Embedded Security Stefan Nürnberger

As we will most likely not finish correction until the office hour tomorrow, we decided to move the exercise discussion to Thursday next week (July 19th). There will be a regular office hour tomorrow to ask questions.

Also, a short reminder that the hardware needs to be returned at the latest on Monday, July 16th. If no one in your team is able to make it, please hand it back during the office hours tomorrow. If both dates do not fit, write a Mail to Simeon with an appointment suggestion (before July 16th).

The new exercise is now online in the CMS. In case you downloaded the premature version earlier, please redownload.

Also, please return your hardware next week on Monday. If no one of your team is able to make it, please return your hardware during the office hours on Thursday between 4 and 6 pm. If neither appointment fits for you, please write an email to Simeon with another time slot that fits your schedule (the time slot needs to be before Monday, July 16th).

Please note that we will not accept incomplete hardware sets ("We'll bring the rest later.") or late returns.

The slides for last week will be uploaded later today. Note that as announced in the lecture last week and this week, slides for today's lecture will not be published. Consequently, they are not relevant for the exam and the exercises.

Due to the unavailability of our usual room for the office hour, it takes place in room 2.22 today.

Also small reminder that you may not use command line tools to measure the integrity of your files in the current task.

You may also not use your C code as a wrapper to the already existing programs (like for example the preexisting flushcontext program in the TSS).

This approach will not yield any points. You may of course look at the source code of such programs and implement your task similarly.

Have fun!

We were told that some of you asked for help and missed the office hour in the lecture hall. We therefore offer an extra small office hour tomorrow, friday the 29.7.18, between 4:15pm and 5:00pm in E9.1 2.21.

As a reminder, the office hours on thursdays after a submission was closed are held in the lecture hall and recap the solution of the last exercise sheet.

We will hand out new hardware in the lecture on Monday for the new exercise, so please make sure that at least one person will be claiming the new hardware.

In return, we will collect the ESP32 controller that you got for the exercise this week, so please bring it to the lecture on Monday.

We handed out new hardware today in the lecture. If no member of your team is able to make it, you will be able to fetch it in the office hour of this week.

We expect you to own a functional micro USB cable for the new hardware. If neither member of your team does have such a cable, please write a message to the tutors. We do not have many of these, so please only take a cable from us if there is no other way for you to get one.

It has brought to our attention that there was a small mistake in the provided code for exercise 2. This is now fixed on the hardware and the updated sheet is online. You may want to check if your attack still works, but if you implemented a correct bufferoverflow as stated in the exercise, nonthing should change.

The third exercise sheet is now online. The lecture will be uploaded later today.

Information for exerise 1: You need to be in the same /24 subnet ip range as the arduino, hence any 192.168.1.x ip should do.

Also, make sure that the ID of the CAN frame you send to the arduino is exactly 3 characters long.

There was a small but decisive fix in the exercise. You may want to redownload the exercise.

The points for exercise 2 are online now.

The overall schedule of the course changes a little bit: instead of office hour every week, we will offer a tutorial in the week after you submitted an exercise in the office hour slot. In this tutorial, we will discuss the solution of the most recent exercise sheet. This tutorial takes place in the lecture hall. This new schedule starts immediately, hence there will be a tutorial tomorrow at 4 pm in the lecture hall.

As you might need building access for future exercises again, please send your card id (the number in the top left of your UDS card) in a mail to one of the tutors if you do not have building access already. Make sure that it is a 17-digit number, as the older cards (less digits) are not supported for granting building access. If you have such an old card, you can change it to the newer model at campus center. It should be free of charge if you mention that you need access to the CISPA building.
 

Exercise 2:

We acknowledge that the second task from the current exercise is out of scope for this course (too hard). Hence we change the evaluation of this exercise: you will get up to full points for this exercise if you can present an approach that will lead you to the result and that shows that you understood the problem. You DO NOT need the secret to receive full points for this exercise. However if you managed to extract the secret and can present how you did it, you will be awarded 5 bonus points.

Lecture next week:
There will be no lecture next week and thus no new exercise sheet. Please note that the current deadline IS NOT extended.

Next week on monday (a holiday), there will be a video upload with a new lecture and a new exercise sheet. You have the full two weeks to work on this exercise sheet.