Preventing brute force attacks against stack canary protector on - PowerPoint PPT Presentation

Preventing brute force attacks against stack canary protector on networking servers Hector Marco Preventing brute force attacks against stack canary protector on networking servers Hector Marco-Gisbert , Ismael Ripoll Universit` at Polit` ecnica de Val` encia (Spain) 2013 IEEE 12th International Symposium on Network Computing and Applications August 22-24, 2013

Preventing brute force attacks against stack canary protector on networking servers Hector Marco Table of contents Introduction 1 The problem: Network servers and their threats 2 How we solve it: RAF SSP 3 Conclusions 4

Preventing brute force attacks against stack canary protector on networking servers Hector Marco Introduction Overview Buffer overflows are still a major software threat. [Top 25] One of the most effective protection technique is the stack canary protector (SSP) . Currently employed in most servers: Apache, Lighthttp, etc. Unfortunately, the SSP on network servers is prone to brute force attacks. We have extended the SSP technique to prevent brute force attacks at zero cost: temporal, spacial and implementational!

Preventing brute force attacks against stack canary protector on networking servers Hector Marco Introduction How the Stack Canary Protector works The canary is a random value placed on the stack to detect buffer overflows. When a overflows the canary is corrupted. If the verification of the canary fails → abort() �

Preventing brute force attacks against stack canary protector on networking servers Hector Marco The problem: Network servers and their threats Forking servers Processes created with fork() inherit most of its father state. Father and children have the same canary-reference value. Server group of processes child server child child fork() Clients

Preventing brute force attacks against stack canary protector on networking servers Hector Marco The problem: Network servers and their threats Forking servers Processes created with fork() inherit most of its father state. Father and children have the same canary-reference value. Server group of processes child server child child fork() Clients When the attacker guesses an incorrect value, the child is killed by the SSP and a new child with the same canary is started. The attack is modelled as sampling without replacement .

Preventing brute force attacks against stack canary protector on networking servers Hector Marco The problem: Network servers and their threats Brute force attacks Sampling without replacement allows to build brute force attacks . Full search attack: The frame-canary word is overwritten on each trial. If the guessed word is not correct → abort() . 100% success on 93 hours and 46 hours on average. Byte for byte attack: Attackers control the number of overwritten bytes. Overwrite only the first stack canary byte until child does not crash. (same for following bytes). 100% success on 15 sec. and 7 sec. on average. Note: Some systems (i.e x86) set to zero most significant byte.

Preventing brute force attacks against stack canary protector on networking servers Hector Marco How we solve it: RAF SSP Observations and facts Facts: There is only one single reference-canary per process. The canary integrity check is done at the end of each function before returning. Upon return, only the current frame-canary is checked. Each child process of a network server is an error confinement region .

Preventing brute force attacks against stack canary protector on networking servers Hector Marco How we solve it: RAF SSP Observations and facts Facts: There is only one single reference-canary per process. The canary integrity check is done at the end of each function before returning. Upon return, only the current frame-canary is checked. Each child process of a network server is an error confinement region . Observation: After a fork(), the child process terminates by calling exit().

Preventing brute force attacks against stack canary protector on networking servers Hector Marco How we solve it: RAF SSP Core idea “Renew the reference-canary of the child right after the fork() ” RANDOM Server group of processes child server child child fork() Clients

Preventing brute force attacks against stack canary protector on networking servers Hector Marco How we solve it: RAF SSP Core idea “Renew the reference-canary of the child right after the fork() ” RANDOM Server group of processes child server child child fork() Clients When the attacker guesses an incorrect value, the child is killed by the SSP and a new child with a new canary is started. As a result, brute force attacks can not be built .

Preventing brute force attacks against stack canary protector on networking servers Hector Marco How we solve it: RAF SSP Stack evolution example: 1/21 �� !�� "�� "�� #$!�� #$!��

Preventing brute force attacks against stack canary protector on networking servers Hector Marco How we solve it: RAF SSP Stack evolution example: 2/21 ��%�� !�� "�� "�� #$!�� #$!��

Preventing brute force attacks against stack canary protector on - PowerPoint PPT Presentation

Preventing brute force attacks against stack canary protector on networking servers Hector Marco Preventing brute force attacks against stack canary protector on networking servers Hector Marco-Gisbert , Ismael Ripoll Universit` at Polit`

DynaGuard: Armoring Canary-Based Protections against Brute-force Attacks Theofilos Petsios,

Better than Brute-Force Optimized Hardware Architecture for Effcient Biclique Attacks on AES-128

eb Security Software Studio yslin@DataLAB 1 Common Security Risks Brute-Force Attacks

Mining Threat-intelligence from Billion- scale SSH Brute-Force Attacks Yuming Wu 1 , Phuong M.

Cisco Passwords - Enforcing Minimum Password Length Common Types of Password Attacks Brute-Force

MA/CSSE 473 Day 13 Brute Force Divide and Conquer MA/CSSE 473 Day 13 Student Questions

Jetpack supercharges your self-hosted WordPress site with cool functionality from WordPress.com.

A heap, a stack, a bottle and a rack The Stack Canary Birds The heap Answer: The first three

Preview question What two methods are mentioned in the StackGuard paper to prevent canary

s c a l e When Hardware Attacks Hardwear.io 27 September 2019 1 Attack exploitation space:

Theorems, Algorithms and Brute Force: Building a Census of 3-Manifolds Benjamin Burton School of

MA/CSSE 473 Day 11 Knuth interview Amortization (growable Array) Brute Force Examples MA/CSSE

Banburismus Banburismus British codebreakers used cribs (guesses), brute force, and the and

Complete Search (aka Brute Force) Section 3.13.2 Dr. Mayfield and Dr. Lam Department of

Automatic Translation Error Analysis or how to brute-force through exponential complexity

Understanding brute force Cryptanalyst wants to find secret 128-bit AES key , D. J. Bernstein

Table of Contents Introduction Hacking Web Sites Examples of Attacks Broken

Buffer Overflow Attacks IA32 Linux Stack Higher Addresses Virtual Address Space Heap Data

1 Problem with Brute force Nave Bayes ( ) ( ) ( ) It cannot generalize to unseen

Dynamic programming Topics for this week: - backtracking revisited: a brute-force technique that

MA/CSSE 473 Day 25 Student questions String search Horspool Boyer Moore intro Brute Force,

Topics for this week Backtracking: - a brute-force technique that finds a solution by trying all

Understanding and preventing common attacks Romain Wartel 7th March 2010, ISGC Security

Scalable Multi-core Model Checking: Technology & Applications of Brute Force Part III:

Preventing brute force attacks against stack canary protector on - PowerPoint PPT Presentation

Preventing brute force attacks against stack canary protector on networking servers Hector Marco Preventing brute force attacks against stack canary protector on networking servers Hector Marco-Gisbert , Ismael Ripoll Universit` at Polit`

DynaGuard: Armoring Canary-Based Protections against Brute-force Attacks Theofilos Petsios,

Better than Brute-Force Optimized Hardware Architecture for Effcient Biclique Attacks on AES-128

eb Security Software Studio yslin@DataLAB 1 Common Security Risks Brute-Force Attacks

Mining Threat-intelligence from Billion- scale SSH Brute-Force Attacks Yuming Wu 1 , Phuong M.

Cisco Passwords - Enforcing Minimum Password Length Common Types of Password Attacks Brute-Force

MA/CSSE 473 Day 13 Brute Force Divide and Conquer MA/CSSE 473 Day 13 Student Questions

Jetpack supercharges your self-hosted WordPress site with cool functionality from WordPress.com.

A heap, a stack, a bottle and a rack The Stack Canary Birds The heap Answer: The first three

Preview question What two methods are mentioned in the StackGuard paper to prevent canary

s c a l e When Hardware Attacks Hardwear.io 27 September 2019 1 Attack exploitation space:

Theorems, Algorithms and Brute Force: Building a Census of 3-Manifolds Benjamin Burton School of

MA/CSSE 473 Day 11 Knuth interview Amortization (growable Array) Brute Force Examples MA/CSSE

Banburismus Banburismus British codebreakers used cribs (guesses), brute force, and the and

Complete Search (aka Brute Force) Section 3.13.2 Dr. Mayfield and Dr. Lam Department of

Automatic Translation Error Analysis or how to brute-force through exponential complexity

Understanding brute force Cryptanalyst wants to find secret 128-bit AES key , D. J. Bernstein

Table of Contents Introduction Hacking Web Sites Examples of Attacks Broken

Buffer Overflow Attacks IA32 Linux Stack Higher Addresses Virtual Address Space Heap Data

1 Problem with Brute force Nave Bayes ( ) ( ) ( ) It cannot generalize to unseen

Dynamic programming Topics for this week: - backtracking revisited: a brute-force technique that

MA/CSSE 473 Day 25 Student questions String search Horspool Boyer Moore intro Brute Force,

Topics for this week Backtracking: - a brute-force technique that finds a solution by trying all

Understanding and preventing common attacks Romain Wartel 7th March 2010, ISGC Security

Scalable Multi-core Model Checking: Technology &amp; Applications of Brute Force Part III:

Scalable Multi-core Model Checking: Technology & Applications of Brute Force Part III: