1. Stack-Based Buffer Overflows Attacker – Can take over a system remotely across a network. local malicious users – To elevate their privileges and gain super user access to a system. Exploit the way OS handle their – Stack : an internal data structure used by running programs to store data temporarily. – Pushing on the stack. Local variables – used by the function Return address – used by the system to resume execution

2. Stack-Based Buffer Overflows

3. OS: UNIX + Windows systems – Have a stack that can hold data and executable code. Poor Code – Exploited to overrun the boundaries of the local variables on the stack. Input length – Not examined by the code – A particular variable on the stack may exceed the memory allocated to it on the stack – Overwriting variables return address. Smashing the stack – Allows an attacker to overflow the local variables to insert executable code (usually a shell routine) and another return address on the stack.

4. Example void function(int a, int b, int c){ char buffer1[5]; char buffer2[10]; } int main(){ function(1,2,3); }

5. Activation Record Function Parameters Return Address Saved Frame Pointer Local Variables

6. Liner Form 444 cba 44 retsfpbuffer1buffer2 510 Top of memory Bottom of stack Bottom of memory Top of stack

7. Example void function(char *str){ char buffer[16]; strcpy(buffer, str); } int main(){ char large_string[256]; int i; for (i = 0; i < 255; i++){ large_string[i] = ‘A’; } function(large_string); } Buffer overflows take advantage of the fact that bounds checking is not performed (not strongly typed language)

8. No boundary check 4 *str 44 retsfpbuffer 16 Top of memory Bottom of stack Bottom of memory Top of stack AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA A A A A A A A A A A A A A A A A The return address is overwritten with ‘AAAA’ (0x41414141) Function exits and goes to execute instruction at 0x41414141…..

9. Example void function(int a, int b, int c){ char buffer1[5]; char buffer2[10]; int *r; r = buffer1 + 9; (*r) += 8; } int main(){ int x = 0; function(1,2,3); x = 1; printf(“%d\n”, x); }

10. Set value 444 cba 44 retsfpbuffer1buffer2 510 Top of memory Bottom of stack Bottom of memory Top of stack 4 r +8 Note: modern implementations have extra info in the stack between the local variables and sfp. This would slightly impact the value added to the address of buffer1. buffer1 + 12 This causes it to skip the assignment of 1 to x, and prints out 0 for the value of x

11. Result We have seen how – We can overwrite the return address of our own program to crash it or skip a few instructions. – Can these principles be used by an attacker to hijack the execution of a program? If we want to go to the buffer, how do we know where the buffer starts? (Basically just guess until you get it right)

12. Stack-Based Buffer Overflows Attacker Enter information as a user into a program – Information Consists of executable code and a new return address. – The buggy program will Not analyze the length of this input, Place it on the stack, and actually begin to execute the attacker’s code. If running with superuser privileges (e.g., SUID root on a UNIX system), the attacker has taken over the machine with a buffer overflow.

13. Stack-Based Buffer Overflow Defenses Programmers: – Properly code software so that it cannot be used to smash the stack. All programs should validate all input from users and other programs, ensuring that it fits into allocated memory structures. Security practitioners and system administrators: – Should carefully control and minimize the number of SUID programs on a system that users can run and have permissions of other users (such as root).

14. Stack-Based Buffer Overflow Defenses Configuring the systems: to not execute code from the stack. (many) – Solaris and Linux offer this option. For example, to secure a Solaris system against stack-based buffer overflows, the following lines should be added: /etc/system: set noexec_user_stack=1 set noexec_user_stack_log=1

15. Stack-Based Buffer Overflow Defenses /etc/system:  will prevent execution on a stack, set noexec_user_stack=1  will log any attempt to do so. – Some programs legitimately try to run code off the stack. Such programs will crash if this option is implemented. If the system is single purpose and needs to be secure (e.g., a Web server) – This option should be used to prevent stack-based buffer overflow.