Udaya Shyama Pallathadka Ganapathi Bhat CSCE 548 Student Presentation Format string problems 24 Deadly sins of software security Michael howard david leblanc john viega Udaya Shyama Pallathadka Ganapathi Bhat CSCE 548 Student Presentation

Technical Overview What is Format String? 1 It consists of Format Function like printf, scanf Format String Parameter like %x, %s Format String would be like printf(“The magic number is: %d\n”,1911); Format String exploit happens when input is evaluated as a command by the application

Technical Overview What is the root cause for Format String Bugs? Who is responsible for it? Which are the most vulnerable coding languages? What could be the result of exploitation? Stickman Logo: https://www.flickr.com/photos/89763795@N02/8243547987/in/photostream/

Technical Overview Any application that takes input from user and passes it to formatting function is potentially at risk 2 Common mistakes that developer commits which leads to this Sin: Failing to properly validate user input Giving the user, freedom to provide format strings as input Failing to protect files using proper ACLs

Examples(Demo) Viewing the Stack Crashing the program (DoS Attack) Viewing the memory at any location Writing data to any arbitrary memory location Note: A live demonstration with respect to the above attacks will be shown during the Presentation on a Command Prompt with C compiler 3 https://youtu.be/AeEqGzkdjdc

Examples(Demo) Source: [2]

Spotting the sin 2 If an application takes user input and passes it to a formatting function then it is potentially at risk Understand the importance of Code Review to Spot the Sin Pass format specifiers into application and see if hexadecimal values are returned Check for variable length of format strings

Redemption steps 2 Never pass user input directly to a formatting function Do use fixed string formats or format string from a trusted source Do heed the warnings and errors that you receive upon compiling the code

Redemption steps 2 Check and limit locale to valid values Don’t use printf family of functions, if possible avoid it Consider using higher-level languages that tend to be less vulnerable to this issue

CONCLUSION It’s an implementation bug Easy to Find Code review is the way to spot this Sin Don’t allow user input directly to formatting functions Always validate and filter the input

References OWASP: Format String Attack. https://www.owasp.org/index.php/Format_string_attack, Last Revisited 04/16/2015 Howard, Michael, David LeBlanc, and John Viega. 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them. New York: McGraw-Hill, 2010. Print. Security Tube_Bot, Format String Vulnerabilities Megaprimer http://www.securitytube.net/groups?operation=view&groupId=3  A video series to understand the basics of Format String Vulnerabilities and how to exploit them