180 likes | 319 Views
Beyond stack smashing: recent advances in exploiting buffer overruns. Authors: J. Pincus and B. Baker from Microsoft Publish: IEEE Security & Privacy Magazine, 2004 Presenter: Jingfei Kong (04/06/2006). Overview. Three new techniques beyond the traditional “ stack smashing ” attack.
E N D
Beyond stack smashing: recent advances in exploiting buffer overruns Authors: J. Pincus and B. Baker from Microsoft Publish: IEEE Security & Privacy Magazine, 2004 Presenter: Jingfei Kong (04/06/2006)
Overview • Three new techniques beyond the traditional “stack smashing” attack
Result from Rapid Growth on Size and Complexity of Software Systems
Buffer Overflow– why? • No bounds checking for C/C++ • C/C++ • Type Casting, pointer arithmetic • Other languages • Pascal • No type casting, no pointer arithmetic and only same type assignment
Launch Attacks • Step One • Change the program’s control flow • Step Two • Execute some code • One exception • Security-critical variable data
Two important enhancements • Trampolining • pop/pop/…/ret • Transferring the code can be separated from buffer overflow operation which modifies the control flow
Arc Injection • Control flow transfer • Bypass • Non-executable stack • W^X mechanism
Pointer Subterfuge • Modify a pointer’s value
Pointer Subterfuge (cont.) Bypass LibSafe
Pointer Subterfuge (cont.) Bypass
Pointer Subterfuge (cont.) • Structured Exception Handling • Virtual Function Table • In all, they are all well-known structures at somehow well-known locations
Heap Smashing #define unlink(P, BK, FD) \ { \ BK = P->bk; \ FD = P->fd; \ FD->bk = BK; \ BK->fd = FD; \ }
Heap Smashing (cont.) • Difficulty • Don’t know the heap object’s location • Difficult to predict operations on heap objects
Twenty attack forms -- from John Wilander etc. • Buffer overflow on the stack all the way to the target: • (a) Return address • (b) Old base pointer • (c) Function pointer as local variable • (d) Function pointer as parameter • (e) Longjmp buffer as local variable • (f) Longjmp buffer as function parameter • Buffer overflow on the heap/BSS/data all the way to the target: • (a) Function pointer • (b) Longjmp buffer
Twenty attack forms (cont.) • Buffer overflow of a pointer on the stack and then pointing at target: • (a) Return address • (b) Base pointer • (c) Function pointer as variable • (d) Function pointer as function parameter • (e) longjmp buffer as variable • (f) longjmp buffer as function parameter • Buffer overflow of a pointer on the heap/BSS/data and then pointing at target: • (a) Return address • (b) Base pointer • (c) Function pointer as variable • (d) Function pointer as function parameter • (e) longjmp buffer as variable • (f) longjmp buffer as function parameter
References • Alpha One, “Smashing The Stack For Fun And Profit”http://www.phrack.org/ • John Wilander and Mariam Kamkar, "A Comparison of Publicly Available Tools for Dynamic Buffer Overflow Prevention” NDSS’03 • … more