebar can be changed with option: "width=2cm" +%\usetheme[outer=sidebar]{tuw} +% move frametitle up (beside logo) +%\usetheme[tuw_frametitletotop]{tuw} + +% if you use german umlaute use T1 encoding: +%\usepackage[T1]{fontenc} +% default Latex fonts are not T1 supported -> bitmaps used, this is not nice on +% screen; you can use the lmodern package instead +%\usepackage{lmodern} +\usepackage[utf8]{inputenc} +\usepackage{listings} +\usepackage{booktabs} +\usepackage{url} +\usepackage{xcolor} + +\definecolor{codegreen}{rgb}{0,0.6,0} +\definecolor{codegray}{rgb}{0.5,0.5,0.5} +\definecolor{codepurple}{rgb}{0.58,0,0.82} +\definecolor{backcolour}{rgb}{0.95,0.95,0.92} +\definecolor{verylightgray}{rgb}{.97,.97,.97} + +\lstdefinelanguage{Solidity}{ + keywords=[1]{anonymous, assembly, assert, balance, break, call, callcode, case, catch, class, constant, continue, constructor, contract, debugger, default, delegatecall, delete, do, else, emit, event, experimental, export, external, false, finally, for, function, gas, if, implements, import, in, indexed, instanceof, interface, internal, is, length, library, log0, log1, log2, log3, log4, memory, modifier, new, payable, pragma, private, protected, public, pure, push, require, return, returns, revert, selfdestruct, send, solidity, storage, struct, suicide, super, switch, then, this, throw, transfer, true, try, typeof, using, value, view, while, with, addmod, ecrecover, keccak256, mulmod, ripemd160, sha256, sha3}, % generic keywords including crypto operations + keywordstyle=[1]\color{blue}\bfseries, + keywords=[2]{address, bool, byte, bytes, bytes1, bytes2, bytes3, bytes4, bytes5, bytes6, bytes7, bytes8, bytes9, bytes10, bytes11, bytes12, bytes13, bytes14, bytes15, bytes16, bytes17, bytes18, bytes19, bytes20, bytes21, bytes22, bytes23, bytes24, bytes25, bytes26, bytes27, bytes28, bytes29, bytes30, bytes31, bytes32, enum, int, int8, int16, int24, int32, int40, int48, int56, int64, int72, int80, int88, int96, int104, int112, int120, int128, int136, int144, int152, int160, int168, int176, int184, int192, int200, int208, int216, int224, int232, int240, int248, int256, mapping, string, uint, uint8, uint16, uint24, uint32, uint40, uint48, uint56, uint64, uint72, uint80, uint88, uint96, uint104, uint112, uint120, uint128, uint136, uint144, uint152, uint160, uint168, uint176, uint184, uint192, uint200, uint208, uint216, uint224, uint232, uint240, uint248, uint256, var, void, ether, finney, szabo, wei, days, hours, minutes, seconds, weeks, years}, % types; money and time units + keywordstyle=[2]\color{teal}\bfseries, + keywords=[3]{block, blockhash, coinbase, difficulty, gaslimit, number, timestamp, msg, data, gas, sender, sig, value, now, tx, gasprice, origin}, % environment variables + keywordstyle=[3]\color{violet}\bfseries, + identifierstyle=\color{black}, + sensitive=true, + comment=[l]{//}, + morecomment=[s]{/*}{*/}, + commentstyle=\color{gray}\ttfamily, + stringstyle=\color{red}\ttfamily, + morestring=[b]', + morestring=[b]" +} + +\lstset{ + language=Solidity, + backgroundcolor=\color{verylightgray}, + extendedchars=true, + basicstyle=\footnotesize\ttfamily, + showstringspaces=false, + showspaces=false, + numbers=left, + numberstyle=\footnotesize, + numbersep=9pt, + tabsize=2, + breaklines=true, + showtabs=false, + captionpos=b +} + +%%% title page settings +\title[SWC-124]{% + SWC-124: Write to Arbitrary Storage Location +} +\subtitle{192.127 Seminar in Software Engineering (Smart Contracts)} +\author{Ivaylo Ivanov \& Peter Millauer} +\date{\today} + +%%% slides start here +\begin{document} + +% first frame must include the title page! +\begin{frame} + \titlepage +\end{frame} + +% table of contents if you have a long presentation (uses 'part' and 'section' +% elements) +\begin{frame}{Outline} + \tableofcontents +\end{frame} + +\section{Introduction} + +\subsection[SWC-124: Weakness Outline]{SWC-124: Weakness Outline} +\begin{frame}[fragile] + \frametitle{SWC-124: Weakness Outline} + SWC-124 is a weakness that allows attackers to write to places in the storage where they should not be able to. + It can be used to gain unauthorized access, overwrite data, steal funds etc. +\end{frame} + +\begin{frame}[fragile] + \frametitle{SWC-124: Weakness Outline} + We generally differentiate three types of SWC-124: +\begin{itemize} + \item unchecked array write + \item incorrect array length check + \item unchecked assembly code +\end{itemize} + + Examples follow, use in production at your own risk ;) +\end{frame} + +\subsection[Examples]{Examples} +\begin{frame}[fragile] + \frametitle{Unchecked Array Write} + \begin{lstlisting}[language=Solidity] +pragma solidity 0.4.25; + +contract MyContract { + uint[] private arr; + + constructor() public { + arr = new uint[](0); + } + + function write(unit index, uint value) { + arr[index] = value; + } +} + \end{lstlisting} +\end{frame} +\begin{frame}[fragile] + \frametitle{Incorrect Array Length Check} + \begin{lstlisting}[language=Solidity, basicstyle=\tiny\ttfamily, numberstyle=\tiny] +pragma solidity 0.4.25; + +contract MyContract { + uint[] private arr; + + constructor() public { + arr = new uint[](0); + } + + function push(value) { + arr[arr.length] = value; + arr.length++; + } + + function pop() { + require(arr.length >= 0); + arr.length--; + } + + function update(unit index, uint value) { + require(index < arr.length); + arr[index] = value; + } +} + \end{lstlisting} +\end{frame} +\begin{frame}[fragile] + \frametitle{Unchecked Assembly} + \begin{lstlisting}[language=Solidity, basicstyle=\tiny\ttfamily, numberstyle=\tiny, breaklines=true] +pragma solidity 0.4.25; + +contract MyContract { + address private owner; + mapping(address => bool) public managers; + + constructor() public { + owner = msg.sender; + setNextUserRole(msg.sender); + } + + function setNextManager(address next) internal { + uint256 slot; + assembly { + slot := managers.slot + sstore(slot, next) + } + bytes32 location = keccak256(abi.encode(160, uint256(slot))); + assembly { + sstore(location, true) + } + } + + function registerUser(address user) { + require(msg.sender == owner); + setNextManager(user); + } +} + \end{lstlisting} +\end{frame} + +\section{Detecting and Exploiting} +\subsection[Detecting SWC-124]{Detecting SWC-124} +\begin{frame}[fragile] + \frametitle{SWC-124: Detection Heuristics 1} + Any contract without dynamic arrays (or mappings with integer keys) or raw assembly including a SSTORE instruction can immediately be considered non-vulnerable. +\end{frame} + +\begin{frame}[fragile] + \frametitle{SWC-124: Detection Heuristics 2} + If heuristic 1 does not hold, we can then apply a second heuristic: checking the solidity compiler version, specified at the top of the contract. Solidity version 0.8.0+ introduced integer under- and overflow protection, which are enabled per default and require extra work to be disabled. +\end{frame} + +\begin{frame}[fragile] + \frametitle{SWC-124: Detection Heuristics 2.1} + If the version of the contract is higher than 0.8.0, we examine whether unchecked arithmetic has been used for modifying the arrays. If this is not the case, which it is not most of the time, we can then determine that the contract is non-vulnerable. Applying this heuristic, we found a contract that could have been vulnerable had it been compiled with a lower solidity version. + + \begin{block}{Note on assembly} + Due to the nature of the examples given, we could not find reliable heuristics for unchecked assembly. + \end{block} +\end{frame} + + +\begin{frame}[fragile] + \frametitle{SWC-124: Detection Tools} + \begin{itemize} + \item existing static analysis tools were useless - most of them had no support for SWC-124 + \item \texttt{solc-select} - for changing solidity compiler versions + \item \texttt{slither} - for printing contract variable layout + \end{itemize} +\end{frame} + +\subsection[Exploiting SWC-124]{Exploiting SWC-124} + +% TODO: Exploitation is trivial, should we just go back and explain or should we go into memory layout? Can we handle it in time? + +\begin{frame}[fragile] + \frametitle{Vulnerable Examples} + Using the previously mentioned heuristics, we could not find a vulnerable contract from the dataset. +\end{frame} + +\section{Future Work} +\begin{frame}[fragile] + \frametitle{Future Work} +\begin{itemize} + \item add heuristics to static analysis tool like \texttt{slither} or \texttt{mythril} + \item develop additional vulnerable and non-vulnerable contracts and test against heuristics + \item train a model against the resulting dataset + \item fine-tune heuristics +\end{itemize} +\end{frame} +\section{Conclusion} +\begin{frame}[fragile] + Questions? +\end{frame} + + +\end{document}