View
212
Download
0
Category
Preview:
Citation preview
Buffer overflow 1
BUFFER OVERFLOWBUFFER OVERFLOW
Tsega Gebreyonas
Sunny Choi
CS 265
November 18, 2003
Buffer overflow 2
OverviewOverview
• The Basics
• Attacks exploiting buffer overflow
• Prevention and countermeasures
• Recent Case Studies
• Conclusion and Observations
Buffer overflow 3
Why Study Buffer Overflow?Why Study Buffer Overflow?
• Vulnerability since the 1970s
• “Computer vulnerability of the decade” 1
• Cause of at least half of all vulnerabilities found in Operating Systems
• Code Red worm, 2001
• Blaster worm, 2003
Buffer overflow 4
Basics of Buffer OverflowBasics of Buffer Overflow
• A “stuffing” of more data into a buffer than the allocated size.
• Two types:– corrupt the execution stack by writing past the
end of an array (aka. smashing the stack/ stack overflow)
– corrupt the heap (heap overflow)
Buffer overflow 5
How Does Buffer Overflow Happen?How Does Buffer Overflow Happen?
• Careless use of buffer without bounds check
• No automatic bounds checking for buffer in C/C++ programming languages
• Unsafe library function calls
• Off-by-one errors
• Old code used for new purposes
• Formatting and logic errors
Buffer overflow 6
Possible causes of buffer overflowPossible causes of buffer overflow
• Un-terminated strings can produce overflow
• Segmentation fault, crash
Buffer overflow 7
Process Memory OrganizationProcess Memory Organization
Text
Data
LowerMemoryaddresses
HigherMemoryaddresses
Process Memory Regions
Heap
Stack
Buffer overflow 8
• Text region– Fixed by the program– Includes code (instructions)– Read-only
• Data region– Contains initialized and un-initialized data– Static variables are stored here.
Text
Data
Heap
Stack
Buffer overflow 9
The StackThe Stack
Contains: – local variables for functions– Return address and local stack pointer– Used to
• Dynamically allocate the local variables used in functions.
• Pass parameters to functions.
• Return values from functions.
Buffer overflow 10
– Stack pointer (SP) points to the top of the stack.– The bottom of the stack is at a fixed address.– Consists of logical stack frames that are pushed
when calling a function and popped when returning.
– Frame pointer (FP) points to a fixed location within a frame.
Text
Data
Heap
Stack
Buffer overflow 11
Example stack.cExample stack.c
void function(int a, int b, int c) {char buffer1[5];
char buffer2[10];}void main() {
function(1,2,3);}
Buffer overflow 12
Example cont.. (1)Example cont.. (1)
• After ‘gcc –S –o stack.s stack.c’– See notes below
• Call function is translated topushl $3
pushl $2
pushl $1
call function
Buffer overflow 13
Example cont.. (2)Example cont.. (2)
– Its pushes the 3 arguments backwards into the stack.
– The instruction ‘call’ will push the EIP onto the stack.
• Procedure prologpush %ebp
mov %esp, %ebp
sub $20, %esp
Buffer overflow 14
Example cont.. (3)Example cont.. (3)
• pushes the FP onto the stack.• Copies the current SP onto EBP, make it the new
FP.• Allocates space for the local variables by
subtracting their size from SP.– Memory can only be addressed in multiples of the word
size.
– 5 byte buffer take 8 bytes (2 words).
– 10 byte buffer take 12 bytes (3 words).
– SP is subtracted by 20
Buffer overflow 15
c
b
a
ret
SFP
buffer1
buffer2
Stack
EBP
Buffer overflow 16
Principle of Stack OverflowsPrinciple of Stack Overflows
• When a program is run:– the next instruction address, ret, is stored on
the stack. – modifying this value in the stack forces the EIP
to get new value. So when the function returns, the program may execute the code (e.g. some shellcode) at this new address specified by overflowing the stack.
Buffer overflow 17
Principle of Stack Overflows cont..Principle of Stack Overflows cont..
• How to find where the ret is, to overwrite? – methods of improving chances
NOPs shellcode (or some code to execute)
repeated return address
buffer overflow with this – as long asret is overflowed with any part of this string,
shellcode will be executed
Buffer overflow 18
Stack Overflow ExampleStack Overflow Example
# include <stdio.h>void show_string(char * str2){ char buffer[5]; strcpy(buffer, str2); printf(“Your string is : %s\n”, buffer);}main (){ char str [10]; gets(str1); show_string(str1); exist (0);}
Buffer overflow 19
The HeapThe Heap
• Definition: contains memory that is dynamically allocated by the application
• Buffer overflow can happen here– Although more difficult to achieve than stack
overflows
Buffer overflow 20
User Exploits of Heap OverflowUser Exploits of Heap Overflow
• Overwrite:
- filenames
- passwords
- …
Manipulate:
- pointers
- function pointers
Buffer overflow 21
Principle of Heap OverflowsPrinciple of Heap Overflows
• Requires some preconditions to be met in the source code of the vulnerable binary: – a buffer must be declared (or defined) first.– a pointer must be declared.
Example:...
static char buf[BUFSIZE]; static char *ptr_to_something; ...
Buffer overflow 22
before overflow after overflow
sometmpfile.tmp /root/.rhosts
BUFFER
POINTER
BUFFER
POINTER
Buffer overflow 23
Heap Overflow ExampleHeap Overflow Example
#define BUFSIZE 16 #define OVERSIZE 8
int main() { u_long diff; char *buf1 = (char *)malloc(BUFSIZE), char *buf2 = (char *)malloc(BUFSIZE); diff = (u_long)buf2 - (u_long)buf1; printf("buf1 = %p, buf2 = %p, diff = 0x%x bytes\n", buf1, buf2, diff); memset(buf2, 'A', BUFSIZE-1), buf2[BUFSIZE-1] = '\0'; printf("before overflow: buf2 = %s\n", buf2); memset(buf1, 'B', (u_int)(diff + OVERSIZE)); printf("after overflow: buf2 = %s\n", buf2); return 0;
}
Buffer overflow 24
Heap Overflow Example ResultsHeap Overflow Example Results
[root /w00w00/heap/examples/basic]# ./heap1
buf1 = 0x804e000, buf2 = 0x804eff0, diff = 0xff0 bytes
before overflow: buf2 = AAAAAAAAAAAAAAA
after overflow: buf2 = BBBBBBBBAAAAAAA
Buffer overflow 25
Why Not “Fix” Buffer Overflow?Why Not “Fix” Buffer Overflow?
• 1000s of lines of legacy code running as root• To change and check cases is expensive• Trade off : security Vs “time to market”• Attitude : “If works …” no one cares• Traditional approach: get it to work first, then fix it.• Security is not easy to verify unless someone find issue
how do you figure what will be fault in the future• Lifecycle of buffer overflow:
– Vulnerability exploited– Patch that program-specific attack
Buffer overflow 26
Buffer Overflow CountermeasuresBuffer Overflow Countermeasures
• Write secure code (Golden Rule)
• Terminate strings and pass size of buffers to functions (e.g. use strncopy instead of strcopy etc)
• Careful Use of C/C++ Library Functions
• Don’t trust inputs (validate all inputs)
• Stack execute invalidate
• Dynamic run-time checks
Buffer overflow 27
Countermeasures cont..Countermeasures cont..
• Programming Languages– Automatically resize arrays (e.g. Perl, Java)– Detect and prevent buffer overflows. (e.g. Ada95, Java)– Use “C” only when speed/low level access is critical (almost all
OSs are written in C nowadays)
• Use advanced compiler tools such StackShield and StackGuard– Same principle for heap overflows
Whenever a function is called, a "canary" valueis pushed on the stack. This value ‘protects’ the return address.
a
ret
SFP
buffer1
canary
StackGuard
Some un-guessable value
Buffer overflow 28
Case StudiesCase Studies
• Code Red (I/II)
• Blaster– infected more than one million hosts over its
first 24 hours of life, according to one estimate
Buffer overflow 29
Code Red I/II, 2001 - EffectsCode Red I/II, 2001 - Effects
• July 19th: spread to 250,000 computers in only 9 hours
• Between the two worms, about 800,000 machines infected
• an estimated $2.5 billion in damages• defaced web sites• a failed attempt at a denial-of-service attack on
www.whitehouse.gov.
Buffer overflow 30
How Did Code Red Work?How Did Code Red Work?
• Exploited a buffer overflow vulnerability in Microsoft Internet Information Servers– attempts to connect to TCP port 80 on a randomly
chosen host – the attacking host sends a HTTP GET request to the
victim, attempting to exploit the buffer overflow in the Indexing Service
– If the exploit is successful, the worm begins executing on the victim host.
• The Code Red II worm exploited the very same vulnerability, except it installed a back door designed to make your entire hard drive available to attackers over the Internet.
Buffer overflow 31
Blaster, 2003Blaster, 2003
• exploited a vulnerability in Microsoft's DCOM RPC interface
• Execution:– Infect with worm– Add the executable to the registry so that it runs at
windows startup– Generates IP address and tries to infect another
computer with that IP address -60% random– Send data on TCP port 135 to exploit DCOM RPC
vulnerability• Impact:
– execute arbitrary code with Local System privileges– denial-of-service condition.
Buffer overflow 32
Microsoft ManhuntMicrosoft Manhunt
• November 5, 2003, Microsoft:– announces $250,000 reward in a worldwide
manhunt for the creator of Blaster.– Earmarks $4.5 million for bounties in future
attacks.
Buffer overflow 33
ConclusionsConclusions
• Buffer overflows exist and will continue to pose a real threat
• Tools can help (not solution)
• Best protection:– be a defensive and educated programmer; write
robust code in the first place
Buffer overflow 34
ReferencesReferences
• Aleph One, "Smashing The Stack For Fun And Profit," Phrack, Vol 7, Issue 49, File 14 of 16
• Howard M., LeBlanc D.,Writing Secure code, second edition, Microsoft Corporation, 2003
• Mark G. Graff, Kenneth R. Van Wyk, Secure Coding, O'Reilly & Associates, July 2003
• Matt Conover, and WSD, "w00w00 on Heap Overflows", January 1999, www.w00w00.org/ files/ articles/heaptut.txt
• Paul Festa, “Study says "buffer overflow" is most common security bug,” CNET News, November 23, 1999, http://news.com.com/2100-1001-233483.html?legacy=cnet
• Pierre-Alain Fayolle, “A Buffer Overflow Study Attacks and Defenses,” 2002, http://g0tr00t.mson.org/docs/nix/bof.html
• Sandeep Grover, “Buffer Overflow Attacks and Their Countermeasures,” Linux Journal, March 2003
Recommended