1. CIT 380: Securing Computer SystemsSlide #1 CIT 380: Securing Computer Systems Software Security

2. CIT 380: Securing Computer SystemsSlide #2 Topics 1.Why Software? 2.Vulnerability Databases 3.Buffer Overflows 4.Integer Overflows 5.Attack Techniques 6.Metasploit

3. CIT 380: Securing Computer SystemsSlide #3 The Problem is Software “Malicious hackers don’t create security holes; they simply exploit them. Security holes and vulnerabilities – the real root cause of the problem – are the result of bad software design and implementation.” John Viega & Gary McGraw

4. CIT 380: Securing Computer SystemsSlide #4 Why is Software Security poor? 1.Security is seen as something that gets in the way of software functionality. 2.Security is difficult to assess and quantify. 3.Security is often not a primary skill or interest of software developers. 4.Time spent on security is time not spent on adding new and interesting functionality.

5. CIT 380: Securing Computer SystemsSlide #5 The Trinity of Trouble Complexity –Continually increasing. –Windows 3.1 (3mloc) to Windows XP (40mloc) Extensibility –Plugins. –Mobile code. Connectivity –Network access. –Wireless networking.

6. CIT 380: Securing Computer SystemsSlide #6 Software Complexity 5-50 bugs per/kloc 8 –5/kloc: rigorous quality assurance testing (QA) –50/kloc: typical feature testing SystemLines of Code MS Word 952 million MS Windows 3.13 million Boeing 7777 million Space Shuttle10 million Netscape17 million MS Windows XP40 million

7. CIT 380: Securing Computer SystemsSlide #7 Vulnerabilities Vulnerability: A defect in software that allows security policy to be violated. –Confidentiality –Integrity –Availability Exploit: A program that exercises a vulnerability.

8. CIT 380: Securing Computer SystemsSlide #8 Vulnerability Databases Collect vulnerability reports. –Vendors maintain databases with patches for their own software. –Security firms maintain databases of vulnerabilities that they’ve discovered. Well known vulnerability databases –CERT –CVE –NVD –OSVDB

9. CIT 380: Securing Computer SystemsSlide #9 Why Vulnerability Databases? Know about vulnerabilities to software that you have deployed so you can mitigate them. Learn about vulnerability trends. If a JPG library bug is discovered, does the same type of bug exist in GIF or PNG libraries? Learn about security problems to prevent when you’re programming.

10. CIT 380: Securing Computer SystemsSlide #10 CVE: Common Vulnerabilities and Exposures Problem: Different researchers and vendors call vulnerabilities by different names. Solution: CVE, a dictionary that provides –A common public name for each vulnerability. –A common standardized description. –Allows different tools / databases to interoperate.

11. CIT 380: Securing Computer SystemsSlide #11 CVE-2002-1185 Name: CVE-2002-1185 Status: Entry Description: Internet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure." References VULNWATCH:20021211 PNG Deflate Heap Corruption Vulnerability BUGTRAQ:20021212 PNG Deflate Heap Corruption Vulnerability EEYE:AD20021211 MS:MS02-066 XF:ie-png-bo(10662) BID:6216 OVAL:oval:org.mitre.oval:def:393

12. CIT 380: Securing Computer SystemsSlide #12 NVD: National Vulnerability DB Collects all publicly available government vulnerability resources. HTML and XML output at http://nvd.nist.gov/ Uses CVE naming scheme. Links to industry and govt reports. Provides CVSS severity numbers. Links to OVAL repository.

13. CIT 380: Securing Computer SystemsSlide #13 Buffer Overflows A program accepts too much input and stores it in a fixed length buffer that’s too small. char A[8]; short B; AAAAAAAABB 0000000003 AAAAAAAABB overflows0 gets(A);

14. CIT 380: Securing Computer SystemsSlide #14 The Stack Stack is LIFO. Every function call allocates a stack frame. Return address is address where function was called from and will return to. Buffer 1 (Local Variable 1) Buffer 2 (Local Variable 2) Return Address Function Arguments Writes go up

15. CIT 380: Securing Computer SystemsSlide #15 Smashing the Stack Program accepts input into local variable 1. Attacker sends too much data for buffer, overwriting the return address. Attacker data contains machine code for shell. Return address overwritten with address of machine code. When function returns, attacker’s code is executed. Machine code exec(/bin/bash) Buffer 2 (Local Variable 2) Pointer to machine code. Function Arguments Writes go up

16. CIT 380: Securing Computer SystemsSlide #16 NOP Slide Attacker includes NOPs in front of executable code in case address isn’t precise. If pointer points at NOPs, execution will continue to machine code. IDS attempt to detect buffer overflows by looking for long strings of NOPs (x90). NOP Machine code exec(/bin/bash) Buffer 2 (Local Variable 2) Pointer to machine code. Function Arguments Writes go up

17. CIT 380: Securing Computer SystemsSlide #17 Integer Overflow An integer overflow is when integer operations produce a value that exceeds the computer’s maximum integer value, causing the value to “wrap around” to a negative value or zero.

18. CIT 380: Securing Computer SystemsSlide #18 32-bit Integer Quiz 1.What two non-zero integers x and y satisfy the equation x * y = 0? 2.What negative integer (-x) has no corresponding positive integer (x)? 3.List two integers x and y, such that x + y < 0.

19. CIT 380: Securing Computer SystemsSlide #19 Quiz Answers 1.65536 * 65536 = 0 or 256 * 16777256 = 0 or any x * y = 2 32 2. -2147483648 3.2147483647 + 1 = -2147483648

20. CIT 380: Securing Computer SystemsSlide #20 Are Integer Overflows Important? Broward County November 2004 election –Amendment 4 vote was reported as tied. –Software from ES&S Systems reported a large negative number of votes. –Discovery revealed that Amendment 4 had passed by a margin of over 60,000 votes.

21. CIT 380: Securing Computer SystemsSlide #21 Fuzz Testing Black-box input based testing technique. –Uses random data. –Easily automated. –If application crashes or hangs, it fails. Results of 1995 study 9. –15-43% of utilities from commerical UNIX systems failed. –9% of Linux utilities failed. –6% of GNU utilities failed. –50% of X-Windows utilities failed.

22. CIT 380: Securing Computer SystemsSlide #22 Metasploit Modular exploit system –Exploit collection: over 100 exploits. –Payloads: machine code to run –Command line and web interfaces. Payloads –Bind shell: opens shell backdoor on port. –Reverse shell: send shell back to attacker. –Windows VNC: remote desktop access. –Create user: add new administrative user.

23. Metasploit http://www.metasploit.com/ CIT 380: Securing Computer SystemsSlide #23

24. CIT 380: Securing Computer SystemsSlide #24 Using Metasploit 1.Select an exploit use exploit_name 2.Enter the target set RHOST ip_address_of_target 3.Select the payload set payload payload_name set LHOST ip_address_of_your_host 4.Run exploit

25. CIT 380: Securing Computer SystemsSlide #25 Advantages of Metasploit Ease of use –One interface to many exploits. Flexibility –Can choose whatever payload you need. Faster development time –Payloads already written. Reliability –Framework and payloads are well tested.

26. CIT 380: Securing Computer SystemsSlide #26 Uses of Metasploit Vulnerability verification –Scanners report possible vulnerabilities. –Metasploit will give you remote access. IDS/IPS testing –Test IDS/IPS with real exploit code. Penetration testing –Easy to develop custom exploits for pen testing. Convincing management –Remote access is more convincing than a report.

27. CIT 380: Securing Computer SystemsSlide #27 References 1.Matt Bishop, Introduction to Computer Security, Addison-Wesley, 2005. 2.Simson Garfinkel, Gene Spafford, and Alan Schartz, Practical UNIX and Internet Security, 3 rd edition, O’Reilly & Associates, 2003. 3.Mark Graff and Kenneth van Wyk, Secure Coding: Principles & Practices, O’Reilly, 2003. 4.Greg Hoglund and Gary McGraw, Exploiting Software: How to Break Code, Addison-Wesley, 2004. 5.Michael Howard, David LeBlanc, and John Viega, 19 Deadly Sins of Software Security, McGraw-Hill Osborne, 2005. 6.Michael Howard, David LeBlanc, Writing Secure Code, 2 nd edition, Microsoft Press, 2003. 7.Michael Howard and Steve Lipner, The Security Development Lifecycle, Microsoft Press, 2006. 8.Gary McGraw, Software Security, Addison-Wesley, 2006. 9.John Viega and Gary McGraw, Building Secure Software, Addison-Wesley, 2002. 10.David Wheeler, Secure Programming for UNIX and Linux HOWTO, http://www.dwheeler.com/secure-programs/Secure-Programs- HOWTO/index.html, 2003. http://www.dwheeler.com/secure-programs/Secure-Programs- HOWTO/index.html