1. Gabe Kanzelmeyer CS 450 4/14/10

2.  What is buffer overflow?  How memory is processed and the stack  The threat  Stack overrun attack  Dangers  Prevention

3.  A buffer (array/string) that holds data  Buffer stored in memory (finite)  Example. char buffer[10] (sets aside buffer[0] – buffer[9]) Consider: buffer[10] = ‘A’; What will happen?

4.  Compiler detects out of bounds  Consider: buffer[i] = ‘A’;  What happens then?  Depends, cant identify problem until execution.

5. First two only effect the user. Malicious programmer focuses on accessing the second two.

6.  Text – program code  Data – global data  Stack and Heap – allocate at run-time  Stack - stores function arguments, local variables, values of selected registers

7.  When a procedure is called, the return address for function call, is put into the stack  Key importance for attacker  Overwrite the return address stored on the stack, upon termination of the procedure, it would be loaded into the EIP register (instruction counter), potentially allowing any overflow code to be executed.

8.  void f(int a, int b) { char buf[10]; } void main() { f(1, 2); }

9.  How to recognize where an attack may occur? Return address on stack Data on stack With this in mind lets consider the following…

10. #include char *code = "AAAABBBBCCCCDDD"; //including the character '\0‘ //size = 16 bytes void main() { char buf[8]; strcpy(buf, code); } -Frame address -Return address -overwritten Modified return address is pushed into instruction counter

11.  1. Discovering a code, which is vulnerable to a buffer overflow.  2. Determining the number of bytes to be long enough to overwrite the return address.  3. Calculating the address to point the alternate code.  4. Writing the code to be executed.  5. Linking everything together and testing

12. #include #define BUF_LEN 40 void main(int argc, char **argv) { char buf[BUF_LEN]; if (argv > 1) { printf(„\buffer length: %d\nparameter length: %d”, BUF_LEN, strlen(argv[1]) ); strcpy(buf, argv[1]); }

13.  Consider: victim.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAA If access violation error Try: victim.exe AAAABBBBCCCCDDDDEEEEFFFFGGGG………

14.  If successful, error message: “The instruction at “0x4b4b4b4b” referenced memory at “0x4b4b4b4b”. The memory could not be read. 0x4b is ASCII“K” Return address has been overwritten with KKKK

15.  From here you can do whatever you want Inject shell code to gain “super user” access Inject address to malicious code Use vulnerable system to exploit Denial of service attack

16.  Poor programming practices  Text/string manipulation functions strcpy() strcat() sprintf() gets() Etc…

17.  Library based defenses Re-implemented unsafe functions (Libsafe) Detects illegitimate code on the stack (SecureWave) Compiler based runtime boundaries