Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the...

26
Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown in gray. Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

TAGS:

Transcript of Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the...

Page 1: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Buffer Overflow Attacks

Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A

has been called. (c) Buffer overflow shown in gray.Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 2: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Avoiding Stack Canaries

Figure 9-22. Skipping the stack canary: by modifying len first, the attack is able to bypass

the canary and modify the return address directly.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 3: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Code Reuse Attacks

Figure 9-23. Return-oriented programming: linking gadgets

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 4: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Format String Attacks

Figure 9-24. A format string attack. By using exactly the right number of %08x, the attacker can use the first

four characters of the format string as an address.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 5: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Command Injection Attacks

Figure 9-25. Code that might lead to a command injection attack.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 6: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Back Doors

Figure 9-26. (a) Normal code. (b) Code with a back door inserted.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 7: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Login Spoofing

Figure 9-27. (a) Correct login screen. (b) Phony login screen.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 8: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Executable Program Viruses (1)

Figure 9-28. A recursive procedure that finds executable files on a UNIX system.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 9: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Executable Program Viruses (2)

Figure 9-28. A recursive procedure that finds executable files on a UNIX system.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 10: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Executable Program Viruses (3)

Figure 9-29. (a) An executable program. (b) With a virus at the front. (c) With a virus at the end. (d) With a virus spread over free space within

the program.Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 11: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Boot Sector Viruses

Figure 9-30. (a) After the virus has captured all the interrupt and trap vectors. (b) After the operating

system has retaken the printer interrupt vector. (c) After the virus has noticed the loss of the printer

interrupt vector and recaptured it.Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 12: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Actions Taken by Spyware (1)

1. Change the browser’s home page.2. Modify the browser’s list of favorite

(bookmarked) pages.3. Add new toolbars to the browser.4. Change the user’s default media

player.5. Change the user’s default search

engine.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 13: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Actions Taken by Spyware (2)

6. Add new icons to the Windows desktop.

7. Replace banner ads on Web pages with those the spyware picks.

8. Put ads in the standard Windows dialog boxes

9. Generate a continuous and unstoppable stream of pop-up ads.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 14: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Types of Rootkits (1)

Five kinds of rootkits – issue is where do they hide?1.Firmware rootkit2.Hypervisor rootkit3.Kernel rootkit4.Library rootkit5.Application rootkit

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 15: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Types of Rootkits (2)

Figure 9-31. Five places a rootkit can hide.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 16: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Firewalls

Figure 9-32. A simplified view of a hardware firewall protecting a LAN with three computers

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 17: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Virus Scanners (1)

Figure 9-33. (a) A program. (b) An infected program. (c) A compressed infected program. (d) An encrypted virus.

(e) A compressed virus with encrypted compression code.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 18: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Virus Scanners (2)

Figure 9-34. Examples of a polymorphic virus.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 19: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Code Signing

Figure 9-35. How code signing works.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 20: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Jailing

Figure 9-36. The operation of a jail.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 21: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Model-Based Intrusion Detection

Figure 9-37. (a) A program. (b) System call graph for (a).

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 22: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Sandboxing

Figure 9-38. (a) Memory divided into 16-MB sandboxes.

(b) One way of checking an instruction for validity.Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 23: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Interpretation

Figure 9-39. Applets can be interpreted by a Web browser.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 24: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Java Security (1)

Checks on applets include:1.Does applet attempt to forge pointers?

2.Does it violate access restrictions on private-class members?

3.Does it try to use variable of one type as another?

4.Does it generate stack overflows or underflows?

5.Does it illegally convert variables of one type to another?

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 25: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

Java Security (2)

Figure 9-40. Some examples of protection that can be specified with JDK 1.2.

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.

Page 26: Buffer Overflow Attacks Figure 9-21. (a) Situation when the main program is running. (b) After the procedure A has been called. (c) Buffer overflow shown.

End

Chapter 9

Tanenbaum & Bo, Modern Operating Systems:4th ed., (c) 2013 Prentice-Hall, Inc. All rights reserved.


Application Layer Attacksathena.ecs.csus.edu/~cookd/115/notes/CSC 115 - Summer... · 2018. 6. 30. · • Web application attacks • Client-side attacks • Buffer overflow attacks

Application Layer Attacksathena.ecs.csus.edu/~cookd/115/notes/CSC 115 - Summer... · 2018. 6. 30. · • Web application attacks • Client-side attacks • Buffer overflow attacks

Secure Cache: Run-Time Detection and Prevention of Buffer Overflow Attacks

Secure Cache: Run-Time Detection and Prevention of Buffer Overflow Attacks

Software Security: Buffer Overflow Attacks · Buffer Overflow Attacks (continued) Autumn 2020 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,

Software Security: Buffer Overflow Attacks · Buffer Overflow Attacks (continued) Autumn 2020 Franziska (Franzi) Roesner [email protected] Thanks to Dan Boneh, Dieter Gollmann,

Buffer Overflow Exploits

Buffer Overflow Exploits

Buffer Overflow

Buffer Overflow

A Buffer Overflow Study - Attacks and Defenses (2002)

A Buffer Overflow Study - Attacks and Defenses (2002)

BSI - Study A Penetration Testing ModelNetwork-based attacks include port scanning, IP spoofing, sniffing, session hijacking, DoS attacks, buffer overflow and format string attacks,

BSI - Study A Penetration Testing ModelNetwork-based attacks include port scanning, IP spoofing, sniffing, session hijacking, DoS attacks, buffer overflow and format string attacks,

Blended Attacks Exploits, Vulnerabilities and Buffer ... BLENDED ATTACKS EXPLOITS, VULNERABILITIES AND BUFFER-OVERFLOW TECHNIQUES IN COMPUTER VIRUSES √ Types of Vulnerability BUFFER

Blended Attacks Exploits, Vulnerabilities and Buffer ... BLENDED ATTACKS EXPLOITS, VULNERABILITIES AND BUFFER-OVERFLOW TECHNIQUES IN COMPUTER VIRUSES √ Types of Vulnerability BUFFER

1 Part 2: Attacks and Countermeasures u Vulnerabilities u System Attacks Virus, Trojan, Worm Buffer overflow Rootkit Zombies Web based attacks.

1 Part 2: Attacks and Countermeasures u Vulnerabilities u System Attacks Virus, Trojan, Worm Buffer overflow Rootkit Zombies Web based attacks.

The OWASP Top 10 and Buffer Overflow Attacks Tom Chothia Computer Security, Lecture 14.

The OWASP Top 10 and Buffer Overflow Attacks Tom Chothia Computer Security, Lecture 14.

Module 5: Buffer Overflow Attacks - Jackson State University

Module 5: Buffer Overflow Attacks - Jackson State University

Energy-Security Tradeoff in a Secure Cache Architecture Against Buffer Overflow Attacks

Energy-Security Tradeoff in a Secure Cache Architecture Against Buffer Overflow Attacks

Software Security: Buffer Overflow Attacks · 2020. 4. 6. · Buffer Overflow Attacks (continued) Spring 2020 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh,

Software Security: Buffer Overflow Attacks · 2020. 4. 6. · Buffer Overflow Attacks (continued) Spring 2020 Franziska (Franzi) Roesner [email protected] Thanks to Dan Boneh,

Buffer Overflow

Buffer Overflow

Blended attacks exploits, vulnerabilities and buffer overflow techniques in computer viruses

Blended attacks exploits, vulnerabilities and buffer overflow techniques in computer viruses

Buffer Overflow and Other Memory Corruption Attacks

Buffer Overflow and Other Memory Corruption Attacks

BLENDED ATTACKS EXPLOITS, VULNERABILITIES AND BUFFER-OVERFLOW TECHNIQUES IN COMPUTER VIRUSES

BLENDED ATTACKS EXPLOITS, VULNERABILITIES AND BUFFER-OVERFLOW TECHNIQUES IN COMPUTER VIRUSES

A buffer overflow study attacks and defenses (2002)

A buffer overflow study attacks and defenses (2002)

6/22/2015 C. Edward Chow CS591 Page 1. History of Buffer Overflow Attacks Buffer Overflow Attack and related Background Knowledge Linux VirtualMemory.

6/22/2015 C. Edward Chow CS591 Page 1. History of Buffer Overflow Attacks Buffer Overflow Attack and related Background Knowledge Linux VirtualMemory.

Buffer Overflow Attacks - University of Delawarecshen/367/notes/Buffer...exploiting a local buffer variable overflow vulnerability to override values of one or both of these key function

Buffer Overflow Attacks - University of Delawarecshen/367/notes/Buffer...exploiting a local buffer variable overflow vulnerability to override values of one or both of these key function