Cyber Security Buffer Overflow

Front 1

Buffer

Back 1

Region of memory storage used to temporarly store data while it is being moved from one place to another

Front 2

Buffer Overflow

Back 2

While writing data to a buffer a program overruns the buffer's boundary and ovewrites the adjacent memory.

Front 3

Heap Smashing Attack

Back 3

Corrupting this data to cause the application to overwrite internal structures such as linked list pointers. Overwrites dynamic memory allocation

Front 4

Stack Smashing Attack

Back 4

Can overwrite a local variable near the buffer, ovewrite the return address, ovewrite a function,

Front 5

Anatomy of a Stack

Back 5

Bottom of the stack is higher memory address - fixed

Front 6

Function call sequence

Back 6

Same as stack

Front 7

Exploit Shell Strategy

Back 7

Compile attack code and insert into the buffer we are overflowing

Hint 7

Overwrite return address with the address where the overflow code should jump

Front 8

Counter Measures

Back 8

Safe Languages, Randomization, Bounds Checkers... ect

Front 9

Safe Language

Back 9

Memory management is handled differently - defers to a scheduled time or until memory constrains it

Hint 9

No dangling pointer references

Front 10

Bounds Checkers

Back 10

Adding Bounds, information to all pointers and checking accesses to ensure the bounds have not overflowed

Hint 10

Can also add bound info to pointers, or adding bounds info for all object. Table stores the bounds info - if pointer points out of bounds then error

Front 11

Canaries

Back 11

Canary (random value) is placed on the stack below the return address. When function is done executing canary will be compared to original

Hint 11

not foolproof, can overwrite a local variable to point at the return address, can reorder stack frame and put pointers on top

Front 12

Seperators/Replicators

Back 12

Store the return address somewhere else

Hint 12

Replicate process but maybe change direction of the stack, or change it around in some other way. Makes attacking replicates hard.

Front 13

Execution Monitors

Back 13

Observe application execution in order to enforce policy or detect aberrations.

Hint 13

2 types: Enforce Policies, specific requirements like only files under /downloads can be opened. 2. Detect anomalies, figures out when things are going wrong

Front 14

Taint Tracking

Back 14

A value is tainted if its value carries info about another already tainted value. Doesn't allow this tainted data in trusted places

Front 15

Hardened Libraries

Back 15

Use libraries with functions that have been built to defend against these problems.

Hint 15

Would Check: If a string is properly NULL terminated. That the number of format specifiers are the same as the number of arguments passed in the function

Front 16

Obfuscation of Memory

Back 16

store pointers in "encrypted form" val (XOR) r for a random value r. to use pointer retrieve r and decrypt it first.

Hint 16

Limitation : If attacker needs to overwrite only low order bytes this is easy to foil? Why?

Front 17

NOP Instructions

Back 17

No Operation is an instruction that does nothing. Can be used with an NOP sled

Front 18

Dangling Pointers

Back 18

Pointers that do not point to a valid object of the appropriate type. Memory Safety violations.

Front 19

Address-space layout Randomization (ASLR)

Back 19

Randomizing the memory segment base address. Also randomize space between objects. When they try to point at return address just get error.

Front 20

Instruction-Set Randomization

Back 20

"Encrypts" instructions on a per-process basis while they are in memory and "decrypts" when needed for execution.

Hint 20

If the attacker doesn't have the key its instructions will cause the an execution error. Attacker injects non encrypted code and so can't be used. Slow approach but effective

Front 21

Virtual Memory Defenses

Back 21

Marking memory as "non executable", requires selectively executing specific lines of code at a time

Front 22

NOP sled

Back 22

Allows code to execute when the exact value of the instruction pointer is indeterminate. Slides CPU instruction execution to the final destination - for example the return address.