Buffer Overflows Lesson 14

Example of poor programming/errors Buffer Overflows result of poor programming practice use of functions such as gets and strcpy –these don’t check input for boundaries may allow individual to gain root or admin access Easy to do in any programming language…what is the real problem?

What is a buffer overflow? “A buffer overflow attack is when an attacker tries to store too much information in an undersized receptacle.” “A common implementation is when a user of the program gives the program more data than the developers of the program allocated to store it.”

Exploits Buffer Overflows fingerd, statd, talkd, … result of poor programming practice Shell Escapes special character in input string causes escape to shell

Buffer Overflow Example #include void func(char *p) { char stack_temp[20]; strcpy(stack_temp, p); printf(stack_temp); } int main(int argc, char* argv[]) { func(“I AM MORE THAN TWENTY CHARACTERS LONG!”); return 0; }

Buffer Overflows Program Execute A Return Subroutine A Read Variable Data Process Stack Return Addr

Buffer Overflows Program Execute A Return Subroutine A Read Variable Data Process Stack Return Addr New Addr Another Routine

Buffer Overflows Program Execute A Return Subroutine A Read Variable Data Process Stack Return Addr New Addr Machine Code

Types of buffer overflow attacks Denial of service – buffer overflow will cause the system to “crash” Since important information needed by the OS to continue running can be located on the stack, by overflowing with enough data you can wipe out this important information. Execution of code that the attacker chooses to run. Overwrite just the right amount of information to overflow the stack and rewrite the return address pointer. Do this right and you can point to your own code.

Buffer Overflows (cont) “A key point to remember is that the attacker’s code will run at whatever privileges the software that is exploited is running at.” “In most cases, an attacker tries to exploit programs that are running as a privileged account such as root or domain administrator.”

Protection against buffer overflow attacks Close the port or service Best way to protect yourself is to remove SW that is subject to an overflow. If this SW is installed by default, close ports and remove service. Rule of thumb: “Know what is installed on your systems and have the least amount of services running and ports open that are required for the system to operate in a specific environment.”

Protection Apply the vendor’s patch or install the latest version of the software. Usually shortly after a buffer overflow vulnerability is discovered the vendor will develop and release a patch. This fixes the problem as opposed to just minimizing exposure.

Protection Filter specific traffic at the firewall. Block the traffic of the vulnerable software at the firewall. This will restrict the ability of external attackers to exploit the vulnerability. Does not prevent an insider from exploiting the vulnerability, just limits the exposure.

Prevention Test key applications. Take a proactive approach and attempt to find buffer overflow exploits yourself. Not practical for all applications but for key ones it is.

Prevention Run Software at the Least Privilege Required Often system administrators will install and configure applications as root. Quick an easy to ensure they have access to what they need. Also easy way to guarantee system is vulnerable if buffer overflow exploit is discovered in one of the applications since it will execute code as root.