1. Udaya Shyama Pallathadka Ganapathi Bhat CSCE 548 Student Presentation
Format string problems 24 Deadly sins of software security Michael howard david leblanc john viega
Udaya Shyama Pallathadka Ganapathi Bhat
CSCE 548 Student Presentation

2. Technical Overview What is Format String? 1
It consists of Format Function like printf, scanf
Format String Parameter like %x, %s
Format String would be like printf(“The magic number is: %d\n”,1911);
Format String exploit happens when input is evaluated as a command by the application

3. Technical Overview What is the root cause for Format String Bugs?
Who is responsible for it?
Which are the most vulnerable coding languages?
What could be the result of exploitation?
Stickman Logo:

4. Technical Overview
Any application that takes input from user and passes it to formatting function is potentially at risk 2
Common mistakes that developer commits which leads to this Sin:
Failing to properly validate user input
Giving the user, freedom to provide format strings as input
Failing to protect files using proper ACLs

5. Examples(Demo) Viewing the Stack Crashing the program (DoS Attack)
Viewing the memory at any location
Writing data to any arbitrary memory location
Note: A live demonstration with respect to the above attacks will be shown during the Presentation on a Command Prompt with C compiler 3

6. Examples(Demo)
Source: [2]

7. Spotting the sin 2
If an application takes user input and passes it to a formatting function then it is potentially at risk
Understand the importance of Code Review to Spot the Sin
Pass format specifiers into application and see if hexadecimal values are returned
Check for variable length of format strings

8. Redemption steps 2
Never pass user input directly to a formatting function
Do use fixed string formats or format string from a trusted source
Do heed the warnings and errors that you receive upon compiling the code

9. Redemption steps 2 Check and limit locale to valid values
Don’t use printf family of functions, if possible avoid it
Consider using higher-level languages that tend to be less vulnerable to this issue

10. CONCLUSION It’s an implementation bug Easy to Find
Code review is the way to spot this Sin
Don’t allow user input directly to formatting functions
Always validate and filter the input

11. References
OWASP: Format String Attack. Last Revisited 04/16/2015
Howard, Michael, David LeBlanc, and John Viega. 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them. New York: McGraw-Hill, Print.
Security Tube_Bot, Format String Vulnerabilities Megaprimer  A video series to understand the basics of Format String Vulnerabilities and how to exploit them