Buffer Overflows

Lesson 14

Example of poor programming/errors

• Buffer Overflows• result of poor programming practice

• use of functions such as gets and strcpy– these don’t check input for boundaries

• may allow individual to gain root or admin access

• Easy to do in any programming language…what is the real problem?

What is a buffer overflow?

• “A buffer overflow attack is when an attacker tries to store too much information in an undersized receptacle.”

• “A common implementation is when a user of the program gives the program more data than the developers of the program allocated to store it.”

Exploits

• Buffer Overflows• fingerd, statd, talkd, …• result of poor programming practice

• Shell Escapes• special character in input string causes escape to

shell

Buffer Overflow Example

#include <stdio.h>#include <string.h>

void func(char *p){ char stack_temp[20]; strcpy(stack_temp, p); printf(stack_temp);}

int main(int argc, char* argv[]){ func(“I AM MORE THAN TWENTY CHARACTERS LONG!”); return 0;}

Buffer Overflows

Program

Execute A

Return

Subroutine A

Read Variable

Data

Process Stack

Return Addr

Buffer Overflows

Program

Execute A

Return

Subroutine A

Read Variable

Data

Process Stack

Return AddrNew Addr

Another Routine

Buffer Overflows

Program

Execute A

Return

Subroutine A

Read Variable

Data

Process Stack

Return AddrNew Addr

Machine Code

Types of buffer overflow attacks

• Denial of service – buffer overflow will cause the system to “crash”• Since important information needed by the OS to

continue running can be located on the stack, by overflowing with enough data you can wipe out this important information.

• Execution of code that the attacker chooses to run.• Overwrite just the right amount of information to

overflow the stack and rewrite the return address pointer.

• Do this right and you can point to your own code.

Buffer Overflows (cont)

• “A key point to remember is that the attacker’s code will run at whatever privileges the software that is exploited is running at.”

• “In most cases, an attacker tries to exploit programs that are running as a privileged account such as root or domain administrator.”

Protection against buffer overflow attacks

• Close the port or service• Best way to protect yourself is to remove SW that is

subject to an overflow.• If this SW is installed by default, close ports and

remove service.

• Rule of thumb: “Know what is installed on your systems and have the least amount of services running and ports open that are required for the system to operate in a specific environment.”

Protection

• Apply the vendor’s patch or install the latest version of the software.• Usually shortly after a buffer overflow

vulnerability is discovered the vendor will develop and release a patch.

• This fixes the problem as opposed to just minimizing exposure.

Protection

• Filter specific traffic at the firewall.• Block the traffic of the vulnerable software at

the firewall.• This will restrict the ability of external attackers

to exploit the vulnerability.• Does not prevent an insider from exploiting the

vulnerability, just limits the exposure.

Prevention

• Test key applications.• Take a proactive approach and attempt to find

buffer overflow exploits yourself.• Not practical for all applications but for key ones it

is.

Prevention

• Run Software at the Least Privilege Required• Often system administrators will install and

configure applications as root. • Quick an easy to ensure they have access to what

they need.• Also easy way to guarantee system is vulnerable if

buffer overflow exploit is discovered in one of the applications since it will execute code as root.