CSC 2400: Computer Systems Stack Buffer Overflow Attacks Summary - PowerPoint PPT Presentation

Feb 26, 2024 •415 likes •576 views

CSC 2400: Computer Systems Stack Buffer Overflow Attacks Summary Invoking a function ! CALL : call the function ! RET : return from the instruction Stack Frame for a function call includes ! Function arguments ! Return address ! Local

CSC 2400: Computer Systems Stack Buffer Overflow Attacks
Summary • Invoking a function ! CALL : call the function ! RET : return from the instruction • Stack Frame for a function call includes ! Function arguments ! Return address ! Local variables ! Saved registers • Base pointer EBP ! Fixed reference point in the Stack Frame ! Useful for referencing arguments and local variables
int add3(int a, int b, int c) { Function Calls int d; d = a + b + c; return d; • main calls add3 } ! Push arguments on the stack ! Push return address on stack int main() { ! Jump to add3 int sum, avg; ! Allocate local variables on stack, save registers, etc. sum = add3(3, 4, 5); avg = sum / 3; Return return avg Address } • Returning to main Stack Frame for add3 ! Clear the stack frame for add3 ! Pop return address from stack Return Addr. ESP Stack Frame Address 3 for main 4 5
Computer Malware Stack buffer overflow attacks: q •Low •Address buffer buffer Saved EBP valid address •Overflowed Return Address New Return Address •region Malicious code •High •Address •Normal stack •Buffer Overflow Attack Heap buffer overflow are also common (overwrite pointer addresses) q
0 EBP-4 buf[0] buf[1] buf[2] buf[3] EBP Old EBP Return Address (0x08048424)
0 EBP-4 buf[0] 0x31 buf[1] buf[2] buf[3] 0x32 0x33 0x00 EBP Old EBP Old EBP Return Address (0x08048424) Return Address (0x08048424) Before gets After gets
0 EBP-4 buf[0] 0x31 buf[1] buf[2] buf[3] 0x32 0x33 0x34 EBP 0x00 Old EBP ... Return Address (0x08048424) Return Address (0x08048424) Before gets After gets
0 EBP-4 buf[0] 0x31 buf[1] buf[2] buf[3] 0x32 0x33 0x34 EBP 0x35 0x36 0x37 0x00 Old EBP Return Address (0x08048424) Return Address (0x08048424) Before gets After gets
0 EBP-4 buf[0] 0x31 buf[1] buf[2] buf[3] 0x32 0x33 0x34 EBP 0x30 0x30 0x30 0x30 Old EBP 0x35 Return Address (0x08048424) 0x36 0x37 0x38 0x00 Before gets After gets
0 EBP-4 buf[0] 0x31 buf[1] buf[2] buf[3] 0x32 0x33 0x34 EBP Old EBP 0x00000000 Return Address (0x08048472) 0x38373635 0x00 Before gets After gets
0 EBP-4 buf[0] 0x00 buf[1] buf[2] buf[3] 0x00 0x00 0x00 EBP Old EBP Some valid address Return Address (0x08048472) Address of Fire Before gets After gets
#include <string.h> void foo (char *bar) { char c[12]; strcpy(c, bar); // no bounds checking } int main (int argc, char **argv) { foo(argv[1]); return 0; } 13
14
15
16

Recommend

History of the Stack Overflow Buffer Overflow Understood

History of the Stack Overflow Buffer Overflow Understood as early as 1972 Computer Security Technology Planning Study Morris Worm First

1.07k views • 42 slides

Buffer Overflow Attacks IA32 Linux Stack Higher Addresses Virtual Address Space Heap Data

Buffer Overflow Attacks IA32 Linux Stack Higher Addresses Virtual Address Space Heap Data Text Lower Addresses Stack and Base Pointers Stack is made up of stack frames Stack frames contain: parameters, local variables, return

604 views • 45 slides

Buffer Overflows with Content 2 A Process Stack Buffer Overflow Common Techniques employed

1 Buffer Overflows with Content 2 A Process Stack Buffer Overflow Common Techniques employed in buffer overflow exploits to create backdoors Execution of additional network services via the INETD daemon The addition of new users

497 views • 30 slides

Buffer Overflow Attacks & Defenses Slides are borrowed from Franziska Roesner @UW and Dawn

Buffer Overflow Attacks & Defenses Slides are borrowed from Franziska Roesner @UW and Dawn Song @Berkeley Linux (32-bit) process memory layout -0xFFFFFFFF Reserved for Kernal -0xC0000000 user stack %esp shared libraries -0x40000000

994 views • 85 slides

Chapter 10 Buffer Overflow Buffer Overflow Common attack mechanism first wide use by

Chapter 10 Buffer Overflow Buffer Overflow Common attack mechanism first wide use by the Morris Worm in 1988 Prevention techniques known NX bit, stack canaries, ASLR Still of major concern Recent examples:

354 views • 21 slides

Outline Memory safety and security CSci 4271W Stack buffer overflow Development of Secure

Outline Memory safety and security CSci 4271W Stack buffer overflow Development of Secure Software Systems Day 2: Memory Safety Introduction Reversing the stack Stephen McCamant University of Minnesota, Computer Science & Engineering

440 views • 4 slides

CPSC 213 Procedures - 3.7 Out-of-Bounds Memory References and Buffer Overflow - 3.12

Readings for Next 3 Lectures Textbook CPSC 213 Procedures - 3.7 Out-of-Bounds Memory References and Buffer Overflow - 3.12 Introduction to Computer Systems Unit 1e Procedures and the Stack 1 2 Local Variables of a Procedure

201 views • 8 slides

Buffer Overflow CS461/ECE422 Spring 2012 Reading Material

Buffer Overflow CS461/ECE422 Spring 2012 Reading Material Based on Chapter 11 of the text Outline Buffer Overflow Stack Buffer Overflow Shell

783 views • 28 slides

a single gadget weird machine Framing Signals a return to portable shellcode Erik Bosman and

a single gadget weird machine Framing Signals a return to portable shellcode Erik Bosman and Herbert Bos stack buffer overflow stack return addr buffer sp 1 stack buffer overflow stack return addr buffer sp 1 stack buffer overflow

1.65k views • 89 slides

CS241 Computer Organization Spring 2015 Buffer Overflow 4-022015 Outline Linking

CS241 Computer Organization Spring 2015 Buffer Overflow 4-022015 Outline Linking & Loading, continued Buffer Overflow Read: CSAPP2: section 3.12: out-of-bounds memory references & buffer overflow K&R:

775 views • 43 slides

Re-arquitetando o Re-arquitetando o Stack Overflow Stack Overflow ou como construmos o Stack

Re-arquitetando o Re-arquitetando o Stack Overflow Stack Overflow ou como construmos o Stack Overflow for Teams Roberta Arcoverde 1 /whois /whois recifense programadora h 15 anos principal software developer na stack overflow

711 views • 52 slides

CPSC 213 Introduction to Computer Systems Unit 1e Procedures and the Stack Readings for Next 3

CPSC 213 Introduction to Computer Systems Unit 1e Procedures and the Stack Readings for Next 3 Lectures Textbook Procedures - 3.7 Out-of-Bounds Memory References and Buffer Overflow - 3.12 Local Variables of a Procedure public

331 views • 16 slides

Buffer Overflows and Defenses CS 419: Computer Security Lecture 10 and 11 Buffer Overflow a

Buffer Overflows and Defenses CS 419: Computer Security Lecture 10 and 11 Buffer Overflow a very common attack mechanism from 1988 Morris Worm to Code Red, Slammer, Sasser and many others prevention techniques known still of major concern

873 views • 53 slides

Software Security: Buffer Overflow Attacks Fall 2017 Franziska (Franzi) Roesner

CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner, John

703 views • 27 slides

Software Security: Buffer Overflow Attacks (continued) Fall 2016 Ada (Adam) Lerner

CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks (continued) Fall 2016 Ada (Adam) Lerner lerner@cs.washington.edu Thanks to Franzi Roesner, Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno,

577 views • 43 slides

Software Security: Buffer Overflow Attacks Autumn 2020 Franziska (Franzi) Roesner

CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks Autumn 2020 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner, John

517 views • 29 slides

Buffer Overflow Attack Outline Understanding of Stack Layout Vulnerable code

Buffer Overflow Attack Outline Understanding of Stack Layout Vulnerable code Challenges in exploitation Shellcode Countermeasures Program Memory Stack a,b, ptr ptr points to the memory here y x Order of the function

368 views • 36 slides

Software Security: Buffer Overflow Attacks Fall 2016 Adam (Ada) Lerner lerner@cs.washington.edu

CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks Fall 2016 Adam (Ada) Lerner lerner@cs.washington.edu Thanks to Franzi Roesner, Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, John

559 views • 41 slides

Stack Smashing as of Today A State-of-the-Art Overview on Buffer Overflow Protections on

\x90\x90\x90\x90\x90\x90\x90\x90 Stack Smashing as of Today A State-of-the-Art Overview on Buffer Overflow Protections on linux_x86_64 <fritsch+blackhat@in.tum.de> Hagen Fritsch Technische Universitt Mnchen Black Hat Europe

928 views • 49 slides

Evolution of Stack Overflow Discussions Using Sentimental Analysis on Comments in Stack Overflow

Evolution of Stack Overflow Discussions Using Sentimental Analysis on Comments in Stack Overflow Posts Presented by Norbert Eke and Saraj Manes Motivation SOTorrent 2018 : Reconstructing and Analyzing the Evolution of Stack Overflow

547 views • 17 slides

Buffer Overflow overflows Defenses and other memory safety vulnerabilities Finish overflow

Last time We continued By looking at Buffer Overflow overflows Defenses and other memory safety vulnerabilities Finish overflow attacks & other vulnerabilities Overflow defenses Everything youve always wanted to know about

2.41k views • 197 slides

CSC 2400: Computer Systems Using the Stack for Function Calls Lecture Goals int add3(int a, int

CSC 2400: Computer Systems Using the Stack for Function Calls Lecture Goals int add3(int a, int b, int c) { int d; How are function calls d = a + b + c; implemented at the return d; } machine level? int main() { int sum, avg;

782 views • 42 slides

Software Vulnerability I Presenter: Yinzhi Cao Lehigh University Overview Buffer Overflow

CSE350/450 Lehigh University Fall 2016 Software Vulnerability I Presenter: Yinzhi Cao Lehigh University Overview Buffer Overflow Shellcode Heap Overflow Format Strings Return-oriented Programming Metasploit 101 Anatomy of the Stack

1.83k views • 124 slides

Security: Buffer Overflows and Defenses CS 416: Operating Systems Design Department of Computer

Security: Buffer Overflows and Defenses CS 416: Operating Systems Design Department of Computer Science Rutgers University http://www.cs.rutgers.edu/~vinodg/416 Buffer Overflow a very common attack mechanism from 1988 Morris Worm to Code Red,

950 views • 55 slides