1. A Buffer Overflow Example João Paulo Magalhães (jpm@estgf.ipp.pt)April 2009

2. Buffer Overflow 2

3. Buffer Overflow – A simple program 3

4. 4 Our goal is to execute the hack() function Could be worst!

5. Buffer Overflow – Internal aspects of the program 5 Stack before the scanf call Stack after the scanf call print_it() and hack() functions addresses

6. Buffer Overflow – Running the program 6 The code of ‘A’ is 0x41!

7. Buffer Overflow – The x86 stack 7 Call parameters Return Address %EBP register Preserve original register values Make space for local variables in subroutines %ESP Stack Pointer (32 bits) Ends of the stack Stack Frame (currently) Stack Frame (Of who calls the subroutine)

8. Buffer Overflow – The attack 8 Call parameters Return Address %EBP register Preserve original register values Make space for local variables in subroutines Buffer s stays here Ends of the stack Stack Frame (currently) Stack Frame (Of who calls the subroutine) Write chars until change the return address

9. Buffer Overflow – Running once more 9 We want to put this address here

10. Buffer Overflow – The attack 10

11. Buffer Overflow – The attack 11 It’s used a String larger than s buffer is expecting and that stays over the return value The return address was changed Mallicious code

12. Buffer Overflow – But where came from the hack() function?? 12 Usually buffers don’t have enought space to store all the code that is going to be executed (i.e. s[] buffer does not have enought space to the binary code of hack()), so we only need to make the program to read data from someplace, and store it in a way that is possible to locate it later. In this case is just necessary to make the returning address point to the right location (e.g., a image!)

13. Buffer Overflow – But... 13 Hackers could not have access to the source code to discover the buffer sizes... It’s very easy to incrementally enlarge the input data until a crash occur. This way, the buffer size is discovered.

14. Buffer Overflow – The correct code 14 Don’t use “insecure functions”, or when it’s absolutely necessary to use them special cares are needed. E.g., gets()/fgets() scanf()/fscanf() strcat()/strcpy()...

15. Bibliography 15

16. Credits... 16 Paulo Marques Departamento de Eng. Informática Universidade de Coimbra pmarques@dei.uc.pt The original (and Portuguese) version of these presentation belongs to Professor Paulo Marques