Software(runtime) attacks

English for Computer Science II

Software(Runtime) AttacksAmir Neziri & Jurlind Budurushi

Source: [6]

Where do we use Software Attacks?(1)

5/12/2011 | Department 20 | B. IT Nieh | Software(Runtime) Attacks | A. Neziri & J. Budurushi 2

Internet(confidentiality, anonymity, authentication)

Overview - Software Attacks

OWASP Top 10 for 2010 A1: Injection A2: Cross-Site Scripting (XSS) A3: Broken Authentication and Session Management A4: Insecure Direct Object References A5: Cross-Site Request Forgery (CSRF) A6: Security Misconfiguration A7: Insecure Cryptographic Storage A8: Failure to Restrict URL Access A9: Insufficient Transport Layer Protection A10: Unvalidated Redirects and Forwards



e-voting



Bank Card payment



TV decoder


Overview of Software(Runtime) Attacks

Buffer Overflows (BO) Stack Smashing, Heap Overflow, Integer Overflow, Format String

Return-into-Libc

Return-Oriented Programming (ROP)

Return-Oriented Programming without Returns


Content

Buffer Overflows (BO) Stack Smashing

Return-Oriented Programming (ROP)

Live Demo Buffer Overflow


We present…

Buffer Overflow Attack


BO Vulnerabilities: Statistics


Still a major threat (e.g. in Internet Explorer or Acrobat Reader, etc.)

Source: [6]

The Stack Frame


Source: [6]

The Stack Frame (cntd.)

Stack is a last in, first out (LIFO) memory Stack Pointer (SP) points to the top word on the stack

The stack can be accessed by two basic operations Push & Pop elements onto the stack (SP is decremented/

incremented)

Stack is divided into following segments: Function arguments Return address Saved Base Pointer Local variables


Vulnerable program

Simple Echo program suffering from a stack overflow vulnerability


Source: [6]

Buffer Overflow

Attack Example


(1) Program starts


Source: [6]

(2) The echo() function is called


Source: [6]

(3) Call instruction pushes return address onto the stack


Source: [6]

(4) Allocation of saved base pointer and buffer


Source: [6]

(5) echo() calls gets(buffer) function


Source: [6]

(6) Adversary transmits malicious code


Source: [6]

(7) Malicious code contains shellcode, pattern bytes, . . .


Source: [6]

(8) . . . , and a new return address


Source: [6]

(9) Before echo() returns to main, SP is updated


Source: [6]

(10) echo() issues return resulting in execution of shellcode


Source: [6]

BO - Countermeasures

W xor X

ASRL – Address Space Layout Randomization

Compiler Extensions

Stack shadowing

Run up to date software

Use security software (Firewall, Anti-Virus, Anti-spyware…)


ROP – The Big Picture


Source: [6]





Source: [6]

ROP – Architectures


ROP attacks are applicable on broad range of architectures: Intel x86

The SPARC Machine

Atmel AVR

Z80 Voting Machines

PowerPC

ARM

ROP – General idea


Use small instruction sequences instead using whole functions

Instruction sequences range from 2 to 5 instructions

All sequences end with a “ret” instruction

Instruction sequences are chained together in a gadget

A gadget performs a particular task (e.g load/store, xor...)

Combine more gadgets for the desiered actions

ROP

Attack Example


ROP – Waiting for input from user


Source: [6]

ROP – Attacker overflows the buffer


Source: [6]

ROP – Input contains ret-addresses and one argument


Source: [6]

ROP – 1st sequence is executed


Source: [6]

ROP – „ret“ instruction transfers control


Source: [6]

ROP – Transfers control from 2nd to 3rd instruction


Source: [6]

ROP – POP argument from stack


Source: [6]

ROP – „ret“ has been reached


Source: [6]

ROP – Transfers control from 3rd to 4th instruction


Source: [6]

ROP – Transfers control from 1st gadget to the 2nd


Source: [6]

ROP – Transfers control from 1st sequence to the 2nd


Source: [6]

ROP - Countermeasures

Compiler based solutions Canary before the ret-address, shadow stack Problem: not able to detect unintended instruction sequences

Hardware based solutions HW to enforce ret-address protection Problem: requieres new/specific hardware

Dynamic Binary Instrumentation based on a JIT-Compiler Allows detection of unintended instruction sequences Problem: high performance overhead


Live Demo & Discussion

Buffer Overflow Attack


Questions???



References

[1] https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project [2] Stephen Checkoway, Ariel J. Feldman, Brian Kantor, J. Alex Halderman,

Edward W. Felten, and Hovav Shacham. Can DREs provide long-lasting security? The case of return-oriented programming and the AVC advantage. In Proceedings of EVT/WOTE 2009, 2009. http://www.youtube.com/watch?v=lsfG3KPrD1I

[3] Aleph One. Smashing the stack for fun and prot. Phrack Magazine, 49(14), 1996.

[4] PaX Team. PaX address space layout randomization (ASLR). http://pax.grsecurity.net/docs/aslr.txt

[5] Hovav Shacham. The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86). In CCS '07: Proceedings of the 14th ACM Conference on Computer and Communications Security, pages 552-561. ACM, 2007.

[6] http://www.trust.informatik.tu-darmstadt.de/fileadmin/user_upload/Group_TRUST/LectureSlides/Chapter02%20-%20RuntimeAttacks.pdf


Date post:	08-Jun-2015
Category:	Spiritual
Upload:	amir-neziri
View:	2,178 times
Download:	2 times

Software(runtime) attacks

Spiritual