Buffer Overflow Exploits

A large number of exploits have been due to sloppy software development. Exceeding array bounds is referred to in security circles as "buffer overflow." These are by far the most common security problems in software. This lecture explains the stack-smashing technique, and presents a few techniques that help in avoiding the exploit.

1. I often give 3 to 5 (55-minute) lectures on this topic.
2. At least one on AlephOne.
3. Lecture #1: Overview, Background, Ideas on: {Code Injection, Detection, Prevention}
4. Lecture #2: Aleph One article, full exploration
5. Lecture #3: Aleph One article, full exploration; past videos of mine
6. Lecture #4: Experience the Exploit
7. Lecture #5: Exploring recent CVEs on Buffer Overflow
8. Coupled Topic: Software Development without Security Holes

1. End result: a super-user owned shell process is born
2. The enabling weaknesses
   1. data address space and executable code address space are not disjoint
   2. sloppy programming
3. Intricately depends on: PL, Compiler, OS, CPU
4. Arguably: The first security exploit (1988)
5. Arguably: The most common exploit
6. Arguably: The still prevalent exploit
7. Alt names: buffer overrun, stack smashing, code injection
8. Related exploits: heap overflow, format string exploit, …
9. Famous Buffer Overflow Attacks: https://engineering.purdue.edu/ResearchGroups/SmashGuard/BoF.html

1. Command line shells
   1. konsole + bash
   2. bash PS1 prompt
2. Details (semantics and compiled code) of C
   1. String library methods: strcpy, strcat
   2. Array bounds
   3. Effective address calculation
   4. Stack frame
   5. ./C-intricacies.html
   6. ../LinuxSetup/StudyPrograms/
3. OS Details
   1. System call: execv
   2. System call: exit
   3. setuserid suid root

1. The program is unmodified.
2. The running process is modified.
3. Modifying the return address (located on the stack)
4. Insert (effectively) new machine code sequence into the process
5. And return!

1. Putting it all together
2. Padding the Shell Code with NOPs so that jump target address is less critical
3. Inputting the shell code as an argument
4. ./AlephOne/alephOne.html One of the best exaplanation of Stack Smashing.

1. As of 2019, many "standard" code injections have been prevented.
2. Virtual Machines
   1. VirtualBox
   2. VMware
3. Linux Distro: (BackTrack) Audtor.ISO
   1. An Old OS/C-compiler/bash
   2. Uses IDE drives; so not bootable on modern PCs

1. Checking the caller of execv
2. Deep packet inspection
3. Tools: Chaperon, Valgrind, CCured, CRED, Insure++, ProPolice and TinyCC, …

1. CPU/MMU: Separate address spaces for Data and Machine Instructions
   1. noexec-user-stack
   2. Never-eXecute (NX) bit http://en.wikipedia.org/wiki/NX_bit
   3. Intel: XD bit, eXecute Disable
   4. AMD: Enhanced Virus Protection
   5. ARM: XN for eXecute Never
2. Stack top randomization
3. ASLR Address space layout randomization
4. Run-time Check for Input Taintedness
5. Run-time Check for Array Bounds

1. Lab on Buffer Overflow Exploits

1. Readings are grouped into Required and Recommended.
2. Required Readings are a must read. These are sources of exam questions.
3. Recommended Readings bring more insight into the topic. But exam questions will not be derived from these.
4. Some of our "readings" are actually web site visits.