Software Vulnerability (2)

1

Software Vulnerability

A. Gholami && M. Khajavi

2

• Vulnerability o Intersectiono Managemento Classificationo V-Window

• ISO 27K

• Definitionso Open Groupo ENISA

• Buffer Overflow

• Call Stacko Structure

• Stack Overflowo Infinite Recursion

o Tail Call Optimization

VulnerabilitySystem

InformationAttacker

Attack Surface

3

• Vulnerability o Intersectiono Managemento Classificationo V-Window

• ISO 27K


• Buffer Overflow




SystemFlaw

AttackerAccess

AttackerCapability

Vulnerability

4

• Vulnerability Intersectiono Managemento Classificationo V-Window

• ISO 27K


• Buffer Overflow




IdentifyingMitigatingRemediatingClassifying

5

• Vulnerability Intersection Managemento Classificationo V-Window

• ISO 27K


• Buffer Overflow




• Humidity• Dust• Unprotected Storage

Hardware

• Insufficient Testing• Lack Of Audit TrailSoftware

• Unprotected Communication Lines• Insecure Network ArchitectureNetwork

• Inadequate Security Awareness• Inadequate Recruiting ProcessPersonnel

6

• Vulnerability Intersection Management Classificationo V-Window

• ISO 27K


• Buffer Overflow




Access is removed A security fix is deployed The attacker is disabled

7

• Vulnerability Intersection Management Classification V-Window

• ISO 27K


• Buffer Overflow




• Deliberate Risk Taking• Organizations are encouraged

to assess the security risks

ISO 27000ISO

International Standard Organization

8


• ISO 27K


• Buffer Overflow




Open Group

IBM

Oracle

ETC.

% (Threat Capability) > % (Resistance)

9


• ISO 27K

• Definitions Open Groupo ENISA

• Buffer Overflow




ENISA

European

Network

Information

Security

Agency

Design error compromising the security of the system.

10


• ISO 27K

• Definitions Open Group ENISA

• Buffer Overflow




?Buffer

11


• ISO 27K


• Buffer Overflow




Buffer zone?? [region separating two areas]

Buffer gas? [non flammable gas]

Buffer solution!? [controlling the Ph.]

Buffer

Compute

r Science

Data Buffer

12


• ISO 27K


• Buffer Overflow




Data buffer(computer science)

Area 1 Area 2Buffer storage is limited!

Input Device

[mouse]Keyboard][electronic

chipset data]

MemoryHard Disk Storage

13


• ISO 27K


• Buffer Overflow




14


• ISO 27K


• Buffer Overflow




Insufficient bounds checking

Getting input data

Copying data from one buffer to another

15


• ISO 27K


• Buffer Overflow




First Examplechar A[8] = "";unsigned short B = 1979;

strcpy (A, "excessive");

16


• ISO 27K


• Buffer Overflow




Solution for boundary overrunning

Bounds Checking!

strncpy (A, "excessive", sizeof(A));

17


• ISO 27K


• Buffer Overflow




Second Exampleint main(){ char buff[3]; int pass = 0;

printf("\n Enter the password : \n"); gets(buff);

if(strcmp(buff, “Khu")) printf ("\n Wrong Password \n"); else{ printf ("\n Correct Password \n"); pass = 1; } if(pass) { /* Now Give root or admin rights to user*/ printf ("\n Root privileges given to the user \n"); } return 0;}

18


• ISO 27K


• Buffer Overflow




Let’s the run the program with correct password ‘Khu’ :

Enter the password:KhuCorrect Password

Root privileges given to the user

19


• ISO 27K


• Buffer Overflow




gets() function does checkthe array bounds

Enter the password:Tes

Root privileges given to the user

t

NOT

Wrong Password

20


• ISO 27K


• Buffer Overflow




Call Stack

21


• ISO 27K


• Buffer Overflow




An Example

22


• ISO 27K


• Buffer Overflow




Another Example

23


• ISO 27K


• Buffer Overflow

• Call Stack Structure



If the call stack pointer exceeds the stack bound

Stack Overflow

24


• ISO 27K


• Buffer Overflow




Call stack size

Programming Language

Machine Architecture

Available Memory

25


• ISO 27K


• Buffer Overflow


• Stack Overflow Infinite Recursion


int function(){ function(); return 0;}

Infinite recursion

Each address

Special case in recursion also called “tail recursive”

On The Stack 4 bytes

26


• ISO 27K


• Buffer Overflow




If a function

Returns the result of

calling itself

As its last operation

Tail recursion

27


• ISO 27K


• Buffer Overflow




Exampleunsigned fac_tailrec (unsigned acc, unsigned n){ if (n < 2) return acc; return fac_tailrec (n * acc, n - 1);}

unsigned fac_tailrec (unsigned acc, unsigned n){TOP: if (n < 2) return acc; acc = n * acc; n = n - 1; goto TOP;}

28


• ISO 27K


• Buffer Overflow




Let’s make it clear ;)unsigned fac (unsigned n){ unsigned acc = 1;

for (true ; n > 1 ; --n) acc *= n;

return acc;}

29


• ISO 27K


• Buffer Overflow



Tail Call Optimization

Finished, We Guess!

Documents

Software Vulnerability (2)