Software Vulnerabilities

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Software Vulnerabilities"

Transcription

1 Software Vulnerabilities -- stack overflow

2 Code based security Code based security discusses typical vulnerabilities made by programmers that can be exploited by miscreants Implementing safe software in C/C++ is almost impossible However, a huge amount of unsafe codes exist worldwide On the other hand, native codes are still appealing due to performance issues Steps have been taken both by hardware and software vendors: High-level languages: Java (J2EE),.NET framework (C#) ASLR: Address Space Layout Randomization Using safe libraries Input validator Antivirus, IDS NX/XN bit: CPU support for non-executable memory ranges 2

3 Code based security/buffer overflow Occurs when the boundary of a buffer is exceeded by data thus overwriting adjecent memory locations Typically causing the program to halt with exception Segmentation fault (Linux) Access violation at 0x (Windows) Can be exploited by overwriting interesting variables, memory locations (return address, pointers, file names,etc) Forcing the program to change its control flow by injecting malicious code Most preferred targets: Setuid/setgid programs Network servers: remote access 3

4 Code based security/buffer overflow Morris worm (1988): overflow in fingerd 6000 machines are infected (10% of Internet) CodeRed (2001): overflow in Microsoft IIS machines are infected in 14 hours SQL Slammer (2003): overflow in MS-SQL server machines are infected in 10 minutes Stack Overflow in FreeBSD kernel (2010) In 2003, 75% of vulnerabilities were buffer overflow related according to CERT Today web based vulnerabilities are more common, however, in case of servers it is still essential 4

5 Code based security/stack overflow Stack has already been introduced Stack overflow can occur when a procedure copies usercontrolled data to a local buffer on the stack without verifying its size. Dangerous functions: strcpy, sprintf, strcat, gets, fgets, Local data overwrites other values on the stack up to return address When the procedure returns EIP is set to the address residing at the location of the return address. control flow can be changed Insert code to that modified address will be executed. 5

6 Stack Stack is built up from several stack frames belonging to functions. Each stack frame comprises: Function parameters Return address Saved Frame Pointer (Frame pointer of the preceding frame) Local variables Previous frame Higher memory addresses Function parameters Return address Saved EBP (SFP) Local variables Free memory EBP 6

7 The stack in calling and returning from function addnum LIFO principles Grows towards lower memory addresses ESP: stack pointer, points to the top of the stack 7

8 mov dword ptr [b],3 ; Moving 3 to the address pointed by variable b mov eax,dword ptr [b]; Storing that value in register eax push eax ; Pushing b to stack and decreasing ESP its widthness 3 (b) int main(void){ int a, b, c; a=7; b=3; c = addnum(a,b); printf("result is: %d", a+b); 8

9 mov dword ptr [a],7 ; Moving 7 to the address pointed by variable a mov ecx,dword ptr [a]; Storing that value in register ecx push ecx ; Pushing a to stack and decreasing ESP by its widthness 3 (b) 7 (a) int main(void){ int a, b, c; a=7; b=3; c = addnum(a,b); printf("result is: %d", a+b); 9

10 call addnum ; pushing the address of the next instruction (return addr.) ; (0x ) to the stack and calling function addnum & ; decreasing esp 3 (b) 7 (a) 0x (ret addr.) int main(void){ int a, b, c; a=7; b=3; c = addnum(a,b); printf("result is: %d", a+b); 10

11 Every function starts with function prologue: push ebp ; Saves the previous frame pointer (EBP also called Saved FP) mov ebp,esp ; Currently the EBP points to SFP sub esp, 0x10 ; Saving space for the local variables of the function 3 (b) 7 (a) 0x (ret addr.) Saved EBP (SFP) int addnum(int a, int b){ int c = 4; c = a + b; return c; 11

12 Every function starts with function prologue: push ebp ; Saves the previous frame pointer (EBP also called Saved FP) mov ebp,esp ; Currently the EBP points to SFP sub esp, 0x10 ; Saving space for the local variables of the function 3 (b) 7 (a) 0x (ret addr.) Saved EBP (SFP),EBP int addnum(int a, int b){ int c = 4; c = a + b; return c; 12

13 Every function starts with function prologue: push ebp ; Saves the previous frame pointer (EBP also called Saved FP) mov ebp,esp ; Currently the EBP points to SFP sub esp, 0x10 ; Saving space for the local variables of the function 3 (b) 7 (a) 0x (ret addr.) Saved EBP (SFP) Space for local variables EBP int addnum(int a, int b){ int c = 4; c = a + b; return c; 13

14 Every function ends with function epilogue. mov esp,ebp ; restoring the stack pointer to SFP, unallocating space for locals pop ebp ; restoring the value of EBP thus point into SFP of preceding frame ret ; popping return address and returning to that, increasing ESP 3 (b) 7 (a) 0x (ret addr.) Saved EBP (SFP) EBP, ESP int addnum(int a, int b){ int c = 4; c = a + b; return c; 14

15 Every function ends with function epilogue. mov esp,ebp ; restoring the stack pointer to SFP, unallocating space for locals pop ebp ; restoring the value of EBP thus point into SFP of preceding frame ret ; popping return address and returning to that, increasing ESP 3 (b) 7 (a) 0x (ret addr.) int addnum(int a, int b){ int c = 4; c = a + b; return c; 15

16 Every function ends with function epilogue. mov esp,ebp ; restoring the stack pointer to SFP, unallocating space for locals pop ebp ; restoring the value of EBP thus point into SFP of preceding frame ret ; popping return address and returning to that, increasing ESP 3 (b) 7 (a) int addnum(int a, int b){ int c = 4; c = a + b; return c; 16

17 add esp,8 ; decreasing the stack after the RET instruction of addnum 3 (b) 7 (a) int main(void){ int a, b, c; a=7; b=3; c = addnum(a,b); printf("result is: %d", a+b); 17

18 Code based security/stack overflow int main(int argc, char* argv[] ) { dangereous(argv[1]); printf( Is everything all right? ); void dangerous(char * buf){ char buffer[100]; strcpy(buffer, buf); Previous frame Higher memory addresses Previous frame Function parameters Function parameters Return address buffer address Saved EBP (frame pointer) EBP SHELLCODE buffer[100] Free memory 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90 Free 0x90 memory 0x90 0x90 NOP sled 18

19 Code based security/stack overflow NOP sled: Put in front of the shellcode and jump into that area. Instructions should always reach the beginig of the shellcode. The simplest version is a sequence of 0x90 (no operations - nop) Reason to apply: Bigger chance to find our shellcode On local systems the position of return address can be calculated (no ASLR) Remote addresses are unknown Where to put the shellcode? Into the local buffer with a preceeding nop sled Remote attacks possible, but the memory page the buffer residing at must be executable. The location of the buffer must be known. Into Environment variables Easy to implement. Good for tiny buffers, however, only for local attacks. Stack must be executable. Address of a function inide the program Remote attacks possible with no executable stack. More frames to put on stack. 19

20 Memory segmentation (ELF binaries) 0xFFFFFFFF Kernel Environment variables Stack Data segment (heap) Data segment (.bss) Data segment (.data) Code segment (.text) Stack segment includes Local variables Values required for procedure call Data segment heap: dynamically allocated memory. bss: Uninitialized global & static variables.data: Initialized global & static vairbales Code Segment: Executable instructions Typically read-only Shared libraries 20

21 Code based security/software ASLR There are many workarounds for protecting against stack and heap overflow. One of the most effective ones is ASLR: Address Space Layout (Load) Randomization Randomizes the base address of stack and heap. Stack Heap RND RND void alt_main(int argc, char* argv[]){... void spamstack(int i, int ac, char* av[] ){ if (! i) alt_main(ac, av); spamstack(--i); int main(int argc, char* argv[]){ srand ( time(null) ); malloc(rand() % ); // rnd heap spamstack(rand() % , argc, argv); 21

Software security. Buffer overflow attacks SQL injections. Lecture 11 EIT060 Computer Security

Software security. Buffer overflow attacks SQL injections. Lecture 11 EIT060 Computer Security Software security Buffer overflow attacks SQL injections Lecture 11 EIT060 Computer Security Buffer overflow attacks Buffer overrun is another common term Definition A condition at an interface under which

More information

Hacking Techniques & Intrusion Detection. Ali Al-Shemery arabnix [at] gmail

Hacking Techniques & Intrusion Detection. Ali Al-Shemery arabnix [at] gmail Hacking Techniques & Intrusion Detection Ali Al-Shemery arabnix [at] gmail All materials is licensed under a Creative Commons Share Alike license http://creativecommonsorg/licenses/by-sa/30/ # whoami Ali

More information

Buffer Overflows. Security 2011

Buffer Overflows. Security 2011 Buffer Overflows Security 2011 Memory Organiza;on Topics Kernel organizes memory in pages Typically 4k bytes Processes operate in a Virtual Memory Space Mapped to real 4k pages Could live in RAM or be

More information

Off-by-One exploitation tutorial

Off-by-One exploitation tutorial Off-by-One exploitation tutorial By Saif El-Sherei www.elsherei.com Introduction: I decided to get a bit more into Linux exploitation, so I thought it would be nice if I document this as a good friend

More information

Stack Overflows. Mitchell Adair

Stack Overflows. Mitchell Adair Stack Overflows Mitchell Adair Outline Why? What? There once was a VM Virtual Memory Registers Stack stack1, stack2, stack3 Resources Why? Real problem Real money Real recognition Still prevalent Very

More information

Unix Security Technologies. Pete Markowsky <peterm[at] ccs.neu.edu>

Unix Security Technologies. Pete Markowsky <peterm[at] ccs.neu.edu> Unix Security Technologies Pete Markowsky What is this about? The goal of this CPU/SWS are: Introduce you to classic vulnerabilities Get you to understand security advisories Make

More information

Format string exploitation on windows Using Immunity Debugger / Python. By Abysssec Inc WwW.Abysssec.Com

Format string exploitation on windows Using Immunity Debugger / Python. By Abysssec Inc WwW.Abysssec.Com Format string exploitation on windows Using Immunity Debugger / Python By Abysssec Inc WwW.Abysssec.Com For real beneficiary this post you should have few assembly knowledge and you should know about classic

More information

MSc Computer Science Dissertation

MSc Computer Science Dissertation University of Oxford Computing Laboratory MSc Computer Science Dissertation Automatic Generation of Control Flow Hijacking Exploits for Software Vulnerabilities Author: Sean Heelan Supervisor: Dr. Daniel

More information

Ethical hacking. László Erdődi, PhD. University of Agder

Ethical hacking. László Erdődi, PhD. University of Agder Ethical hacking László Erdődi, PhD. University of Agder laszlo.erdodi@uia.no About myself PhD from Computer Security (Software vulnerability exploitation) Research on Software vulnerabilities (error finding

More information

CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 20: Stack Frames 7 March 08

CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 20: Stack Frames 7 March 08 CS412/CS413 Introduction to Compilers Tim Teitelbaum Lecture 20: Stack Frames 7 March 08 CS 412/413 Spring 2008 Introduction to Compilers 1 Where We Are Source code if (b == 0) a = b; Low-level IR code

More information

I Control Your Code Attack Vectors Through the Eyes of Software-based Fault Isolation. Mathias Payer, ETH Zurich

I Control Your Code Attack Vectors Through the Eyes of Software-based Fault Isolation. Mathias Payer, ETH Zurich I Control Your Code Attack Vectors Through the Eyes of Software-based Fault Isolation Mathias Payer, ETH Zurich Motivation Applications often vulnerable to security exploits Solution: restrict application

More information

Return-oriented programming without returns

Return-oriented programming without returns Faculty of Computer Science Institute for System Architecture, Operating Systems Group Return-oriented programming without urns S. Checkoway, L. Davi, A. Dmitrienko, A. Sadeghi, H. Shacham, M. Winandy

More information

CSCE 465 Computer & Network Security

CSCE 465 Computer & Network Security CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Program Security: Buffer Overflow 1 Buffer Overflow BO Basics Stack smashing Other buffer overflow

More information

Cataloguing and Avoiding the Buffer Overflow Attacks in Network Operating Systems

Cataloguing and Avoiding the Buffer Overflow Attacks in Network Operating Systems Abstract: Cataloguing and Avoiding the Buffer Overflow Attacks in Network Operating Systems *P.VADIVELMURUGAN #K.ALAGARSAMY *Research Scholar, Department of Computer Center, Madurai Kamaraj University,

More information

Defense in Depth: Protecting Against Zero-Day Attacks

Defense in Depth: Protecting Against Zero-Day Attacks Defense in Depth: Protecting Against Zero-Day Attacks Chris McNab FIRST 16, Budapest 2004 Agenda Exploits through the ages Discussion of stack and heap overflows Common attack behavior Defense in depth

More information

Hotpatching and the Rise of Third-Party Patches

Hotpatching and the Rise of Third-Party Patches Hotpatching and the Rise of Third-Party Patches Alexander Sotirov asotirov@determina.com BlackHat USA 2006 Overview In the next one hour, we will cover: Third-party security patches _ recent developments

More information

Memory management in C: The heap and the stack

Memory management in C: The heap and the stack Memory management in C: The heap and the stack Leo Ferres Department of Computer Science Universidad de Concepción leo@inf.udec.cl October 7, 2010 1 Introduction When a program is loaded into memory, it

More information

GSM. Global System for Mobile Communications, 1992. Security in mobile phones. System used all over the world. Sikkerhed04, Aften Trusler

GSM. Global System for Mobile Communications, 1992. Security in mobile phones. System used all over the world. Sikkerhed04, Aften Trusler GSM Global System for Mobile Communications, 1992 Security in mobile phones System used all over the world 1 GSM: Threat Model What Cloning Eavesdropping Tracking Who Criminals Secret Services Why Break

More information

Bypassing Browser Memory Protections in Windows Vista

Bypassing Browser Memory Protections in Windows Vista Bypassing Browser Memory Protections in Windows Vista Mark Dowd & Alexander Sotirov markdowd@au1.ibm.com alex@sotirov.net Setting back browser security by 10 years Part I: Introduction Thesis Introduction

More information

Return-oriented Programming

Return-oriented Programming Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Return-oriented Programming

More information

Defending Computer Networks Lecture 3: More On Vulnerabili3es. Stuart Staniford Adjunct Professor of Computer Science

Defending Computer Networks Lecture 3: More On Vulnerabili3es. Stuart Staniford Adjunct Professor of Computer Science Defending Computer Networks Lecture 3: More On Vulnerabili3es Stuart Staniford Adjunct Professor of Computer Science Enrollment Logis;cs Send request to cs- course- enroll@cornell.edu Cc me (sgs235@cornell.edu)

More information

Buffer Overflows. Code Security: Buffer Overflows. Buffer Overflows are everywhere. 13 Buffer Overflow 12 Nov 2015

Buffer Overflows. Code Security: Buffer Overflows. Buffer Overflows are everywhere. 13 Buffer Overflow 12 Nov 2015 CSCD27 Computer and Network Security Code Security: Buffer Overflows 13 Buffer Overflow CSCD27 Computer and Network Security 1 Buffer Overflows Extremely common bug. First major exploit: 1988 Internet

More information

Return-to-libc Attack Lab

Return-to-libc Attack Lab Laboratory for Computer Security Education 1 Return-to-libc Attack Lab Copyright c 2006-2010 Wenliang Du, Syracuse University. The development of this document is funded by the National Science Foundation

More information

Betriebssysteme KU Security

Betriebssysteme KU Security Betriebssysteme KU Security IAIK Graz University of Technology 1 1. Drivers 2. Security - The simple stuff 3. Code injection attacks 4. Side-channel attacks 2 1. Drivers 2. Security - The simple stuff

More information

Bypassing Memory Protections: The Future of Exploitation

Bypassing Memory Protections: The Future of Exploitation Bypassing Memory Protections: The Future of Exploitation Alexander Sotirov alex@sotirov.net About me Exploit development since 1999 Research into reliable exploitation techniques: Heap Feng Shui in JavaScript

More information

Ripples in the Gene Pool. Creating Genetic Mutations to Survive the Vulnerability Window Chris Eagle Defcon 14

Ripples in the Gene Pool. Creating Genetic Mutations to Survive the Vulnerability Window Chris Eagle Defcon 14 Ripples in the Gene Pool Creating Genetic Mutations to Survive the Vulnerability Window Chris Eagle Defcon 14 Standard Disclaimer The views expressed in this presentation are my own and do not necessarily

More information

Attacking Host Intrusion Prevention Systems. Eugene Tsyrklevich eugene@securityarchitects.com

Attacking Host Intrusion Prevention Systems. Eugene Tsyrklevich eugene@securityarchitects.com Attacking Host Intrusion Prevention Systems Eugene Tsyrklevich eugene@securityarchitects.com Agenda Introduction to HIPS Buffer Overflow Protection Operating System Protection Conclusions Demonstration

More information

Hands-on Hacking Unlimited

Hands-on Hacking Unlimited About Zone-H Attacks techniques (%) File Inclusion Shares misconfiguration SQL Injection DNS attack through social engineering Web Server external module intrusion Attack against the administrator/user

More information

Assembly Language: Function Calls" Jennifer Rexford!

Assembly Language: Function Calls Jennifer Rexford! Assembly Language: Function Calls" Jennifer Rexford! 1 Goals of this Lecture" Function call problems:! Calling and returning! Passing parameters! Storing local variables! Handling registers without interference!

More information

Practical taint analysis for protecting buggy binaries

Practical taint analysis for protecting buggy binaries Practical taint analysis for protecting buggy binaries So your exploit beats ASLR/DEP? I don't care Erik Bosman Traditional Stack Smashing buf[16] GET / HTTP/1.100baseretnarg1arg2 Traditional

More information

Format String Vulnerability. printf ( user input );

Format String Vulnerability. printf ( user input ); Lecture Notes (Syracuse University) Format String Vulnerability: 1 Format String Vulnerability printf ( user input ); The above statement is quite common in C programs. In the lecture, we will find out

More information

Heap-based Buffer Overflow Vulnerability in Adobe Flash Player

Heap-based Buffer Overflow Vulnerability in Adobe Flash Player Analysis of Zero-Day Exploit_Issue 03 Heap-based Buffer Overflow Vulnerability in Adobe Flash Player CVE-2014-0556 20 December 2014 Table of Content Overview... 3 1. CVE-2014-0556 Vulnerability... 3 2.

More information

Introduction to Information Security

Introduction to Information Security Introduction to Information Security 0368-3065, Spring 2015 Lecture 1: Introduction, Control Hijacking (1/2) Eran Tromer Slides credit: Avishai Wool, Tel Aviv University 1 Administration Lecturer: Eran

More information

How does the technique look on the stack - a basic view will be something similar to this:

How does the technique look on the stack - a basic view will be something similar to this: Bypassing non-executable-stack during exploitation using return-to-libc by c0ntex c0ntex[at]gmail.com ----------------------------------------------------------------------- Returning to libc is a method

More information

Abysssec Research. 1) Advisory information. 2) Vulnerable version

Abysssec Research. 1) Advisory information. 2) Vulnerable version Abysssec Research 1) Advisory information Title Version Discovery Vendor Impact Contact Twitter CVE : Apple QuickTime FlashPix NumberOfTiles Remote Code Execution Vulnerability : QuickTime player 7.6.5

More information

Chapter 15 Operating System Security

Chapter 15 Operating System Security Operating Systems: Internals and Design Principles Chapter 15 Operating System Security Eighth Edition By William Stallings System Access Threats System access threats fall into two general categories:

More information

Heap Overflows and Double-Free Attacks

Heap Overflows and Double-Free Attacks Heap Overflows and Double-Free Attacks Yan Huang Credits: Vitaly Shmatikov Format Strings Variable Arguments in C In C, can define a function with a variable number of arguments - Example: void printf(const

More information

http://www.nologin.org Bypassing Windows Hardware-enforced Data Execution Prevention

http://www.nologin.org Bypassing Windows Hardware-enforced Data Execution Prevention http://www.nologin.org Bypassing Windows Hardware-enforced Data Execution Prevention Oct 2, 2005 skape mmiller@hick.org Skywing Skywing@valhallalegends.com One of the big changes that Microsoft introduced

More information

Some Anti-Worm Efforts at Microsoft. Acknowledgements

Some Anti-Worm Efforts at Microsoft. Acknowledgements Some Anti-Worm Efforts at Microsoft Helen J. Wang System and Networking Research Group Microsoft Research Oct 29, 2004 1 Acknowledgements Matt Braverman, Opher Dubrovsky, John Dunagan, Louis Lafreniere,

More information

For a 64-bit system. I - Presentation Of The Shellcode

For a 64-bit system. I - Presentation Of The Shellcode #How To Create Your Own Shellcode On Arch Linux? #Author : N3td3v!l #Contact-mail : 4nonymouse@usa.com #Website : Nopotm.ir #Spcial tnx to : C0nn3ct0r And All Honest Hackerz and Security Managers I - Presentation

More information

Last Class: OS and Computer Architecture. Last Class: OS and Computer Architecture

Last Class: OS and Computer Architecture. Last Class: OS and Computer Architecture Last Class: OS and Computer Architecture System bus Network card CPU, memory, I/O devices, network card, system bus Lecture 3, page 1 Last Class: OS and Computer Architecture OS Service Protection Interrupts

More information

Securing software by enforcing data-flow integrity

Securing software by enforcing data-flow integrity Securing software by enforcing data-flow integrity Manuel Costa Joint work with: Miguel Castro, Tim Harris Microsoft Research Cambridge University of Cambridge Software is vulnerable use of unsafe languages

More information

Duration: 90 Minutes Examiner: A. Goel

Duration: 90 Minutes Examiner: A. Goel Duration: 90 Minutes Examiner: A. Goel 1. Your exam will be eligible for remarking only if you use a pen. 2. Do not turn this page until you have received the signal to start. 3. This exam is closed textbook

More information

Reverse Engineering Objective-C. Jeff Hui

Reverse Engineering Objective-C. Jeff Hui Reverse Engineering Objective-C Jeff Hui The process of understanding a system through analysis of its structure, function, and operation Wikipedia It s not Debugging It s Reverse Engineering! The process

More information

Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering

Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 39 System Security Welcome

More information

Context switch in Linux. Gabriel Kliot, Technion 1 Context switch in Linux OS course

Context switch in Linux. Gabriel Kliot, Technion 1 Context switch in Linux OS course Context switch in Linux Gabriel Kliot, Technion 1 Context switch in Linux OS course Memory layout general picture Stack Stack Stack Process X user memory Process Y user memory Process Z user memory Stack

More information

CS3235 - Computer Security Thirteenth topic: System attacks. defenses

CS3235 - Computer Security Thirteenth topic: System attacks. defenses Overflows... Security case studies CS3235 - Computer Security Thirteenth topic: System attacks and defenses Hugh Anderson National University of Singapore School of Computing March/April, 2016 Hugh Anderson

More information

Last Class: Introduction to Operating Systems. Today: OS and Computer Architecture

Last Class: Introduction to Operating Systems. Today: OS and Computer Architecture Last Class: Introduction to Operating Systems User apps OS Virtual machine interface hardware physical machine interface An operating system is the interface between the user and the architecture. History

More information

Security Protection and Checking for Embedded System Integration Against Buffer Overflow Attacks via Hardware/Software

Security Protection and Checking for Embedded System Integration Against Buffer Overflow Attacks via Hardware/Software 1 Security Protection and Checking for Embedded System Integration Against Buffer Overflow Attacks via Hardware/Software Zili Shao, Member, IEEE, Chun Xue, Student Member, IEEE, Qingfeng Zhuge, Member,

More information

Binary analysis and dynamic jumps

Binary analysis and dynamic jumps Binary analysis and dynamic jumps Gina-Adriana DOBRESCU and Maxime MEIGNAN École Nationale Supérieure d Informatique et de Mathématiques Appliquées de Grenoble, France Email: gina-adriana.dobrescu@ensimag.grenoble-inp.fr

More information

Introduction. Figure 1 Schema of DarunGrim2

Introduction. Figure 1 Schema of DarunGrim2 Reversing Microsoft patches to reveal vulnerable code Harsimran Walia Computer Security Enthusiast 2011 Abstract The paper would try to reveal the vulnerable code for a particular disclosed vulnerability,

More information

telnetd exploit FreeBSD Telnetd Remote Exploit Für Compass Security AG Öffentliche Version 1.0 Januar 2012

telnetd exploit FreeBSD Telnetd Remote Exploit Für Compass Security AG Öffentliche Version 1.0 Januar 2012 telnetd exploit FreeBSD Telnetd Remote Exploit Für Compass Security AG Öffentliche Version 1.0 Januar 2012 Content Part I Info Bug Telnet Exploit Part II Advanced Exploitation Meta Information Disclosed

More information

Attacking x86 Windows Binaries by Jump Oriented Programming

Attacking x86 Windows Binaries by Jump Oriented Programming Attacking x86 Windows Binaries by Jump Oriented Programming L. Erdődi * * Faculty of John von Neumann, Óbuda University, Budapest, Hungary erdodi.laszlo@nik.uni-obuda.hu Abstract Jump oriented programming

More information

Eugene Tsyrklevich. Ozone HIPS: Unbreakable Windows

Eugene Tsyrklevich. Ozone HIPS: Unbreakable Windows Eugene Tsyrklevich Eugene Tsyrklevich has an extensive security background ranging from designing and implementing Host Intrusion Prevention Systems to training people in research, corporate, and military

More information

I decided to write a quick document about the techniques I used to exploit Internet Explorer 8 on windows 7 with ASLR and DEP enabled.

I decided to write a quick document about the techniques I used to exploit Internet Explorer 8 on windows 7 with ASLR and DEP enabled. Pwn2Own 2010 Windows 7 Internet Explorer 8 exploit I decided to write a quick document about the techniques I used to exploit Internet Explorer 8 on windows 7 with ASLR and DEP enabled. The exploit consists

More information

風 水. Heap Feng Shui in JavaScript. Alexander Sotirov. asotirov@determina.com

風 水. Heap Feng Shui in JavaScript. Alexander Sotirov. asotirov@determina.com 風 水 Heap Feng Shui in JavaScript Alexander Sotirov asotirov@determina.com Black Hat Europe 2007 Introduction What is Heap Feng Shui? the ancient art of arranging heap blocks in order to redirect the program

More information

An Analysis of Address Space Layout Randomization on Windows Vista

An Analysis of Address Space Layout Randomization on Windows Vista ADVANCED THREAT RESEARCH 2007 Symantec Corporation 1 An Analysis of Address Space Layout Randomization on Windows Vista Ollie Whitehouse, Architect, Symantec Advanced Threat Research Abstract: Address

More information

Where s the FEEB? The Effectiveness of Instruction Set Randomization

Where s the FEEB? The Effectiveness of Instruction Set Randomization Where s the FEEB? The Effectiveness of Instruction Set Randomization Ana Nora Sovarel David Evans Nathanael Paul University of Virginia, Department of Computer Science http://www.cs.virginia.edu/feeb Abstract

More information

Buffer Overflow Vulnerability Detection in the Binary Code

Buffer Overflow Vulnerability Detection in the Binary Code Buffer Overflow Vulnerability Detection in the Binary Code Shehab Gamal El-Dien, Reda Salama, Ahmed Eshak shehab@ispofegypt.com, redasalama@hotmail.com, a_issac@sakhr.com Al-Azhar University, Faculty of

More information

Advanced IBM AIX Heap Exploitation. Tim Shelton V.P. Research & Development HAWK Network Defense, Inc. tshelton@hawkdefense.com

Advanced IBM AIX Heap Exploitation. Tim Shelton V.P. Research & Development HAWK Network Defense, Inc. tshelton@hawkdefense.com Advanced IBM AIX Heap Exploitation Tim Shelton V.P. Research & Development HAWK Network Defense, Inc. tshelton@hawkdefense.com Introduction Our society has become dependent on computers and network systems.

More information

Assembly Lesson Function call conventions. November 3, 2005 becoul a/asm/2005/

Assembly Lesson Function call conventions. November 3, 2005  becoul a/asm/2005/ Assembly Lesson Function call conventions November 3, 2005 http://etud.epita.fr/ becoul a/asm/2005/ Copying this document Copying this document Copyright c 2004 ACU, Alexandre Becoulet and Benoit Perrot

More information

CSC 574 Computer and Network Security. Reverse Engineering

CSC 574 Computer and Network Security. Reverse Engineering CSC 574 Computer and Network Security Reverse Engineering Alexandros Kapravelos kapravelos@ncsu.edu (Derived from slides by Chris Kruegel) Introduction Reverse engineering process of analyzing a system

More information

1. General function and functionality of the malware

1. General function and functionality of the malware 1. General function and functionality of the malware The malware executes in a command shell, it begins by checking to see if the executing file contains the MZP file extension, and then continues to access

More information

Introduction to computer and network security. Session 2 : Examples of vulnerabilities and attacks pt1

Introduction to computer and network security. Session 2 : Examples of vulnerabilities and attacks pt1 Introduction to computer and network security Session 2 : Examples of vulnerabilities and attacks pt1 Jean Leneutre jean.leneutre@telecom-paristech.fr Tél.: 01 45 81 78 81 Page 1 Outline I- Introduction

More information

Modern Binary Exploitation Course Syllabus

Modern Binary Exploitation Course Syllabus Modern Binary Exploitation Course Syllabus Course Information Course Title: Modern Binary Exploitation Course Number: CSCI 4968 Credit Hours: 4 Semester / Year: Spring 2015 Meeting Days: Tuesday/Friday

More information

Working with Buffers

Working with Buffers University Hamburg Department of Informatics Scientific Computing Research Group Working with Buffers Seminar Paper Seminar Efficient Programming in C Christoph Brauer 0brauer@informatik.uni-hamburg.de

More information

Title: Bugger The Debugger - Pre Interaction Debugger Code Execution

Title: Bugger The Debugger - Pre Interaction Debugger Code Execution White Paper Title: Bugger The Debugger Pre Interaction Debugger Code Execution Prepared by: Brett Moore Network Intrusion Specialist, CTO SecurityAssessment.com Date: April 2005 Abstract The use of debuggers

More information

EECS 354 Network Security. Introduction

EECS 354 Network Security. Introduction EECS 354 Network Security Introduction Why Learn To Hack Understanding how to break into computer systems allows you to better defend them Learn how to think like an attacker Defense then becomes second-nature

More information

Violating Database - Enforced Security Mechanisms

Violating Database - Enforced Security Mechanisms Violating Database - Enforced Security Mechanisms Runtime Patching Exploits in SQL Server 2000: a case study Chris Anley [chris@ngssoftware.com] 18/06/2002 An NGSSoftware Insight Security Research (NISR)

More information

Automating Mimicry Attacks Using Static Binary Analysis

Automating Mimicry Attacks Using Static Binary Analysis Automating Mimicry Attacks Using Static Binary Analysis Christopher Kruegel and Engin Kirda Technical University Vienna chris@auto.tuwien.ac.at, engin@infosys.tuwien.ac.at Darren Mutz, William Robertson,

More information

esrever gnireenigne tfosorcim seiranib

esrever gnireenigne tfosorcim seiranib esrever gnireenigne tfosorcim seiranib Alexander Sotirov asotirov@determina.com CanSecWest / core06 Reverse Engineering Microsoft Binaries Alexander Sotirov asotirov@determina.com CanSecWest / core06 Overview

More information

Carlos Villavieja, Nacho Navarro {cvillavi,nacho}@ac.upc.edu. Arati Baliga, Liviu Iftode {aratib,liviu}@cs.rutgers.edu

Carlos Villavieja, Nacho Navarro {cvillavi,nacho}@ac.upc.edu. Arati Baliga, Liviu Iftode {aratib,liviu}@cs.rutgers.edu Continuous Monitoring using MultiCores Carlos Villavieja, Nacho Navarro {cvillavi,nacho}@ac.upc.edu Arati Baliga, Liviu Iftode {aratib,liviu}@cs.rutgers.edu Motivation Intrusion detection Intruder gets

More information

Design of a secure system. Example: trusted OS. Bell-La Pdula Model. Evaluation: the orange book. Buffer Overflow Attacks

Design of a secure system. Example: trusted OS. Bell-La Pdula Model. Evaluation: the orange book. Buffer Overflow Attacks Stware Security Holes and Defenses Design a secure system Follows a ring design. Every object has an associated security attribute. Every subject has a security clearance. Least secure Highest security

More information

Computer Architecture and Assembly Language. Practical Session 4

Computer Architecture and Assembly Language. Practical Session 4 Computer Architecture and Assembly Language Practical Session 4 Labels Definition - advanced label: (pseudo) instruction operands ; comment valid characters in labels are: letters, numbers, _, $, #, @,

More information

l Status flags or condition codes are set when the in a zero l Example 1 l mov 0xFFFFFFFF %eax l add 1 %eax

l Status flags or condition codes are set when the in a zero l Example 1 l mov 0xFFFFFFFF %eax l add 1 %eax Machine-Level Programming II: Control Flow Topics Condition Codes Setting Testing Control Flow If-then-else While, for loop Assembly programmer view PC SP BR ALU IR GPR Status Flags ALU: Arithmetic Logic

More information

Hydra. Advanced x86 polymorphic engine. Incorporates existing techniques and introduces new ones in one package. All but one feature OS-independent

Hydra. Advanced x86 polymorphic engine. Incorporates existing techniques and introduces new ones in one package. All but one feature OS-independent Hydra Advanced x86 polymorphic engine Incorporates existing techniques and introduces new ones in one package All but one feature OS-independent Random register operations Different synonymous instructions

More information

From SQL Injection to MIPS Overflows

From SQL Injection to MIPS Overflows From SQL Injection to MIPS Overflows Rooting SOHO Routers Zachary Cutlip Black Hat USA 2012 Acknowledgements Tactical Network Solutions Craig Heffner What I m going to talk about Novel uses of SQL injection

More information

Custom Penetration Testing

Custom Penetration Testing Custom Penetration Testing Compromising a Vulnerability through Discovery and Custom Exploitation Stephen Sims Advanced Penetration Testing - 2009 SANS 1 Objectives Penetration Testing Precompiled Tools

More information

Return-oriented Programming: Exploitation without Code Injection

Return-oriented Programming: Exploitation without Code Injection Return-oriented Programming: Exploitation without Code Injection Erik Buchanan, Ryan Roemer, Stefan Savage, Hovav Shacham University of California, San Diego Bad code versus bad behavior Bad Bad behavior

More information

Operating Systems. Week 2 Recitation: The system call. Paul Krzyzanowski. Rutgers University. Spring 2015

Operating Systems. Week 2 Recitation: The system call. Paul Krzyzanowski. Rutgers University. Spring 2015 Operating Systems Week 2 Recitation: The system call Paul Krzyzanowski Rutgers University Spring 2015 February 14, 2015 2014-2015 Paul Krzyzanowski 1 System calls System calls are an operating system s

More information

TitanMist: Your First Step to Reversing Nirvana TitanMist. mist.reversinglabs.com

TitanMist: Your First Step to Reversing Nirvana TitanMist. mist.reversinglabs.com TitanMist: Your First Step to Reversing Nirvana TitanMist mist.reversinglabs.com Contents Introduction to TitanEngine.. 3 Introduction to TitanMist 4 Creating an unpacker for TitanMist.. 5 References and

More information

CSC 405 Introduction to Computer Security

CSC 405 Introduction to Computer Security CSC 405 Introduction to Computer Security Topic 3. Program Security -- Part II CSC 405 Dr. Peng Ning 1 Targeted Malicious Code General purpose malicious code Affect users and machines indiscriminately

More information

SECURITY APPLICATIONS OF DYNAMIC BINARY TRANSLATION DINO DAI ZOVI THESIS. Submitted in Partial Fulfillment of the Requirements for the Degree of

SECURITY APPLICATIONS OF DYNAMIC BINARY TRANSLATION DINO DAI ZOVI THESIS. Submitted in Partial Fulfillment of the Requirements for the Degree of SECURITY APPLICATIONS OF DYNAMIC BINARY TRANSLATION by DINO DAI ZOVI THESIS Submitted in Partial Fulfillment of the Requirements for the Degree of Bachelor of Science Computer Science The University of

More information

64-Bit NASM Notes. Invoking 64-Bit NASM

64-Bit NASM Notes. Invoking 64-Bit NASM 64-Bit NASM Notes The transition from 32- to 64-bit architectures is no joke, as anyone who has wrestled with 32/64 bit incompatibilities will attest We note here some key differences between 32- and 64-bit

More information

Lecture Overview. INF3510 Information Security Spring 2015. Lecture 4 Computer Security. Meaningless transport defences when endpoints are insecure

Lecture Overview. INF3510 Information Security Spring 2015. Lecture 4 Computer Security. Meaningless transport defences when endpoints are insecure Lecture Overview INF3510 Information Security Spring 2015 Fundamental computer security concepts CPU and OS kernel security mechanisms Virtualization Memory Protection Trusted computing and TPM Lecture

More information

Fast Byte-Granularity Software Fault Isolation

Fast Byte-Granularity Software Fault Isolation Fast Byte-Granularity Software Fault Isolation Miguel Castro, Manuel Costa, Jean-Philippe Martin, Marcus Peinado, Periklis Akritidis, Austin Donnelly, Paul Barham, Richard Black Microsoft Research Cambridge,

More information

The Beast is Resting in Your Memory On Return-Oriented Programming Attacks and Mitigation Techniques To appear at USENIX Security & BlackHat USA, 2014

The Beast is Resting in Your Memory On Return-Oriented Programming Attacks and Mitigation Techniques To appear at USENIX Security & BlackHat USA, 2014 Intelligent Things, Vehicles and Factories: Intel Workshop on Cyberphysical and Mobile Security 2014, Darmstadt, June 11 The Beast is Resting in Your Memory On Return-Oriented Programming Attacks and Mitigation

More information

CS 161 Computer Security

CS 161 Computer Security Paxson Spring 2013 CS 161 Computer Security Homework 1 Due: Friday, February 15, at 10PM Instructions. You must submit this homework electronically. To submit, put a single solution file hw1.pdf in a directory

More information

Defeating Microsoft Windows XP SP2 Heap protection and DEP bypass

Defeating Microsoft Windows XP SP2 Heap protection and DEP bypass Defeating Microsoft Windows XP SP2 Heap protection and DEP bypass Alexander Anisimov, Positive Technologies. ( anisimov[at]ptsecurity.com, HTTP://WWW.PTSECURITY.COM ) Overview Memory protection Buffer

More information

X86-64 Architecture Guide

X86-64 Architecture Guide X86-64 Architecture Guide For the code-generation project, we shall expose you to a simplified version of the x86-64 platform. Example Consider the following Decaf program: class Program { int foo(int

More information

Reverse Engineering and Computer Security

Reverse Engineering and Computer Security Reverse Engineering and Computer Security Alexander Sotirov alex@sotirov.net Introduction Security researcher at Determina, working on our LiveShield product Responsible for vulnerability analysis and

More information

Lecture 03 Bits, Bytes and Data Types

Lecture 03 Bits, Bytes and Data Types Lecture 03 Bits, Bytes and Data Types In this lecture Computer Languages Assembly Language The compiler Operating system Data and program instructions Bits, Bytes and Data Types ASCII table Data Types

More information

Hunting birds. Yuki Koike

Hunting birds. Yuki Koike Hunting birds Yuki Koike Abstract NADA Junior and Senior High School 8-5-1, Uozaki-Kitamachi, Higashinada-ku, Kobe-shi, Hyogo 658-0082, JAPAN poteticalbee@gmail.com Stack Smashing Protection (SSP) is one

More information

Windows XP SP3 Registry Handling Buffer Overflow

Windows XP SP3 Registry Handling Buffer Overflow Windows XP SP3 Registry Handling Buffer Overflow by Matthew j00ru Jurczyk and Gynvael Coldwind Hispasec 1. Basic Information Name Windows XP SP3 Registry Handling Buffer Overflow Class Design Error Impact

More information

Application-Specific Attacks: Leveraging the ActionScript Virtual Machine

Application-Specific Attacks: Leveraging the ActionScript Virtual Machine IBM Global Technology Services April 2008 Application-Specific Attacks: Leveraging the ActionScript Virtual Machine By Mark Dowd X-Force Researcher IBM Internet Security Systems (markdowd@au1.ibm.com)

More information

A Tiny Guide to Programming in 32-bit x86 Assembly Language

A Tiny Guide to Programming in 32-bit x86 Assembly Language CS308, Spring 1999 A Tiny Guide to Programming in 32-bit x86 Assembly Language by Adam Ferrari, ferrari@virginia.edu (with changes by Alan Batson, batson@virginia.edu and Mike Lack, mnl3j@virginia.edu)

More information

Stitching the Gadgets On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection

Stitching the Gadgets On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection USENIX Security Symposium 2014, San Diego, CA, USA Stitching the Gadgets On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection Lucas Davi Intel Collaborative Research Institute for

More information

Operating System Structure

Operating System Structure Operating System Structure Lecture 3 Disclaimer: some slides are adopted from the book authors slides with permission Recap Computer architecture CPU, memory, disk, I/O devices Memory hierarchy Architectural

More information

Code Injection in C and C++ : A Survey of Vulnerabilities and Countermeasures

Code Injection in C and C++ : A Survey of Vulnerabilities and Countermeasures Code Injection in C and C++ : A Survey of Vulnerabilities and Countermeasures Yves Younan Wouter Joosen Frank Piessens Report CW 386, July 2004 n Katholieke Universiteit Leuven Department of Computer Science

More information