Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade Crispin Cowan SANS 2000

Buffer Overflows Inject and execute attack code at the privilege of the vulnerable program. “exec(/bin/sh)”

Inject Code On the stack (automatic variables) On the heap (malloc’d variables) In static data areas Code does not need to be in the overflowing buffer.

Use Code Already There “exec(arg)” by making arg point to “/bin/sh”

Jump to Attacker’s Code Activation Record Overflow into return address on the stack and make it point at the code. Overflow into return address on the stack and make it point at the code. Function pointers Overflow into “void (*foo())()” and it point at the code. Overflow into “void (*foo())()” and it point at the code.

Buffer Overflow Defenses Writing Correct Code Vulnerable programs continue to emerge on a regular basis Vulnerable programs continue to emerge on a regular basis C has many error-prone idioms and a culture that favors performance over correctness. Static Analysis Tools Fortify – looks for vulnerable constructs Fortify – looks for vulnerable constructs Too many false positives. Too many false positives.

Buffer Overflow Defenses Non-executable buffers Non executable data segments Non executable data segments Optimizing compiles emit code into program data segments Non executable stack segments Non executable stack segments Highly effective against code injection on the stack but not against code injections on the heap or static variables.

Buffer Overflow Defenses Array Bound Checking Can run 12x-30x slower Can run 12x-30x slower a[3] is checked but *(a+3) is not a[3] is checked but *(a+3) is not

Buffer Overflow Defenses Type safe languages: Java or ML There are millions of lines of C code in operating systems and security system applications There are millions of lines of C code in operating systems and security system applications Attack the Java Virtual Machine which is a C program Attack the Java Virtual Machine which is a C program

Canary Terminator Canary 0 (null), CR, LF, -1 (EOF) 0 (null), CR, LF, -1 (EOF) Random Canary 32 bit random number 32 bit random number

StackGuard Compiler Recompiled Linux Prevented old and new attacks Execution cost of SSH and Apache was indistinguishable

StackGuard Compiler Performance Pointer dereferencing occurs much less than array references Pointer dereferencing occurs much less than array references There does not exist any bounds checking compiler capable of approaching the compatibility and performance of the StackGuard compiler

PointGuard Compiler Put canary next to function pointers as well. Only the relative obscure form of buffer overflow attack that corrupts non-pointer variables to affect the program’s logic will escape PointGuard (Morris worm)

Conclusion Use Safer Library : Strsafe.h Visual C++.NET /GS option Similar to StackGuard Similar to StackGuard