PPT-Exploits Buffer Overflows and Format String Attacks

David Brumley Carnegie Mellon University You will find a t least one error on each set of slides 2 Red format c Blue vs 3 An Epic Battle Red format c Blue Bug 4 Find Exploitable. More over buffer overflow vulnerabilities dominate the area of remote network penetra tion vulnerabilities where an anonymous Inter net user seeks to gain partial or total control of a host If buffer overflow vulnerabilities could be effectively eli More over buffer overflow vulnerabilities dominate the area of remote network penetra tion vulnerabilities where an anonymous Inter net user seeks to gain partial or total control of a host If buffer overflow vulnerabilities could be effectively eli More over buffer overflow vulnerabilities dominate the area of remote network penetra tion vulnerabilities where an anonymous Inter net user seeks to gain partial or total control of a host If buffer overflow vulnerabilities could be effectively eli BUFFER t;78typedefstructconnf9STATIC BUFFER tread buf;10...//omitted11gCONN t;1213staticvoidserverlog(LOG TYPE ttype,14constcharformat,...)15f16...//omitted17if(format!=NULL)f18va start(ap,format);19 . Attacker’s goal. :. Take over target machine (e.g. web server). Execute arbitrary code on target by . hijacking application control flow. This lecture: three examples.. Buffer overflow attacks. Overflow Example. Dan Fleck. CS469 Security Engineering. Reference: . http://. www.thegeekstuff.com. /2013/06/buffer-overflow/ . Coming up: Buffer Overflows. 1. 1. Buffer Overflows. Buffer overflows occur when some sized portion of memory is overwritten with something bigger.. Gabe Kanzelmeyer. CS 450. 4/14/10. Overview. What is buffer overflow?. How memory is processed and the stack. The threat. Stack overrun attack. Dangers. Prevention. What is buffer overflow?. A buffer (array/string) that holds data. C memory layout. We talked about the heap and stack last time.. Heap: dynamically allocated data (so grows and shrinks depending on objects created). Stack: grows and shrinks as functions are called and return. Serious Note. Try a web search for “buffer overflow exploit”.. Check alt.2600, rootshell.com, antionline.com – you can find long lists of . exploits. based on buffer overflow.. Even the original version of . What is an Exploit?. An . exploit. . is any . input. (i.e., a piece of software, an argument string, or sequence of commands) that takes advantage of a bug, glitch or vulnerability in order to cause an attack. Many . of the following slides are . based on those . from . Complete . Powerpoint. Lecture Notes for. Computer Systems: A Programmer's Perspective (CS:APP). Randal E. Bryant. and . David R. . O'Hallaron. Chih. Hung Wang. Reference:. 1. B. Chess and J. West, Secure Programming with Static Analysis, Addison-Wesley, 2007.. 2. R. C. . Seacord. , Secure Coding in C and C , Addison-Wesley, 2006.. 1. Introduction (1). Where are we?. We have been investigating buffer overflows. Understand the intricacies of injecting malicious code. Coming up soon!. OWASP . 10. Cryptography, .... Defenses against heap overflows. Attacks against defenses against heap overflows. A . buffer is a contiguous allocated chunk of memory. , such as pointers, arrays, lists, etc.. Languages like C and C++ do not feature automatic bounds checking on the buffer, so it can be bypassed..