HeapHopper. Bringing Bounded Model Checking to Heap Implementation Security
|
|
|
- Olivia Murphy
- 5 years ago
- Views:
Transcription
1 HeapHopper Bringing Bounded Model Checking to Heap Implementation Security Moritz Eckert*, Antonio Bianchi*, Ruoyu Wang*, Yan Shoshitaishvili, Christopher Kruegel*, and Giovanni Vigna* *University of California, Santa Barbara Arizona State University The University of Iowa
2 Poison NULL Byte Attack Complex attacking-technique discovered by Chris Evans Only needs an overflow of a single NULL byte Leverages that to a full overlapping chunk Attacker gains full control over chunk and metadata A patch was introduced by Chris Evans himself: Did we finally nail off-by-one NULL byte overwrites in the glibc heap? Only time will tell! 2
3 Poison NULL Byte Attack The answer is No. After the usual long proposal phase the patch was considered being good and finally merged Within days someone found a bypass 3
4 Motivation Manually managing dynamic memory is hard Bugs are common Metadata corruption is a valuable target for attackers Checks are introduced in a nonsystematic way 4
5 HeapHopper 5
6 Heap Interaction Models 6
7 Heap Interaction Models 7
8 Model Transactions Heap-state Mapped memory Allocated chunks Freed chunks... Malloc Free Overflow... New Heap-state Mapped memory Allocated chunks Freed chunks... 8
9 Model Transactions Malloc Free Overflow... 9
10 Transactions Currently supported transactions Usages Malloc Free Miss-Usages Overflow Use-After-Free (UAF) Double Free Fake Free 10
11 Allocated chunk with symbolic attributes Malloc (M) Addr: x Size: y Re tur ns Metadata Size parameter Symbolic value: 20 or 200 or 2000 malloc Con stra ins ies dif Mo if size < 100:... if size < 500:... Heap state 11
12 Use-After-Free (UAF) Potential metadata overwritten with symbolic bytes Freed chunk Metadata Symbolic Data Addr: x Size: y UAF M od Symbolic data Addr: x Size: y ifie s Heap state 12
13 Interaction Models Transactions All permutations of Transactions bounded by a maximum depth Permutation Source Code Filtered with a set of rules Consider semantics Existence of at least one malicious transactions Transform to source code Binary Placeholders for the symbolic memory Compiled to binaries 13
14 Model Checking 14
15 Model Checking 15
16 Symbolic Execution Executing the library code Emulating system calls such as mmap, brk Using Depth First Search angr 16
17 Identifying Security Violations Checking for one of the following states Overlapping Allocation (OA) Non-Heap Allocation (NHA) Arbitrary Write (AW) / Arbitrary Write Constraint (AWC) Memory write issued in allocator code with a symbolic address as the destination Representing a attacker controlled write 17
18 PoC Generation 18
19 PoC Generation 19
20 PoC Generation int main(void) { // Allocation ctrl_data_0.global_var = malloc( 0x80); ctrl_data_0.global_var[0] = &write_target; ctrl_data_0.global_var[1] = &write_target; ctrl_data_0.global_var[2] = 0x0; ctrl_data_0.global_var[3] = 0x0;... // VULN: Overflow offset = mem2chunk_offset; (ctrl_data_1.global_var-offset)[0] = 0x90; (ctrl_data_1.global_var-offset+0x8)[0] = 0x90; write_target[0] = 0x0; write_target[1] = 0x0; write_target[2] = ctrl_data_0.global_var + 8; write_target[3] = ctrl_data_0.global_var + 0; free(ctrl_data_1.global_var); } Symbolic allocation sizes Symbolic memory content Symbolic overflow data 20
21 HeapHopper 21
22 Limitations Bounded by depth when creating permutations Bounded by memory Bounded by time 22
23 Evaluation 23
24 Allocator Comparison Allocator OA NHA AWC AW dlmalloc (M,F,O): M-M-M-F-O-M (M,F,UAF): M-M-M-F-UAF-M-M (M,FF): FF-M (M,F,O): M-M-O-F-M (M,F,UAF): M-M-F-UAF-M-M dlmalloc (M,F,O): M-M-M-F-O-M (M,F,UAF): M-M-M-F-UAF-M-M musl (M,F,O): M-M-M-F-O-M (M,F,UAF): M-M-M-F-UAF-M-M (M,FF): FF-M (M,F,UAF): M-M-F-UAF-M-M (M,F,FF): M-FF-F (M,F,UAF): M-M-F-UAF-M (M,F,FF): M-M-F-FF-M-M ptmalloc 2.23 (M,F,O): M-M-M-F-O-M (M,F,UAF): M-M-M-F-UAF-M-M (M,FF): FF-M (M,F,O): M-M-M-O-F-M (M,F,UAF): M-M-F-UAF-M-M (M-F-FF): M-FF-F (M,F,O): M-M-O-F (M,F,UAF): M-M-F-UAF-M ptmalloc 2.26 (M,F,O): M M-O-F-M (M,F,UAF): M-M-M-F-UAF-M-M (M,FF): FF-M (M,F,UAF): M-M-F-UAF-M-M (M,F,FF): M-FF-F (M,F,O): M-M-O-F (M,F,UAF): M-M-F-UAF-M (M,F,O): M-M-M-F-O-O-F (M,F,UAF): M-M-F-UAF-M (M-F-FF): M-FF-F Overflow (O), Free (F), Use-After-Free (UAF), Double Free (DF), Fake Free (FF) 24
25 Allocator Comparison Allocator OA NHA AWC AW dlmalloc (M,F,O): M-M-M-F-O-M (M,F,UAF): M-M-M-F-UAF-M-M (M,FF): FF-M (M,F,O): M-M-O-F-M (M,F,UAF): M-M-F-UAF-M-M dlmalloc (M,F,O): M-M-M-F-O-M (M,F,UAF): M-M-M-F-UAF-M-M musl (M,F,O): M-M-M-F-O-M (M,F,UAF): M-M-M-F-UAF-M-M (M,FF): FF-M (M,F,UAF): M-M-F-UAF-M-M (M,F,FF): M-FF-F (M,F,UAF): M-M-F-UAF-M (M,F,FF): M-M-F-FF-M-M ptmalloc 2.23 (M,F,O): M-M-M-F-O-M (M,F,UAF): M-M-M-F-UAF-M-M (M,FF): FF-M (M,F,O): M-M-M-O-F-M (M,F,UAF): M-M-F-UAF-M-M (M-F-FF): M-FF-F (M,F,O): M-M-O-F (M,F,UAF): M-M-F-UAF-M ptmalloc 2.26 (M,F,O): M M-O-F-M (M,F,UAF): M-M-M-F-UAF-M-M (M,FF): FF-M (M,F,UAF): M-M-F-UAF-M-M (M,F,FF): M-FF-F (M,F,O): M-M-O-F (M,F,UAF): M-M-F-UAF-M (M,F,O): M-M-M-F-O-O-F (M,F,UAF): M-M-F-UAF-M (M-F-FF): M-FF-F Overflow (O), Free (F), Use-After-Free (UAF), Double Free (DF), Fake Free (FF) 25
26 Poison NULL Byte Attack Challenging because of high depth Verified that HeapHopper finds attack Verified that HeapHopper finds patch bypass Developed a new patch and verified that HeapHopper does not find a bypass We are trying to upstream this patch 26
27 Questions? 27
Memory management. Johan Montelius KTH
Memory management Johan Montelius KTH 2017 1 / 22 C program # include int global = 42; int main ( int argc, char * argv []) { if( argc < 2) return -1; int n = atoi ( argv [1]); int on_stack
ECE 598 Advanced Operating Systems Lecture 10
ECE 598 Advanced Operating Systems Lecture 10 Vince Weaver http://www.eece.maine.edu/~vweaver vincent.weaver@maine.edu 17 February 2015 Announcements Homework #1 and #2 grades, HW#3 Coming soon 1 Various
Dnmaloc: a more secure memory allocator
Dnmaloc: a more secure memory allocator 28 September 2005 Yves Younan, Wouter Joosen, Frank Piessens and Hans Van den Eynden DistriNet, Department of Computer Science Katholieke Universiteit Leuven Belgium
Dynamic Memory Allocation. Zhaoguo Wang
Dynamic Memory Allocation Zhaoguo Wang Why dynamic memory allocation? Do not know the size until the program runs (at runtime). #define MAXN 15213 int array[maxn]; int main(void) { int i, n; scanf("%d",
Lecture 4 September Required reading materials for this class
EECS 261: Computer Security Fall 2007 Lecture 4 September 6 Lecturer: David Wagner Scribe: DK Moon 4.1 Required reading materials for this class Beyond Stack Smashing: Recent Advances in Exploiting Buffer
ECE 598 Advanced Operating Systems Lecture 12
ECE 598 Advanced Operating Systems Lecture 12 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 1 March 2018 Announcements Next homework will be due after break. Midterm next Thursday
SA30228 / CVE
Generated by Secunia 29 May, 2008 5 pages Table of Contents Introduction 2 Technical Details 2 Exploitation 4 Characteristics 4 Tested Versions 5 Fixed Versions 5 References 5 Generated by Secunia 29 May,
Lecture 1: Buffer Overflows
CS5431 Computer Security Practicum Spring 2017 January 27, 2017 1 Conficker Lecture 1: Buffer Overflows Instructor: Eleanor Birrell In November 2008, a new piece of malware was observed in the wild. This
Lecture 07 Heap control data. Stephen Checkoway University of Illinois at Chicago
Lecture 07 Heap control data Stephen Checkoway University of Illinois at Chicago Layout of program memory Heap is managed by malloc - Many different malloc implementations - glibc uses a modified version
Heap Off by 1 Overflow Illustrated. Eric Conrad October 2007
Heap Off by 1 Overflow Illustrated Eric Conrad October 2007 1 The Attack Older CVS versions are vulnerable to an Off by 1 attack, where an attacker may insert one additional character into the heap CVS
Ramblr. Making Reassembly Great Again
Ramblr Making Reassembly Great Again Ruoyu Fish Wang, Yan Shoshitaishvili, Antonio Bianchi, Aravind Machiry, John Grosen, Paul Grosen, Christopher Kruegel, Giovanni Vigna Motivation Available Solutions
Secure Coding in C and C++ Dynamic Memory Management Lecture 5 Jan 29, 2013
Secure Coding in C and C++ Dynamic Memory Management Lecture 5 Jan 29, 2013 Acknowledgement: These slides are based on author Seacord s original presentation Issues Dynamic Memory Management Common Dynamic
Secure Coding in C and C++
Secure Coding in C and C++ Dynamic Memory Management Lecture 5 Sept 21, 2017 Acknowledgement: These slides are based on author Seacord s original presentation Issues Dynamic Memory Management Common Dynamic
Digital Forensics Lecture 02 PDF Structure
Digital Forensics Lecture 02 PDF Structure PDF Files Structure Akbar S. Namin Texas Tech University Spring 2017 PDF Format and Structure Tools used Text editor (e.g., vi) ClamAV antivirus (http://www.clamav.net/lang/en/download/
Homework 3 CS161 Computer Security, Fall 2008 Assigned 10/07/08 Due 10/13/08
Homework 3 CS161 Computer Security, Fall 2008 Assigned 10/07/08 Due 10/13/08 For your solutions you should submit a hard copy; either hand written pages stapled together or a print out of a typeset document
A program execution is memory safe so long as memory access errors never occur:
A program execution is memory safe so long as memory access errors never occur: Buffer overflows, null pointer dereference, use after free, use of uninitialized memory, illegal free Memory safety categories
Illustration of the problem
NTIC : Using a customized malloc on Solaris 8 and 0. This page last changed on Jun 24, 2008 by sable. Sungard GP3 uses a virtual machine called "Magnum Runtime" to execute applications written with an
Cling: A Memory Allocator to Mitigate Dangling Pointers. Periklis Akritidis
Cling: A Memory Allocator to Mitigate Dangling Pointers Periklis Akritidis --2010 Use-after-free Vulnerabilities Accessing Memory Through Dangling Pointers Techniques : Heap Spraying, Feng Shui Manual
CSE 509: Computer Security
CSE 509: Computer Security Date: 2.16.2009 BUFFER OVERFLOWS: input data Server running a daemon Attacker Code The attacker sends data to the daemon process running at the server side and could thus trigger
Software Security II: Memory Errors - Attacks & Defenses
1 Software Security II: Memory Errors - Attacks & Defenses Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab1 Writeup 3 Buffer overflow Out-of-bound memory writes (mostly sequential) Allow
2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks
Runtime attacks are major threats to today's applications Control-flow of an application is compromised at runtime Typically, runtime attacks include injection of malicious code Reasons for runtime attacks
malloc() is often used to allocate chunk of memory dynamically from the heap region. Each chunk contains a header and free space (the buffer in which
Heap Overflow malloc() is often used to allocate chunk of memory dynamically from the heap region. Each chunk contains a header and free space (the buffer in which data are placed). The header contains
Stack Vulnerabilities. CS4379/5375 System Security Assurance Dr. Jaime C. Acosta
1 Stack Vulnerabilities CS4379/5375 System Security Assurance Dr. Jaime C. Acosta Part 1 2 3 An Old, yet Still Valid Vulnerability Buffer/Stack Overflow ESP Unknown Data (unused) Unknown Data (unused)
Intrusion Detection and Malware Analysis
Intrusion Detection and Malware Analysis Host Based Attacks Pavel Laskov Wilhelm Schickard Institute for Computer Science Software security threats Modification of program code viruses and self-replicating
Automatic Binary Exploitation and Patching using Mechanical [Shell]Phish University of California, Santa Barbara (UCSB)
![Automatic Binary Exploitation and Patching using Mechanical [Shell]Phish University of California, Santa Barbara (UCSB)](/thumbs/84/89116457.jpg "Automatic Binary Exploitation and Patching using Mechanical [Shell]Phish University of California, Santa Barbara (UCSB)")
Automatic Binary Exploitation and Patching using Mechanical [Shell]Phish Antonio Bianchi antoniob@cs.ucsb.edu University of California, Santa Barbara (UCSB) HITCON Pacific December 2nd, 2016 Shellphish
Week 5, continued. This is CS50. Harvard University. Fall Cheng Gong
This is CS50. Harvard University. Fall 2014. Cheng Gong Table of Contents News... 1 Buffer Overflow... 1 Malloc... 6 Linked Lists... 7 Searching... 13 Inserting... 16 Removing... 19 News Good news everyone!
CMPSC 497 Buffer Overflow Vulnerabilities
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CMPSC 497 Buffer Overflow
Memory Corruption 101 From Primitives to Exploit
Memory Corruption 101 From Primitives to Exploit Created by Nick Walker @ MWR Infosecurity / @tel0seh What is it? A result of Undefined Behaviour Undefined Behaviour A result of executing computer code
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Spring 2018, Lecture 6 Low Level Software Security IV: Heap Corruption Memory management in C The C programming language uses explicit memory management Data is
Software Vulnerabilities August 31, 2011 / CS261 Computer Security
Software Vulnerabilities August 31, 2011 / CS261 Computer Security Software Vulnerabilities...1 Review paper discussion...2 Trampolining...2 Heap smashing...2 malloc/free...2 Double freeing...4 Defenses...5
CNIT 127: Exploit Development. Ch 18: Source Code Auditing. Updated
CNIT 127: Exploit Development Ch 18: Source Code Auditing Updated 4-10-17 Why Audit Source Code? Best way to discover vulnerabilities Can be done with just source code and grep Specialized tools make it
Last week. Data on the stack is allocated automatically when we do a function call, and removed when we return
Last week Data can be allocated on the stack or on the heap (aka dynamic memory) Data on the stack is allocated automatically when we do a function call, and removed when we return f() {... int table[len];...
CSC 591 Systems Attacks and Defenses Stack Canaries & ASLR
CSC 591 Systems Attacks and Defenses Stack Canaries & ASLR Alexandros Kapravelos akaprav@ncsu.edu How can we prevent a buffer overflow? Check bounds Programmer Language Stack canaries [...more ] Buffer
Leveraging CVE for ASLR Bypass & RCE. Gal De Leon & Nadav Markus
Leveraging CVE-2015-7547 for ASLR Bypass & RCE Gal De Leon & Nadav Markus 1 Who We Are Nadav Markus, Gal De-Leon Security researchers @ PaloAltoNetworks Vulnerability research and exploitation Reverse
Analysis of MS Multiple Excel Vulnerabilities
Analysis of MS-07-036 Multiple Excel Vulnerabilities I. Introduction This research was conducted using the Office 2003 Excel Viewer application and the corresponding security patch for MS-07-036 - Vulnerabilities
Memory Corruption 2. Advanced Internet Security
Memory Corruption 2 Advanced Internet Security Adrian Dabrowski, Georg Merzdovnik, Aljosha Judmayer, Johanna Ullrich, Markus Kammerstätter, Stefan Riegler, Christian Kudera 1 News from the Lab 75 solved
Buffer Overflow and Protection Technology. Department of Computer Science,
Buffer Overflow and Protection Technology Department of Computer Science, Lorenzo Cavallaro Andrea Lanzi Table of Contents Introduction
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 2
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 2 Announcements First project is on the web Due: Feb. 1st at midnight Form groups of 2 or 3 people If you need help finding a group,
Agenda. Dynamic Memory Management. Robert C. Seacord. Secure Coding in C and C++
Dynamic Memory Management Secure Coding in C and C++ Robert C. Seacord CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 The CERT Coordination
CNIT 127: Exploit Development. Ch 14: Protection Mechanisms. Updated
CNIT 127: Exploit Development Ch 14: Protection Mechanisms Updated 3-25-17 Topics Non-Executable Stack W^X (Either Writable or Executable Memory) Stack Data Protection Canaries Ideal Stack Layout AAAS:
Play with FILE Structure Yet Another Binary Exploitation Technique. Abstract
Play with FILE Structure Yet Another Binary Exploitation Technique An-Jie Yang (Angelboy) angelboy@chroot.org Abstract To fight against prevalent cyber threat, more mechanisms to protect operating systems
Computer Science 50: Introduction to Computer Science I Harvard College Fall Quiz 0 Solutions. Answers other than the below may be possible.
Quiz 0 Solutions Answers other than the below may be possible. Short Answers. 0. :-) 1. 10111111 + 00000001 11000000 2. For efficiency, characters printed to stdout are buffered until a newline is printed
Illustration of the problem
NTIC : Using a customized malloc on AIX 5.2 and 5.3 This page last changed on Jun 24, 2008 by sable. Sungard GP3 uses a virtual machine called "Magnum Runtime" to execute applications written with an inhouse
Secure Software Programming and Vulnerability Analysis
Secure Software Programming and Vulnerability Analysis Christopher Kruegel chris@auto.tuwien.ac.at http://www.auto.tuwien.ac.at/~chris Heap Buffer Overflows and Format String Vulnerabilities Secure Software
Jailbreaking. Apple Watch. Max Bazaliy. December 4-7, 2017
1 2 Jailbreaking 3 4 5 Apple Watch 6 7 8 9 Max Bazaliy 10 11 12 whoami 1 2 3 o Security researcher at Lookout o ios/tvos/watchos jailbreak author o Lead researcher on Pegasus exploit chain o Focused on
PRESENTED BY: SANTOSH SANGUMANI & SHARAN NARANG
PRESENTED BY: SANTOSH SANGUMANI & SHARAN NARANG Table of contents Introduction Binary Disassembly Return Address Defense Prototype Implementation Experimental Results Conclusion Buffer Over2low Attacks
LAVA: Large-scale Automated Vulnerability Addition
LAVA: Large-scale Automated Vulnerability Addition Engin Kirda Andrea Mambretti Wil Robertson Northeastern University Brendan Dolan-Gavitt NYU Tandon Patrick Hulin, Tim Leek, Fredrich Ulrich, Ryan Whelan
Process Layout, Function Calls, and the Heap
Process Layout, Function Calls, and the Heap CS 6 Spring 20 Prof. Vern Paxson TAs: Devdatta Akhawe, Mobin Javed, Matthias Vallentin January 9, 20 / 5 2 / 5 Outline Process Layout Function Calls The Heap
Bypassing Mitigations by Attacking JIT Server in Microsoft Edge
Bypassing Mitigations by Attacking JIT Server in Microsoft Edge Ivan Fratric Infiltrate 2018 About me Security researcher at Google Project Zero Previously: Google Security Team, Academia (UNIZG) Doing
Steal this Movie. Automatically Bypassing DRM Protection in Streaming Media Services
Steal this Movie Automatically Bypassing DRM Protection in Streaming Media Services Ruoyu Fish Wang 12, Yan Shoshitaishvili 1, Christopher Kruegel 1, Giovanni Vigna 1 1 UC Santa Barbara 2 Tsinghua Unversity
Stack Overflow COMP620
Stack Overflow COMP620 There are two kinds of people in America today: those who have experienced a foreign cyber attack and know it, and those who have experienced a foreign cyber attack and don t know
PlatPal: Detecting Malicious Documents with Platform Diversity
PlatPal: Detecting Malicious Documents with Platform Diversity Meng Xu and Taesoo Kim Georgia Institute of Technology 1 Malicious Documents On the Rise 2 3 4 Adobe Components Exploited Element parser JavaScript
Lecture Embedded System Security A. R. Darmstadt, Runtime Attacks
2 ARM stands for Advanced RISC Machine Application area: Embedded systems Mobile phones, smartphones (Apple iphone, Google Android), music players, tablets, and some netbooks Advantage: Low power consumption
Protection and Mitigation of Software Bug Exploitation
Protection and Mitigation of Software Bug Exploitation Vartan Padaryan vartan@ispras.ru 1 How safe is latest Linux release? Command line arguments fuzzer (inspired by Brumley s article) Launch programs
SoK: Eternal War in Memory
SoK: Eternal War in Memory László Szekeres, Mathias Payer, Tao Wei, Dawn Song Presenter: Wajih 11/7/2017 Some slides are taken from original S&P presentation 1 What is SoK paper? Systematization of Knowledge
Defeat Exploit Mitigation Heap Attacks. compass-security.com 1
Defeat Exploit Mitigation Heap Attacks compass-security.com 1 ASCII Armor Arbitrary Write Overflow Local Vars Exploit Mitigations Stack Canary ASLR PIE Heap Overflows Brute Force Partial RIP Overwrite
ISA564 SECURITY LAB. Code Injection Attacks
ISA564 SECURITY LAB Code Injection Attacks Outline Anatomy of Code-Injection Attacks Lab 3: Buffer Overflow Anatomy of Code-Injection Attacks Background About 60% of CERT/CC advisories deal with unauthorized
Runtime Defenses against Memory Corruption
CS 380S Runtime Defenses against Memory Corruption Vitaly Shmatikov slide 1 Reading Assignment Cowan et al. Buffer overflows: Attacks and defenses for the vulnerability of the decade (DISCEX 2000). Avijit,
Oracle Developer Studio Code Analyzer
Oracle Developer Studio Code Analyzer The Oracle Developer Studio Code Analyzer ensures application reliability and security by detecting application vulnerabilities, including memory leaks and memory
DHCP is hard. Felix Wilhelm HITB Dubai 2018
DHCP is hard. Felix Wilhelm HITB Dubai 2018 A story of 5 bugs Intro Dynamic Host Configuration Protocol (DHCP) is a 25 year old protocol designed to dynamically assign an IP address and other related config
UniSan: Proactive Kernel Memory Initialization to Eliminate Data Leakages
UniSan: Proactive Kernel Memory Initialization to Eliminate Data Leakages Kangjie Lu, Chengyu Song, Taesoo Kim, Wenke Lee School of Computer Science, Georgia Tech Any Problem Here? /* File: drivers/usb/core/devio.c*/
Buffer overflow prevention, and other attacks
Buffer prevention, and other attacks Comp Sci 3600 Security Outline 1 2 Two approaches to buffer defense Aim to harden programs to resist attacks in new programs Run time Aim to detect and abort attacks
IAGO ATTACKS: WHY THE SYSTEM CALL API IS A BAD UNTRUSTED RPC INTERFACE
IAGO ATTACKS: WHY THE SYSTEM CALL API IS A BAD UNTRUSTED RPC INTERFACE Stephen Checkoway and Hovav Shacham March 19, 2013 1 1 A vulnerable program #include int main() { void *p = malloc(100);
A Heap of Trouble Exploiting the Linux Kernel SLOB Allocator
A Heap of Trouble Exploiting the Linux Kernel SLOB Allocator Dan Rosenberg 1 Who am I? Security consultant and vulnerability researcher at VSR in Boston App/net pentesting, code review, etc. Published
Memory Allocator Security
Memory Allocator Security Yves Younan, Wouter Joosen, Frank Piessens and Hans Van den Eynden DistriNet, Department of Computer Science Katholieke Universiteit Leuven Belgium Yves.Younan@cs.kuleuven.ac.be
Operating System Labs. Yuanbin Wu
Operating System Labs Yuanbin Wu CS@ECNU Operating System Labs Project 2 Due 21:00, Oct. 24 Project 3 Group of 3 If you can not find a partner, drop us an email You now have 3 late days, but start early!
LibsafeXP: A Practical & Transparent Tool for Run-time Buffer Overflow Preventions
The 7th Annual IEEE Information Assurance Workshop LibsafeXP: A Practical & Transparent Tool for Run-time Buffer Overflow Preventions Zhiqiang Lin, Bing Mao and Li Xie Dept. of Computer Science Nanjing
Optimizing Dynamic Memory Management
Optimizing Dynamic Memory Management 1 Goals of this Lecture Help you learn about: Details of K&R heap mgr Heap mgr optimizations related to Assignment #5 Faster free() via doubly-linked list, redundant
Princeton University Computer Science 217: Introduction to Programming Systems. Dynamic Memory Management
Princeton University Computer Science 217: Introduction to Programming Systems Dynamic Memory Management 1 Goals of this Lecture Help you learn about: The need for dynamic* memory mgmt (DMM) Implementing
Topics in Software Security Vulnerability
Topics in Software Security Vulnerability Software vulnerability What are software vulnerabilities? Types of vulnerabilities E.g., Buffer Overflows How to find these vulnerabilities and prevent them? Classes
Buffer overflows (a security interlude) Address space layout the stack discipline + C's lack of bounds-checking HUGE PROBLEM
Buffer overflows (a security interlude) Address space layout the stack discipline + C's lack of bounds-checking HUGE PROBLEM x86-64 Linux Memory Layout 0x00007fffffffffff not drawn to scale Stack... Caller
Memory Management Basics
Memory Management Basics 1 Basic Memory Management Concepts Address spaces! Physical address space The address space supported by the hardware Ø Starting at address 0, going to address MAX sys! MAX sys!!
DYNAMIC MEMORY ALLOCATION ON REAL-TIME LINUX
DYNAMIC MEMORY ALLOCATION ON REAL-TIME LINUX Jianping Shen Institut Dr. Foerster GmbH und Co. KG In Laisen 70, 72766, Reutlingen, Germany shen.jianping@foerstergroup.de Michael Hamal Institut Dr. Foerster
It s a TRaP: Table Randomization and Protection against Function-Reuse Attacks
It s a TRaP: Table Randomization and Protection against Function-Reuse Attacks Stephen Crane, Stijn Volckaert, Felix Schuster, Christopher Liebchen, Per Larsen, Lucas Davi, Ahmad-Reza Sadeghi, Thorsten
PROJECT 2 - MEMORY ALLOCATOR Computer Systems Principles. October 1, 2010
PROJECT 2 - MEMORY ALLOCATOR Computer Systems Principles Emery Berger Mark Corner October 1, 2010 1 Overview The purpose of this project is to acquaint you with how memory allocators provide virtual memory
Princeton University. Computer Science 217: Introduction to Programming Systems. Dynamic Memory Management
Princeton University Computer Science 217: Introduction to Programming Systems Dynamic Memory Management 1 Agenda The need for DMM DMM using the heap section DMMgr 1: Minimal implementation DMMgr 2: Pad
In Java we have the keyword null, which is the value of an uninitialized reference type
+ More on Pointers + Null pointers In Java we have the keyword null, which is the value of an uninitialized reference type In C we sometimes use NULL, but its just a macro for the integer 0 Pointers are
Bypassing Browser Memory Protections
Bypassing Browser Memory Protections Network Security Instructor: Dr. Shishir Nagaraja September 10, 2011. 1 Introduction to the topic A number of memory protection mechanisms like GS, SafeSEH, DEP and
Using static analysis to detect use-after-free on binary code
Using static analysis to detect use-after-free on binary code Josselin Feist Laurent Mounier Marie-Laure Potet Verimag / University of Grenoble - Alpes France SDTA 2014 - Clermont-Ferrand 5 décembre 2014
Processes, Address Spaces, and Memory Management. CS449 Spring 2016
Processes, Address Spaces, and Memory Management CS449 Spring 2016 Process A running program and its associated data Process s Address Space 0x7fffffff Stack Data (Heap) Data (Heap) Globals Text (Code)
Inception: System-Wide Security Testing of Real- World Embedded Systems Software Nassim Corteggiani (Maxim Integrated / EURECOM) Giovanni Camurati
Inception: System-Wide Security Testing of Real- World Embedded Systems Software Nassim Corteggiani (Maxim Integrated / EURECOM) Giovanni Camurati (EURECOM) Aurélien Francillon (EURECOM) 08/15/18 Embedded
Buffer overflow background
and heap buffer background Comp Sci 3600 Security Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Address Space and heap buffer
HA2lloc: Hardware-Assisted Secure Allocator
HA2lloc: Hardware-Assisted Secure Allocator Orlando Arias, Dean Sullivan, Yier Jin {oarias,dean.sullivan}@knights.ucf.edu yier.jin@ece.ufl.edu University of Central Florida University of Florida June 25,
Secure Coding Techniques
Secure Coding Techniques "... the world outside your function should be treated as hostile and bent upon your destruction" [Writing Secure Code, Howard and LeBlanc] "Distrust and caution are the parents
CSC 405 Computer Security Stack Canaries & ASLR
CSC 405 Computer Security Stack Canaries & ASLR Alexandros Kapravelos akaprav@ncsu.edu How can we prevent a buffer overflow? Check bounds Programmer Language Stack canaries [...more ] Buffer overflow defenses
Limitations of the stack
The heap hic 1 Limitations of the stack int *table_of(int num, int len) { int table[len+1]; for (int i=0; i
Preventing Use-after-free with Dangling Pointers Nullification
Preventing Use-after-free with Dangling Pointers Nullification Byoungyoung Lee, Chengyu Song, Yeongjin Jang Tielei Wang, Taesoo Kim, Long Lu, Wenke Lee Georgia Institute of Technology Stony Brook University
CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING
CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING LECTURE 16, SPRING 2013 TOPICS TODAY Project 6 Perils & Pitfalls of Memory Allocation C Function Call Conventions in Assembly Language PERILS
CS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Homework 1 Due: Wednesday, February 9, at 9:59pm Instructions. Submit your solution by Wednesday, February 9, at 9:59pm, in the drop box labelled CS161 in 283
Inside ptmalloc2. Peng Xu Sep 14, 2013
Inside ptmalloc2 Peng Xu peng.p.xu@ericsson.com Sep 14, 2013 Part I basic concept and data structure Memory Translation process memory layout kernel space command line and environment variables stack heap
1 Dynamic Memory continued: Memory Leaks
CS104: Data Structures and Object-Oriented Design (Fall 2013) September 3, 2013: Dynamic Memory, continued; A Refresher on Recursion Scribes: CS 104 Teaching Team Lecture Summary In this lecture, we continue
ENEE 457: Computer Systems Security. Lecture 16 Buffer Overflow Attacks
ENEE 457: Computer Systems Security Lecture 16 Buffer Overflow Attacks Charalampos (Babis) Papamanthou Department of Electrical and Computer Engineering University of Maryland, College Park Buffer overflow
Inject malicious code Call any library functions Modify the original code
Inject malicious code Call any library functions Modify the original code 2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks 2 3 Sadeghi, Davi TU Darmstadt
Offensive Security My First Buffer Overflow: Tutorial
Offensive Security My First Buffer Overflow: Tutorial César Bernardini University of Trento cesar.bernardini@unitn.it October 12, 2015 2 Cesar Bernardini Postdoctoral Fellow at UNITN PhD Student at INRIA-LORIA
BUFFER OVERFLOW. Jo, Heeseung
BUFFER OVERFLOW Jo, Heeseung IA-32/LINUX MEMORY LAYOUT Heap Runtime stack (8MB limit) Dynamically allocated storage When call malloc(), calloc(), new() DLLs (shared libraries) Data Text Dynamically linked
Fall 2018 Discussion 2: September 3, 2018
CS 61C C Basics Fall 2018 Discussion 2: September 3, 2018 1 C C is syntactically similar to Java, but there are a few key differences: 1. C is function-oriented, not object-oriented; there are no objects.
Buffer Overflow. Jo, Heeseung
Buffer Overflow Jo, Heeseung IA-32/Linux Memory Layout Heap Runtime stack (8MB limit) Dynamically allocated storage When call malloc(), calloc(), new() DLLs (shared libraries) Data Text Dynamically linked
KCon. Breaking ios Mitigation Jails to Achieve Your Own Private Jailbreak. Min(Spark) Alibaba Mobile Security
KCon Breaking ios Mitigation Jails to Achieve Your Own Private Jailbreak Min(Spark) Zheng @ Alibaba Mobile Security ONLY AVAILABLE AT THE SCENE ios status Apple sold more than 1 billion ios devices. More
CSE509 System Security
CSE509 System Security Software Security Nick Nikiforakis nick@cs.stonybrook.edu Things we are going to discuss Basic x86 assembly instructions Stack workings GDB syntax Overflows Stack Heap Shellcode
Defeating Code Reuse Attacks with Minimal Tagged Architecture. Samuel Fingeret. B.S., Massachusetts Institute of Technology (2014)
Defeating Code Reuse Attacks with Minimal Tagged Architecture by Samuel Fingeret B.S., Massachusetts Institute of Technology (2014) Submitted to the Department of Electrical Engineering and Computer Science