Finishing Buffer Overflow

• There are many other ways a buffer overflow can result in problems.
• There is some level of mitigation or countermeasures for these attacks
  • Programmer:
    • As a programmer always check your index values.
    • And make sure library routines do as well.
  • programmer, OS, compiler, hardware
    • Check lengths before writing.
    • Make sure subscript lengths are within limits.
    • Double check boundary condition code to catch off-by-one errors
    • Only accept the number of characters you can handle in the buffer
    • Use string utilities that bound transfer.
      • strcpy vs strncpy
    • Limit privileges in code.
  • Program controls
    • Code reviews
    • Testing, testing, testing.
    • Code analyzers
      • Why Can't Johnny Fix Vulnerabilities: A Usability Evaluation of Static Analysis Tools for Security
  • Language features
    • Avoid C, C++ and assembly.
      • Low level access (pointers)
      • No, limited, or by-passable safe structures
      • consider .at() vs []
    • Java, Python
      • Do not allow access to low level memory. (No pointers)
      • Integrate required bounds checking.
    • RUST
      • Combination of built in compiler analysis and dynamic checking.
  • Other items
    • See this page
    • Address Space Layout Randomization
      • randomize_va_space
      • /proc/sys/kernel/randomize_va_space
      • This makes finding the return address harder.
      • Du talks about a brute force attack on this
        • For a 32 bit machine there are only $2^19$ different addresses available.
        • or 500,000 possibilities.
        • But some of these just overlap.
        • Essentially they just run the program over and over.
        • After about 12,000 tries, they had root.
    • Non executable stack
      • gcc -z execstack/noexecstack
      • I can't find much on this.
      • But apparently it can be done in hardware.
    • StackGuard or Canaries
      • Protect the area around the return address
      • If this changes, fail.
      • Consider

        void bof(char * str) {
           int guard = secret
        
           char buffer[12]
           strcpy (buffer, str);
        
           if (guard == secret) {
              return;
           }
           exit (1);
        }
                        

      • But secret
        • Must be random.
        • Must not be stored in accessible memory
    • Stackshield
      • Save a copy of the RA somewhere safe.
      • Check on return before you return.
  • -fstack-protector or -fstack-protector-strong
  • Shell countermeasures
    • Programs in linux have three ids, real,effective, user
    • Not all three of these will be set to 1 in buffer smash.
    • But will be in real setuid programs.
    • So the shell can "detect" an attack.
    • But I can easily write my own mini shell.