Buffer Overflows: What They Are, and How to Avoid Them Ricardo J. - - PowerPoint PPT Presentation

▶
buffer overflows what they are and how to avoid them
SMART_READER_LITE
LIVE PREVIEW

Buffer Overflows: What They Are, and How to Avoid Them Ricardo J. - - PowerPoint PPT Presentation

Mar 12, 2024 318 likes •825 views

Buffer Overflows: What They Are, and How to Avoid Them Ricardo J. Rodr guez All wrongs reversed rj.rodriguez@unileon.es @RicardoJRdez www.ricardojrodriguez.es Research Institute of Applied Sciences in Cybersecurity University of

slide-1
SLIDE 1

Buffer Overflows: What They Are, and How to Avoid Them

Ricardo J. Rodr´ ıguez

All wrongs reversed

rj.rodriguez@unileon.es ※ @RicardoJRdez ※ www.ricardojrodriguez.es

Research Institute of Applied Sciences in Cybersecurity University of Le´

  • n, Spain

April 28, 2015 Mundo Hacker Day 2015 Madrid (Espa˜ na)

slide-2
SLIDE 2

$whoami

Ph.D. on Comp. Sci. (Univ. of Zaragoza, Spain) (2013) Senior Researcher at University of Le´

  • n (Spain)

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 2 / 19

slide-3
SLIDE 3

$whoami

Ph.D. on Comp. Sci. (Univ. of Zaragoza, Spain) (2013) Senior Researcher at University of Le´

  • n (Spain)

Performance and safety analysis on critical, complex systems Model-based security analysis Advanced malware analysis NFC security

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 2 / 19

slide-4
SLIDE 4

$whoami

Ph.D. on Comp. Sci. (Univ. of Zaragoza, Spain) (2013) Senior Researcher at University of Le´

  • n (Spain)

Performance and safety analysis on critical, complex systems Model-based security analysis Advanced malware analysis NFC security

Trainer at NcN, RootedCON, HIP Speaker at NcN, HackLU, RootedCON, STIC CCN-CERT, MalCON, HIP, HITB. . .

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 2 / 19

slide-5
SLIDE 5

What is a BOF? (I)

void readName () { char username [256]; printf("Username: "); scanf("%s", username ); }

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 3 / 19

slide-6
SLIDE 6

What is a BOF? (I)

void readName () { char username [256]; printf("Username: "); scanf("%s", username ); } void copyBuffers (char *org, char *dst) { char buffer [5000]; strcpy(buffer , org ); // Do some stuff into your buffer strcpy(dst , buffer); }

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 3 / 19

slide-7
SLIDE 7

What is a BOF? (I)

void readName () { char username [256]; printf("Username: "); scanf("%s", username ); } void copyBuffers (char *org, char *dst) { char buffer [5000]; strcpy(buffer , org ); // Do some stuff into your buffer strcpy(dst , buffer); }

Buffer Overflow (BOF)

Memory zone overflow

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 3 / 19

slide-8
SLIDE 8

What is a BOF? (I)

void readName () { char username [256]; printf("Username: "); scanf("%s", username ); } void copyBuffers (char *org, char *dst) { char buffer [5000]; strcpy(buffer , org ); // Do some stuff into your buffer strcpy(dst , buffer); }

Buffer Overflow (BOF)

Memory zone overflow It has consequences: Arbitrary code execution

Any code can be illegitimately forced to execute by an attacker (!)

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 3 / 19

slide-9
SLIDE 9

What is a BOF? (I)

void readName () { char username [256]; printf("Username: "); scanf("%s", username ); } void copyBuffers (char *org, char *dst) { char buffer [5000]; strcpy(buffer , org ); // Do some stuff into your buffer strcpy(dst , buffer); }

Buffer Overflow (BOF)

Memory zone overflow It has consequences: Arbitrary code execution

Any code can be illegitimately forced to execute by an attacker (!)

Is it used?

Common attack vector for malware

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 3 / 19

slide-10
SLIDE 10

What is a BOF? (II)

Anything else?

Causes DoS

Application ends unexpectedly (it crashes)

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 4 / 19

slide-11
SLIDE 11

What is a BOF? (II)

Anything else?

Causes DoS

Application ends unexpectedly (it crashes)

Wikipedia definition (overflow):

“a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer’s boundary and

  • verwrites adjacent memory. This is a special case of violation of

memory safety’ ’

Problem trending is growing

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 4 / 19

slide-12
SLIDE 12

What is a buffer overflow BOF? (III)

(Image source: www.cvedetails.com, date from 1999 to 2015) R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 5 / 19

slide-13
SLIDE 13

What is a BOF? (IV)

(Image source: www.cvedetails.com, date from 1999 to 2015) R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 6 / 19

slide-14
SLIDE 14

What is a BOF? (V)

Overflow types

Stack-based BOF

CPU stack: Local variables storage, procedure parameters. . . Control-flow execution data

Return addresses Exception handlers

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 7 / 19

slide-15
SLIDE 15

What is a BOF? (V)

Overflow types

Stack-based BOF

CPU stack: Local variables storage, procedure parameters. . . Control-flow execution data

Return addresses Exception handlers

Consequences: Control-flow hijacking → an attacker controls what is going to be executed

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 7 / 19

slide-16
SLIDE 16

What is a BOF? (V)

Overflow types

Stack-based BOF

CPU stack: Local variables storage, procedure parameters. . . Control-flow execution data

Return addresses Exception handlers

Consequences: Control-flow hijacking → an attacker controls what is going to be executed

Heap-based BOF

Overwriting of allocated memory (malloc, allocate)

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 7 / 19

slide-17
SLIDE 17

What is a BOF? (V)

Overflow types

Stack-based BOF

CPU stack: Local variables storage, procedure parameters. . . Control-flow execution data

Return addresses Exception handlers

Consequences: Control-flow hijacking → an attacker controls what is going to be executed

Heap-based BOF

Overwriting of allocated memory (malloc, allocate) Consequences: Memory corruption, code execution

. . .

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 7 / 19

slide-18
SLIDE 18

What is a BOF? (VI)

Overflow types

. . . Off-by-one

A loop takes (n − 1) steps instead of n steps Consequences: Control-flow register may be rewritten (1 byte)

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 8 / 19

slide-19
SLIDE 19

What is a BOF? (VI)

Overflow types

. . . Off-by-one

A loop takes (n − 1) steps instead of n steps Consequences: Control-flow register may be rewritten (1 byte)

Buffer Overrun

Bottleneck on memory blocks when using CD/DVD writers Buffer overflow → data is corrupted → CD/DVD useless

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 8 / 19

slide-20
SLIDE 20

What is a BOF? (VI)

Overflow types

. . . Off-by-one

A loop takes (n − 1) steps instead of n steps Consequences: Control-flow register may be rewritten (1 byte)

Buffer Overrun

Bottleneck on memory blocks when using CD/DVD writers Buffer overflow → data is corrupted → CD/DVD useless

Integer OF

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 8 / 19

slide-21
SLIDE 21

What is a BOF? (VI)

Overflow types

. . . Off-by-one

A loop takes (n − 1) steps instead of n steps Consequences: Control-flow register may be rewritten (1 byte)

Buffer Overrun

Bottleneck on memory blocks when using CD/DVD writers Buffer overflow → data is corrupted → CD/DVD useless

Integer OF

In this talk, we focus on Stack-based BOF

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 8 / 19

slide-22
SLIDE 22

What is a BOF? (VII)

char A[8]; unsigned short B;

Variable A: 8B (1 char → 1B) Variable B: 2B

No initialized

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 9 / 19

slide-23
SLIDE 23

What is a BOF? (VII)

char A[8]; unsigned short B;

Variable A: 8B (1 char → 1B) Variable B: 2B

No initialized

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 9 / 19

slide-24
SLIDE 24

What is a BOF? (VII)

char A[8]; unsigned short B;

Variable A: 8B (1 char → 1B) Variable B: 2B

No initialized

Let’s copy a string to A. . .

strcpy(A, "cadena");

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 9 / 19

slide-25
SLIDE 25

What is a BOF? (VII)

char A[8]; unsigned short B;

Variable A: 8B (1 char → 1B) Variable B: 2B

No initialized

Let’s copy a string to A. . .

strcpy(A, "cadena");

What is the memory content?

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 9 / 19

slide-26
SLIDE 26

What is a BOF? (VII)

char A[8]; unsigned short B;

Variable A: 8B (1 char → 1B) Variable B: 2B

No initialized

Let’s copy a string to A. . .

strcpy(A, "cadena");

What is the memory content? What if we copy a longer string?

strcpy(A, " cadena larga");

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 9 / 19

slide-27
SLIDE 27

What is a BOF? (VII)

char A[8]; unsigned short B;

Variable A: 8B (1 char → 1B) Variable B: 2B

No initialized

Let’s copy a string to A. . .

strcpy(A, "cadena");

What is the memory content? What if we copy a longer string?

strcpy(A, " cadena larga");

What is the memory content?

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 9 / 19

slide-28
SLIDE 28

What is a BOF? (VII)

char A[8]; unsigned short B;

Variable A: 8B (1 char → 1B) Variable B: 2B

No initialized

Let’s copy a string to A. . .

strcpy(A, "cadena");

What is the memory content? What if we copy a longer string?

strcpy(A, " cadena larga");

What is the memory content?

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 9 / 19

slide-29
SLIDE 29

What is a BOF? (VII)

char A[8]; unsigned short B;

Variable A: 8B (1 char → 1B) Variable B: 2B

No initialized

Let’s copy a string to A. . .

strcpy(A, "cadena");

What is the memory content? What if we copy a longer string?

strcpy(A, " cadena larga");

What is the memory content?

Overwriting adjacent memory locations

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 9 / 19

slide-30
SLIDE 30

Stack-based BOFs: From theory to practice (I)

Stack-based BOF

Stack space: Local variables storage

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 10 / 19

slide-31
SLIDE 31

Stack-based BOFs: From theory to practice (I)

Stack-based BOF

Stack space: Local variables storage Data to control execution flow

Return addresses Exception handlers

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 10 / 19

slide-32
SLIDE 32

Stack-based BOFs: From theory to practice (I)

Stack-based BOF

Stack space: Local variables storage Data to control execution flow

Return addresses Exception handlers

Consequences: control-flow hijacking → an attacker controls what is going to be executed

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 10 / 19

slide-33
SLIDE 33

Stack-based BOFs: From theory to practice (II)

Return to the classic BOF (CWE-120)

http://cwe.mitre.org/data/definitions/120.html “the program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the

  • utput buffer, leading to a buffer overflow.”

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 11 / 19

slide-34
SLIDE 34

Stack-based BOFs: From theory to practice (II)

Return to the classic BOF (CWE-120)

http://cwe.mitre.org/data/definitions/120.html “the program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the

  • utput buffer, leading to a buffer overflow.”

Common exploitable functions (C language)

strcpy(), strcat() scanf(), gets() printf() family: sprintf(), vsprintf(), . . .

https://security.web.cern.ch/security/recommendations/en/codetools/c.shtml R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 11 / 19

slide-35
SLIDE 35

void readCredentials () { /* Create an array for storing some dummy data */ char username [16]; printf("Enter your username for login , and then press <Enter >: "); scanf("%s", username ); printf("Hi %s, welcome back! Well coding!\n", username ); return; }

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 12 / 19

slide-36
SLIDE 36

void readCredentials () { /* Create an array for storing some dummy data */ char username [16]; printf("Enter your username for login , and then press <Enter >: "); scanf("%s", username ); printf("Hi %s, welcome back! Well coding!\n", username ); return; } LC0 : .ascii "Enter your username for login , and ... \0" LC1 : .ascii "%s\0" LC2 : .ascii "Hi %s, welcome back! Well coding !\12\0" .text _readCredentials : push ebp mov ebp, esp sub esp, 40 mov DWORD PTR [esp], OFFSET FLAT:LC0 call _printf lea eax, [ebp -24] mov DWORD PTR [esp +4], eax mov DWORD PTR [esp], OFFSET FLAT:LC1 call _scanf lea eax, [ebp -24] mov DWORD PTR [esp +4], eax mov DWORD PTR [esp], OFFSET FLAT:LC2 call _printf leave ret L1:

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 12 / 19

slide-37
SLIDE 37

void readCredentials () { /* Create an array for storing some dummy data */ char username [16]; printf("Enter your username for login , and then press <Enter >: "); scanf("%s", username ); printf("Hi %s, welcome back! Well coding!\n", username ); return; } LC0 : .ascii "Enter your username for login , and ... \0" LC1 : .ascii "%s\0" LC2 : .ascii "Hi %s, welcome back! Well coding !\12\0" .text _readCredentials : push ebp mov ebp, esp sub esp, 40 mov DWORD PTR [esp], OFFSET FLAT:LC0 call _printf lea eax, [ebp -24] mov DWORD PTR [esp +4], eax mov DWORD PTR [esp], OFFSET FLAT:LC1 call _scanf lea eax, [ebp -24] mov DWORD PTR [esp +4], eax mov DWORD PTR [esp], OFFSET FLAT:LC2 call _printf leave ret L1:

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 12 / 19

slide-38
SLIDE 38

void readCredentials () { /* Create an array for storing some dummy data */ char username [16]; printf("Enter your username for login , and then press <Enter >: "); scanf("%s", username ); printf("Hi %s, welcome back! Well coding!\n", username ); return; } LC0 : .ascii "Enter your username for login , and ... \0" LC1 : .ascii "%s\0" LC2 : .ascii "Hi %s, welcome back! Well coding !\12\0" .text _readCredentials : push ebp mov ebp, esp sub esp, 40 mov DWORD PTR [esp], OFFSET FLAT:LC0 call _printf lea eax, [ebp -24] mov DWORD PTR [esp +4], eax mov DWORD PTR [esp], OFFSET FLAT:LC1 call _scanf lea eax, [ebp -24] mov DWORD PTR [esp +4], eax mov DWORD PTR [esp], OFFSET FLAT:LC2 call _printf leave ret L1:

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 12 / 19

slide-39
SLIDE 39

void readCredentials () { /* Create an array for storing some dummy data */ char username [16]; printf("Enter your username for login , and then press <Enter >: "); scanf("%s", username ); printf("Hi %s, welcome back! Well coding!\n", username ); return; } LC0 : .ascii "Enter your username for login , and ... \0" LC1 : .ascii "%s\0" LC2 : .ascii "Hi %s, welcome back! Well coding !\12\0" .text _readCredentials : push ebp mov ebp, esp sub esp, 40 mov DWORD PTR [esp], OFFSET FLAT:LC0 call _printf lea eax, [ebp -24] mov DWORD PTR [esp +4], eax mov DWORD PTR [esp], OFFSET FLAT:LC1 call _scanf lea eax, [ebp -24] mov DWORD PTR [esp +4], eax mov DWORD PTR [esp], OFFSET FLAT:LC2 call _printf leave ret L1:

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 12 / 19

slide-40
SLIDE 40

void readCredentials () { /* Create an array for storing some dummy data */ char username [16]; printf("Enter your username for login , and then press <Enter >: "); scanf("%s", username ); printf("Hi %s, welcome back! Well coding!\n", username ); return; } LC0 : .ascii "Enter your username for login , and ... \0" LC1 : .ascii "%s\0" LC2 : .ascii "Hi %s, welcome back! Well coding !\12\0" .text _readCredentials : push ebp mov ebp, esp sub esp, 40 mov DWORD PTR [esp], OFFSET FLAT:LC0 call _printf lea eax, [ebp -24] mov DWORD PTR [esp +4], eax mov DWORD PTR [esp], OFFSET FLAT:LC1 call _scanf lea eax, [ebp -24] mov DWORD PTR [esp +4], eax mov DWORD PTR [esp], OFFSET FLAT:LC2 call _printf leave ret L1:

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 12 / 19

slide-41
SLIDE 41

It’s demo time!

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 13 / 19

slide-42
SLIDE 42

Mechanisms to Avoid Stack-based BOFs: Brief Summary

Stack Cookies (aka Stack Canaries)

Compiler flag (/GSswitch)

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 14 / 19

slide-43
SLIDE 43

Mechanisms to Avoid Stack-based BOFs: Brief Summary

Stack Cookies (aka Stack Canaries)

Compiler flag (/GSswitch)

SafeSEH / SEHOP (Structured Exception Handler Overwrite Protection)

Compiler flag (/safeSEH) (out of scope in this talk!)

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 14 / 19

slide-44
SLIDE 44

Mechanisms to Avoid Stack-based BOFs: Brief Summary

Stack Cookies (aka Stack Canaries)

Compiler flag (/GSswitch)

SafeSEH / SEHOP (Structured Exception Handler Overwrite Protection)

Compiler flag (/safeSEH) (out of scope in this talk!)

Data Execution Prevention (DEP) (aka Write or eXecute only mode, W ⊕ X)

Operating System / Architecture supported

Address Space Layout Randomization (ASLR)

Operating System / Compiler flag /DYNAMICBASE

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 14 / 19

slide-45
SLIDE 45

Conclusions (I)

Programming bugs may lead in exploitable BOFs Several protection mechanisms exist:

Compiler flags (/GS, /SafeSEH, /NXCOMPAT, /DYNAMICBASE) Operating System/Architecture (SEHOP, Hardware-DEP, ASLR) Commercial/Free third-party libraries (http://en.wikipedia.org/wiki/Buffer_overflow_protection)

Evasion techniques for these protections are well-known

Isolated: Makes the exploit process more difficult to achieve Combined: Better protection is guaranteed

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 15 / 19

slide-46
SLIDE 46

Conclusiones (II)

Take-Home Message

Code (and compile) safely!

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 16 / 19

slide-47
SLIDE 47

Conclusiones (II)

Take-Home Message

Code (and compile) safely!

Final recommendations

Make use of safe functions Compile with all available protection flags activated In all files!

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 16 / 19

slide-48
SLIDE 48

Further Readings

Corelan EWT, https://www.corelan.be/index.php/category/security/exploit-writing-tutorials/ Wikipedia, http://en.wikipedia.org/wiki/Buffer_overflow CVE details, http://www.cvedetails.com Practical Malware Analysis, M. Sikorski, A. Honig, NoStarch, 2012 Malware Analyst’s Cookbook, M.H. Ligh, S. Adair, B. Hartstein, M. Richard, Wiley, 2011 A Guide to Kernel Exploitation: Attacking the Core, E. Perla, M. Oldani, Elsevier, 2011 Software Security: Building Security In, G. McGraw, Addison Wesley, 2006 Reversing: Secrets of Reverse Engineering, E. Eilam, Wiley, 2005 The Art of Computer Virus Research and Defense, P. Szor, Addison Wesley, 2005

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 17 / 19

slide-49
SLIDE 49

Agenda

1

What is a buffer overflow (BOF)?

2

Stack-based BOFs: From theory to practice

3

Mechanisms to Avoid Stack-based BOFs

4

Conclusions

5

Further Readings

R.J. Rodr´ ıguez (ULE) Buffer Overflows: What They Are, and How to Avoid Them MHD’15 18 / 19

slide-50
SLIDE 50

Buffer Overflows: What They Are, and How to Avoid Them

Ricardo J. Rodr´ ıguez

All wrongs reversed

rj.rodriguez@unileon.es ※ @RicardoJRdez ※ www.ricardojrodriguez.es

Research Institute of Applied Sciences in Cybersecurity University of Le´

  • n, Spain

April 28, 2015 Mundo Hacker Day 2015 Madrid (Espa˜ na)