1. Buffer Overflow By: John Quach and Napoleon N. Valdez

2. Buffer Overflow Basics Allocate more data into a program than it was designed to support Data that overflow to another region of the memory could be fatal No outbound checking in C++/C/Fortran

3. What is a buffer? A memory space allocated for used during execution. Frame of function void function(int a, int b) { char buffer1[5]; } void main() { function(1,2); } b a ret SFP buffer1

4. Simple Buffer Overflow Example Show example Static Variables ret SFP buffer1 A A A A A A A A A A A A B D C E

5. What happened? function is called and parameter “AAAAAAAAAAAABCDE?” was passed Since strcpy() does not check string’s length, the function call caused a the buffer to overflow

6. Why is BO so dangerous? Buffer can grow towards return address Malicious code could be executed at the new address

7. Example DEEEEEEEEEEEE EEEE FFFF FFFF FFFF FFFF F0123456789AB CDEF 0123 4567 89AB CDEF buffer sfp ret a b c [MALICIOUSPRO][GRAM][0xDF][0x01][0x02][0x03] ^ | |____________________| Exploit a program to execute a malicious program

8. Buffer Overflow Exploit Example Analyst crackme named weird.exe Run the program and guess the serial Find the correct serial using buffer overflow

9. Past BO exploits Morris Internet worm Code Red worm 2001 Blaster worm 2003 Internet Information Server (IIS) Many more

10. How to Prevent Buffer Overflow Always check bounds Avoid scanf() and other dangerous library function call Use strncpy instead Automatic source code checking www.polyspace.com (Linux only) www.polyspace.com Compiler add-ons www.immunix.org

11. Conclusion Buffer Overflow is simply manipulating memory to gain control of a program Buffer Overflow is hard to successfully execute Hard to fix

12. Reference Chuvakin, Anton and Peikari, Cyrus. Security Warrior. Reilly Associates Inc, 2004. pp.161-175 One, Aleph, "Smashing The Stack For Fun And Profit," Phrack, Vol 7, Issue 49, File 14 of 16