Malicious Code Malicious Code for Fun and Profit for Fun and - PowerPoint PPT Presentation

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu mihai@cs.wisc.edu 29 March 2007

SYN Cookies (cont’d) SYN Cookies (cont’d) • SYN cookies are particular choices of initial TCP sequence numbers by TCP servers. • Server sequence number = Client sequence number + t mod 32 (top 5 bits) max segment size (next 3 bit) H K ( cl. IP, cl. port, srv IP, srv port, t ) 29 March 2007 Mihai Christodorescu 2

What is Malicious Code? What is Malicious Code? Viruses, worms, trojans, … Code that breaks your security policy. Attack vector Characteristics Payload Spreading algorithm 29 March 2007 Mihai Christodorescu 3

Outline Outline • Attack Vectors • Payloads • Spreading Algorithms • Case Studies 29 March 2007 Mihai Christodorescu 4

Attack Vectors Attack Vectors • Social engineering “Make them want to run it.” • Vulnerability exploitation “Force your way into the system.” • Piggybacking “Make it run when other programs run.” 29 March 2007 Mihai Christodorescu 5

Social Engineering Social Engineering • Suggest to user that the executable is: – A game. – A desirable picture/movie. – An important document. – A security update from Microsoft. – A security update from the IT department. • Spoofing the sender helps. 29 March 2007 Mihai Christodorescu 6

Outline Outline • Attack Vectors: � Social Engineering � Vulnerability Exploitation � Piggybacking • Payloads • Spreading Algorithms • Case Studies 29 March 2007 Mihai Christodorescu 7

Vulnerability Exploitation Vulnerability Exploitation • Make use of flaws in software input handling. • Sample techniques: – Buffer overflow attacks. – Format string attacks. – Return-to-libc attacks. – SQL injection attacks. 29 March 2007 Mihai Christodorescu 8

Buffer Basic Principles Basic Principles Overflows A buffer overflow occurs when data is stored past the boundaries of an array or a string. The additional data now overwrites nearby program variables. Result: Attacker controls or takes over a currently running process. 29 March 2007 Mihai Christodorescu 9

Buffer Example Example Overflows Expected input: \\hostname\path void process_request process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... process_request( “\\tux12\usr\foo.txt” ); ⇒ � OK OK return; process_request( “\\aaabbbcccdddeeefffggghhh\bar” ); ⇒ � BAD BAD } 29 March 2007 Mihai Christodorescu 10

Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() void process_request process_request( char * req ) { process_request() // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; } strcpy() 29 March 2007 Mihai Christodorescu 11

Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() void process_request process_request( char * req ) { process_request() // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; } strcpy() 29 March 2007 Mihai Christodorescu 12

Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() arg: req req void process_request process_request( char * req ) { process_request() // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; } strcpy() 29 March 2007 Mihai Christodorescu 13

Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() arg: req req void process_request process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; } strcpy() 29 March 2007 Mihai Christodorescu 14

Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() arg: req req void process_request process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; } strcpy() 29 March 2007 Mihai Christodorescu 15

Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() arg: req req void process_request process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; } local: pos pos strcpy() 29 March 2007 Mihai Christodorescu 16

Buffer Normal Execution Normal Execution Overflows process_request( “\\tux12\usr\foo.txt” ); main() arg: req req void process_request process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; } local: pos pos 29 March 2007 Mihai Christodorescu 17

Buffer Normal Execution Normal Execution Overflows process_request( “\\tux12\usr\foo.txt” ); main() arg: req req void process_request process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... 2 \0 return; t u x 1 } local: pos pos 7 29 March 2007 Mihai Christodorescu 18

Buffer Overflow Execution Overflow Execution Overflows process_request( “\\aaabbbcccdddeeefffggghhhiiijjj\bar” ); Characters main() that overwrite arg: req req void process_request process_request( char * req ) j j \0 the return { return address address. i i i j process_request() // Get hostname frame pointer g h h h char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); f f g g strcpy( host, e e e f substr( req, 2, pos – 1 ) ); local: host host c d d d ... b b c c return; a a a b } local: pos pos 32 32 29 March 2007 Mihai Christodorescu 19

Buffer Smashing the Stack Smashing the Stack Overflows The attacker gets one chance to gain control. Craft an input string such that: • The return address is overwritten with a pointer to malicious code. • The malicious code is placed inside the input string. Malicious code can create a root shell by executing “ /bin/sh ”. 29 March 2007 Mihai Christodorescu 20

Buffer Shell Code Shell Code Overflows EB 17 5E 89 76 08 31 C0 Code for exec(“/bin/sh”): 88 46 07 89 46 0C B0 0B mov edx, arg2 mov ecx, arg1 mov ebx, “/bin/sh” 89 F3 8D 4E 08 31 D2 CD mov eax, 0Bh int 80h 80 E8 E4 FF FF FF / b i n / s h \0 arg 2 arg 2 arg 1 pointer Pointer value for overwriting the return address. to code 29 March 2007 Mihai Christodorescu 21

Buffer Thicker Armor Thicker Armor Overflows • Defense against stack-smashing attacks: – Bounds-checking. – Protection libraries. – Non-executable stack. – setuid()/chroot(). – Avoid running programs as root! – Address randomization. – Behavioral monitoring. 29 March 2007 Mihai Christodorescu 22

More Info More Info “Smashing the Stack for Fun and Profit” by Aleph One StackGuard , RAD , PAX , ASLR CERT 29 March 2007 Mihai Christodorescu 23

Format Format String Attacks Format String Attacks Strings • Another way to illegally control program values. • Uses flaws in the design of printf() printf() : printf( “%s: %d” , s, x ); printf( “%s: %d” , s, x ); 29 March 2007 Mihai Christodorescu 24

Format () Operation Operation printf printf() () Strings printf printf () foo() y x printf( “%s: %d, %x”, printf( “%s: %d, %x”, s s, x, y ); s, x, y ); format string ptr printf() 29 March 2007 Mihai Christodorescu 25

Format Attack 1: Read Any Value Attack 1: Read Any Value Strings secret key ptr What the code says: printf( str printf( str ); What the programmer meant: format string ptr printf( “%s”, str ); printf( “%s”, str If str = “ %x%x%x%x%s %x%x%x%x%s ” 29 March 2007 Mihai Christodorescu 26

Format Attack 2: Write to Address Attack 2: Write to Address Strings 4 return address What the code says: printf( str printf( str ); format string ptr If str = “ %x%x%x%x%n %x%x%x%x%n ” 29 March 2007 Mihai Christodorescu 27

Format Defenses Defenses Strings Never use printf() printf() without a format string! FormatGuard. 29 March 2007 Mihai Christodorescu 28

Outline Outline • Attack Vectors: � Social Engineering � Vulnerability Exploitation � Piggybacking • Payloads • Spreading Algorithms • Case Studies 29 March 2007 Mihai Christodorescu 29

Piggybacking Piggybacking Malicious code injected into a benign program or data file. • Host file can be: – An executable. – A document with some executable content (Word documents with macros, etc.). 29 March 2007 Mihai Christodorescu 30