Software Security: Buffer Overflow Attacks Fall 2016 Adam (Ada) - - PowerPoint PPT Presentation

▶
software security
SMART_READER_LITE
LIVE PREVIEW

Software Security: Buffer Overflow Attacks Fall 2016 Adam (Ada) - - PowerPoint PPT Presentation

Oct 10, 2023 142 likes •559 views

CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks Fall 2016 Adam (Ada) Lerner lerner@cs.washington.edu Thanks to Franzi Roesner, Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, John

slide-1
SLIDE 1

CSE 484 / CSE M 584: Computer Security and Privacy

Software Security: Buffer Overflow Attacks

Fall 2016 Adam (Ada) Lerner lerner@cs.washington.edu

Thanks to Franzi Roesner, Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials ...

slide-2
SLIDE 2

Announcements

  • Sign the ethics form by today at 5!
  • Homework 1 is due on Monday.
  • Please start forming groups for lab 1

– You can use the forum to find group members

10/5/16 CSE 484 / CSE M 584 - Fall 2016 2

slide-3
SLIDE 3

Announcements

  • TA office hours have been moved to

Mondays at 4:30 (after class), in the second floor breakout.

– Sorry for the confusion!

10/5/16 CSE 484 / CSE M 584 - Fall 2016 3

slide-4
SLIDE 4

Security: Not Just for PCs

10/5/16 CSE 484 / CSE M 584 - Fall 2016 4

smartphones wearables game platforms cars medical devices EEG headsets voting machines RFID mobile sensing platforms airplanes

slide-5
SLIDE 5

Software Problems are Ubiquitous

10/5/16 CSE 484 / CSE M 584 - Fall 2016 5

slide-6
SLIDE 6

Software Problems are Ubiquitous

10/5/16 CSE 484 / CSE M 584 - Fall 2016 6

slide-7
SLIDE 7

Software Problems are Ubiquitous

10/5/16 CSE 484 / CSE M 584 - Fall 2016 7

slide-8
SLIDE 8

Software Problems are Ubiquitous

  • Other serious bugs (many others exist)

– US Vincennes tracking software – MV-22 Osprey – Medtronic Model 8870 Software Application Card

10/5/16 CSE 484 / CSE M 584 - Fall 2016 8

slide-9
SLIDE 9

Adversarial Failures

  • Software bugs are bad

– Consequences can be serious

  • Even worse when an intelligent adversary

wishes to exploit them!

– Intelligent adversaries: Force bugs into “worst possible” conditions/states – Intelligent adversaries: Pick their targets

10/5/16 CSE 484 / CSE M 584 - Fall 2016 9

slide-10
SLIDE 10

BUFFER OVERFLOWS

10/5/16 CSE 484 / CSE M 584 - Fall 2016 10

slide-11
SLIDE 11

Adversarial Failures

  • Buffer overflows bugs: Big class of bugs

– Normal conditions: Can sometimes cause systems to fail – Adversarial conditions: Attacker able to violate security of your system (control, obtain private information, ...)

10/5/16 CSE 484 / CSE M 584 - Fall 2016 11

slide-12
SLIDE 12

Reference for Q1

10/5/16 CSE 484 / CSE M 584 - Fall 2016 12

Text region Heap Stack

Addr 0x00...0 Addr 0xFF...F Top Bottom ret/IP Caller’s frame Addr 0xFF...F Saved FP

Execute code at this address after func() finishes

buf

Local variables

str

Args

slide-13
SLIDE 13

A Bit of History: Morris Worm

  • Worm was released in 1988 by Robert Morris

– Graduate student at Cornell, son of NSA chief scientist – Convicted under Computer Fraud and Abuse Act, sentenced to 3 years of probation and 400 hours of community service – Now an EECS professor at MIT

  • Worm was intended to propagate slowly and

harmlessly measure the size of the Internet

  • Due to a coding error, it created new copies as fast

as it could and overloaded infected machines

  • $10-100M worth of damage

10/5/16 CSE 484 / CSE M 584 - Fall 2016 13

slide-14
SLIDE 14

Morris Worm and Buffer Overflow

  • One of the worm’s propagation techniques was a

buffer overflow attack against a vulnerable version

  • f fingerd on VAX systems

– By sending special string to finger daemon, worm caused it to execute code creating a new worm copy – Unable to determine remote OS version, worm also attacked fingerd on Suns running BSD, causing them to crash (instead of spawning a new copy)

10/5/16 CSE 484 / CSE M 584 - Fall 2016 14

slide-15
SLIDE 15

Famous Internet Worms

  • Buffer overflows: very common cause of Internet attacks

– In 1998, over 50% of advisories published by CERT (computer security incident report team) were caused by buffer overflows

  • Morris worm (1988): overflow in fingerd

– 6,000 machines infected

  • CodeRed (2001): overflow in MS-IIS server

– 300,000 machines infected in 14 hours

  • SQL Slammer (2003): overflow in MS-SQL server

– 75,000 machines infected in 10 minutes (!!)

  • Sasser (2005): overflow in Windows LSASS

– Around 500,000 machines infected

10/5/16 CSE 484 / CSE M 584 - Fall 2016 15

slide-16
SLIDE 16

… And More

  • Conficker (2008-08): overflow in Windows RPC

– Around 10 million machines infected (estimates vary)

  • Stuxnet (2009-10): several zero-day overflows + same

Windows RPC overflow as Conficker

– Windows print spooler service – Windows LNK shortcut display – Windows task scheduler

  • Flame (2010-12): same print spooler and LNK overflows

as Stuxnet

– Targeted cyperespionage virus

  • Still ubiquitous, especially in embedded systems

10/5/16 CSE 484 / CSE M 584 - Fall 2016 16

slide-17
SLIDE 17

Attacks on Memory Buffers

  • Buffer is a pre-defined data storage area inside

computer memory (stack or heap)

  • Typical situation:

– A function takes some input that it writes into a pre- allocated buffer. – The developer forgets to check that the size of the input isn’t larger than the size of the buffer. – Uh oh.

  • “Normal” bad input: crash
  • “Adversarial” bad input : take control of execution

10/5/16 CSE 484 / CSE M 584 - Fall 2016 17

slide-18
SLIDE 18

Stack Buffers

10/5/16 CSE 484 / CSE M 584 - Fall 2016 18

  • Suppose Web server contains this function

void func(char *str) { char buf[126]; ... strcpy(buf,str); ... }

  • No bounds checking on strcpy()
  • If str is longer than 126 bytes

– Program may crash – Attacker may change program behavior

buf uh oh!

slide-19
SLIDE 19

Answer Q2

10/5/16 CSE 484 / CSE M 584 - Fall 2016 19

  • Suppose Web server contains this function

void func(char *str) { char buf[126]; ... strcpy(buf,str); ... }

  • No bounds checking on strcpy()
  • If str is longer than 126 bytes

– Program may crash – Attacker may change program behavior

buf uh oh!

slide-20
SLIDE 20

Example: Changing Flags

10/5/16 CSE 484 / CSE M 584 - Fall 2016 20

  • authenticated variable

buf authenticated 1 1 ( :-) ! )

slide-21
SLIDE 21

Example: Changing Flags

10/5/16 CSE 484 / CSE M 584 - Fall 2016 21

  • authenticated variable
  • Morris worm also overflowed a

buffer to overwrite an authenticated flag in fingerd

buf authenticated 1 1 ( :-) ! )

slide-22
SLIDE 22

Memory Layout

  • Text region: Executable code of the program
  • Heap: Dynamically allocated data
  • Stack: Local variables, function return addresses;

grows and shrinks as functions are called and return

10/5/16 CSE 484 / CSE M 584 - Fall 2016 22

Text region Heap Stack

Addr 0x00...0 Addr 0xFF...F Top Bottom

slide-23
SLIDE 23

Redirecting Program Flow

  • Instead of “normal” string, attacker

sends 2 things as input:

– Assembly code she wants to execute – The address where she expects that code to appear

10/5/16 CSE 484 / CSE M 584 - Fall 2016 23

slide-24
SLIDE 24

Redirecting Program Flow

  • Instead of “normal” string, attacker

sends 2 things as input:

– Assembly code she wants to execute – The address where she expects that code to appear

10/5/16 CSE 484 / CSE M 584 - Fall 2016 24

“Shellcode”

slide-25
SLIDE 25

Stack Buffers

  • Suppose Web server contains this func3on:

void func(char *str) { char buf[126]; strcpy(buf,str); }

  • When this func3on is invoked, a new frame

(ac3va3on record) is pushed onto the stack.

Allocate local buffer (126 bytes reserved on stack) Copy argument into local buffer

ret/IP Caller’s frame Addr 0xFF...F Saved FP

Execute code at this address after func() finishes

buf

Local variables

str

Args

10/5/16 CSE 484 / CSE M 584 - Fall 2016 25

slide-26
SLIDE 26

What if Buffer is Overstuffed?

  • Memory pointed to by str is copied onto stack…

void func(char *str) { char buf[126]; strcpy(buf,str); }

  • If a string longer than 126 bytes is copied into

buffer, it will overwrite adjacent stack locations.

strcpy does NOT check whether the string at *str contains fewer than 126 characters

This will be interpreted as return address!

ret/IP Caller’s frame Addr 0xFF...F Saved FP buf

Local variables

str

Args

10/5/16 CSE 484 / CSE M 584 - Fall 2016 26

slide-27
SLIDE 27

What if Buffer is Overstuffed?

  • What if the string is read in from an

attacker on the network?

This will be interpreted as return address!

ret/IP Caller’s frame Addr 0xFF...F Saved FP buf

Local variables

str

Args

10/5/16 CSE 484 / CSE M 584 - Fall 2016 27

slide-28
SLIDE 28

What if Buffer is Overstuffed?

exec(“/bin/sh”) asdf…asdf 0xFFFFFFA2

This will be interpreted as return address!

ret/IP Caller’s frame Addr 0xFF...F Saved FP buf

Local variables

str

Args

10/5/16 CSE 484 / CSE M 584 - Fall 2016 28

slide-29
SLIDE 29

Executing Attack Code

  • When func3on exits, code in the buffer will be

executed, giving aAacker a shell

– Root shell if the vic3m program is setuid root

ret/IP Saved FP buf Caller’s stack frame Addr 0xFF...F

Attacker puts actual assembly instructions into his input string, e.g., binary code of execve(“/bin/sh”)

exec(“/bin/sh”)

In the overflow, a pointer back into the buffer appears in the location where the system expects to find return address

Caller’s frame str

10/5/16 CSE 484 / CSE M 584 - Fall 2016 29

slide-30
SLIDE 30

Stretch Break

  • When func3on exits, code in the buffer will be

executed, giving aAacker a shell

– Root shell if the vic3m program is setuid root

ret/IP Saved FP buf Caller’s stack frame Addr 0xFF...F

Attacker puts actual assembly instructions into his input string, e.g., binary code of execve(“/bin/sh”)

exec(“/bin/sh”)

In the overflow, a pointer back into the buffer appears in the location where the system expects to find return address

Caller’s frame str

10/5/16 CSE 484 / CSE M 584 - Fall 2016 30

slide-31
SLIDE 31

Buffer Overflows can be Hard

  • Overflow portion of the buffer must contain

correct address of attack code in the RET position

– The value in the RET position must point to the beginning of attack assembly code in the buffer

  • Otherwise application will (probably) crash with

segmentation violation

– Attacker must correctly guess in which stack position his/her buffer will be when the function is called

10/5/16 CSE 484 / CSE M 584 - Fall 2016 31

slide-32
SLIDE 32

Problem: No Bounds Checking

  • strcpy does not check input size

– strcpy(buf, str) simply copies memory contents into buf starting from *str until “\0” is encountered, ignoring the size of area allocated to buf

  • Many C library functions are unsafe

– strcpy(char *dest, const char *src) – strcat(char *dest, const char *src) – gets(char *s) – scanf(const char *format, …) – printf(const char *format, …)

10/5/16 CSE 484 / CSE M 584 - Fall 2016 32

slide-33
SLIDE 33
  • strncpy(char *dest, const char *src, size_t n)

– If strncpy is used instead of strcpy, no more than n characters will be copied from *src to *dest

  • Programmer has to supply the right value of n
  • Potential overflow in htpasswd.c (Apache 1.3):

strcpy(record,user); strcat(record,”:”); strcat(record,cpw);

  • Published fix:

strncpy(record,user,MAX_STRING_LEN-1); strcat(record,”:”) strncat(record,cpw,MAX_STRING_LEN-1);

Does Bounds Checking Help?

10/5/16 CSE 484 / CSE M 584 - Fall 2016 33

Copies username (“user”) into buffer (“record”), then appends “:” and hashed password (“cpw”)

slide-34
SLIDE 34
  • strncpy(char *dest, const char *src, size_t n)

– If strncpy is used instead of strcpy, no more than n characters will be copied from *src to *dest

  • Programmer has to supply the right value of n
  • Potential overflow in htpasswd.c (Apache 1.3):

strcpy(record,user); strcat(record,”:”); strcat(record,cpw);

  • Published fix:

strncpy(record,user,MAX_STRING_LEN-1); strcat(record,”:”) strncat(record,cpw,MAX_STRING_LEN-1);

Answer Q3

10/5/16 CSE 484 / CSE M 584 - Fall 2016 34

Copies username (“user”) into buffer (“record”), then appends “:” and hashed password (“cpw”)

slide-35
SLIDE 35

Misuse of strncpy in htpasswd “Fix”

  • Published “fix” for Apache htpasswd overflow:

strncpy(record,user,MAX_STRING_LEN-1); strcat(record,”:”) strncat(record,cpw,MAX_STRING_LEN-1);

10/5/16 CSE 484 / CSE M 584 - Fall 2016 35

MAX_STRING_LEN bytes allocated for record buffer contents of *user

Put up to MAX_STRING_LEN-1 characters into buffer

:

Put “:”

contents of *cpw

Again put up to MAX_STRING_LEN-1 characters into buffer

slide-36
SLIDE 36

What About This?

  • Home-brewed range-checking string copy

void mycopy(char *input) { char buffer[512]; int i; for (i=0; i<=512; i++) buffer[i] = input[i]; } void main(int argc, char *argv[]) { if (argc==2) mycopy(argv[1]); }

  • 1-byte overflow: can’t change RET, but can change

pointer to previous stack frame

– On little-endian architecture, make it point into buffer – RET for previous function will be read from buffer!

10/5/16 CSE 484 / CSE M 584 - Fall 2016 36

slide-37
SLIDE 37

Off-By-One Overflow

  • Home-brewed range-checking string copy

void mycopy(char *input) { char buffer[512]; int i; for (i=0; i<=512; i++) buffer[i] = input[i]; } void main(int argc, char *argv[]) { if (argc==2) mycopy(argv[1]); }

  • 1-byte overflow: can’t change RET, but can change

pointer to previous stack frame

– On little-endian architecture, make it point into buffer – RET for previous function will be read from buffer!

10/5/16 CSE 484 / CSE M 584 - Fall 2016 37

This will copy 513 characters into

  • buffer. Oops!
slide-38
SLIDE 38

Frame Pointer Overflow

ret/IP Caller’s frame Addr 0xFF...F Saved FP buf

Local variables

str

Args

Fake RET Fake FP

ATTACK CODE

10/5/16 CSE 484 / CSE M 584 - Fall 2016 38

slide-39
SLIDE 39

Another Variant: Function Pointer Overflow

  • C uses function pointers for callbacks: if

pointer to F is stored in memory location P, then another function G can call F as (*P)(…)

10/5/16 CSE 484 / CSE M 584 - Fall 2016 39

attack code

Buffer with attacker-supplied input string Callback pointer

Heap

Legitimate function F

  • verflow

(elsewhere in memory)

slide-40
SLIDE 40

Other Overflow Targets

  • Format strings in C

– More details next time

  • Heap management structures used by

malloc()

– More details in section

  • These are all attacks you can look forward to

in Lab #1 J

10/5/16 CSE 484 / CSE M 584 - Fall 2016 40

slide-41
SLIDE 41

Looking Forward

  • Ethics form due at 5!
  • Homework #1 due Monday, Oct 10
  • Next few classes:

– Friday: guest lecture by David Aucsmith – Monday: more buffer overflows – Wednesday: guest lecture by Emily McReynolds

  • Section tomorrow about Lab 1

10/5/16 CSE 484 / CSE M 584 - Fall 2016 41