Mitigating the unkn0wn When your SMB exploit fails. Nicolas Joly
|
|
|
- Solomon O’Brien’
- 6 years ago
- Views:
Transcription
1 Mitigating the unkn0wn When your SMB exploit fails Nicolas Joly
2 Security Engineer at the MSRC Exploiting stuff, breaking things Have played pwn2own before, now judging entries
3 customers- and- evaluating- risk/
4 6 CVEs, 5 Critical us/library/security/ms aspx
5 EternalBlue
6 EternalBlue CVE Integer overflow due to storing a Ulong as a Ushort in SrvOs2FeaListSizeToNt security- intelligence/ms eternalblue/
7 EternalBlue CVE Integer overflow due to storing a Ulong as a Ushort in SrvOs2FeaListSizeToNt SrvOs2FeaListSizeToNt inlined in SrvOs2FeaListToNt Integer truncation here
8 EternalBlue CVE Integer overflow due to storing a Ulong as a Ushort in SrvOs2FeaListSizeToNt security- intelligence/ms eternalblue/
9 EternalBlue CVE Integer overflow due to storing a Ulong as a Ushort in SrvOs2FeaListSizeToNt EternalBlue in action
10 EternalBlue CVE Integer overflow due to storing a Ulong as a Ushort in SrvOs2FeaListSizeToNt Spraying with new connections to :445
11 EternalBlue CVE Integer overflow due to storing a Ulong as a Ushort in SrvOs2FeaListSizeToNt Sending new connections leads to spray the pool with MDLs: This points to HAL Pool before and after the overflow
12 EternalBlue CVE Integer overflow due to storing a Ulong as a Ushort in SrvOs2FeaListSizeToNt Redirecting the flow in srvnet!srvnetcommonreceivehandler
13 EternalBlue CVE Integer overflow due to storing a Ulong as a Ushort in SrvOs2FeaListSizeToNt Fix? Use PTR_DIFF instead of PTR_DIFF_SHORT
14 EternalChampion
15 EternalChampion CVE Race condition with Transaction requests Sending simple transactions us/library/ee aspx
16 EternalChampion CVE Race condition with Transaction requests But, if parameters or data don t fit in the first Transaction, we can use secondary transactions (while xcount < TotalxCount, send ) us/library/ee aspx
17 EternalChampion CVE Race condition with Transaction requests How does the server knows when to process the request? Can we race it? What happens if we send an unexpected secondary request here? us/library/ee aspx
18 EternalChampion CVE Race condition with Transaction requests Even if the primary transaction is being processed, the secondary transaction will still increment some fields, like Transaction - > DataCount and ParameterCount SrvSmbTransactionSecondary
19 EternalChampion CVE Race condition with Transaction requests Exploit is in two ways. First make an info leak with SrvSmbNtRename and an additional secondary transaction, followed by several transaction requests to spray the heap: Smb NTRename, totaldatacount = 0x1B8 Transaction secondary, totaldatacount = 0x108 Transaction primaries
20 EternalChampion CVE Race condition with Transaction requests First response to the Smb NtRename Second response to the secondary transaction, this time leaking memory
21 EternalChampion CVE Race condition with Transaction requests By spraying Transaction objects it becomes possible to have one located right after the SmbNtRename transaction buffer and leak some pointers from the Transaction object: datadisp goes out of bounds!
22 EternalChampion CVE Race condition with Transaction requests Several packets follow next: A QueryPathInformation packet to have transaction- >InData point to a stack address: A bunch of secondary transactions following to reach that memcpy and trigger a stack corruption in SrvSmbTransactionSecondary:
23 EternalChampion CVE Race condition with Transaction requests That results in a 4- byte overwrite in the stack: Leading to execute arbitrary code from a Paged pool:
24 EternalChampion CVE Race condition with Transaction requests Send an NtRename SMB followed by a secondary transaction and trigger a race EternalChampion on Win7 32- bit Execute arbitrary code in a PagedPool block Read back the data and disclose the location of a controlled buffer Send a QueryInformationPacke t followed by several secondary transactions to create a race Overwrite a return address on the stack EternalChampion in action
25 EternalRomance 2 different bugs
26 EternalRomance CVE Type confusion between WriteAndX and Transaction requests CVE Info disclosure in SrvPeekNamedPipe RestartPeekNamedPipe and SrvCompleteExecuteTransaction could be abused together to return uninitialized memory after calling SrvPeekNamedPipe: datalength was not checked against OutData, thus leaking memory
27 EternalRomance CVE Type confusion between WriteAndX and Transaction requests CVE Info disclosure in SrvPeekNamedPipe Amount of bytes in the pipe An initial request with Max Parameter Count = 0x5400 would lead to allocate 0x54A8 in the PagedPool bytes in SrvAllocateTransaction which would lead to leak the bytes + 0x54A8 in the response
28 EternalRomance CVE Type confusion between WriteAndX and Transaction requests CVE Info disclosure in SrvPeekNamedPipe [MS- SMB].pdf
29 EternalRomance CVE Type confusion between WriteAndX and Transaction requests CVE Info disclosure in SrvPeekNamedPipe Multiple WriteAndX requests can follow to fill the Transaction buffer when WriteMode is in RAW_MODE leading to increment InData and DataCount in SrvSmbWriteAndX
30 EternalRomance CVE Type confusion between WriteAndX and Transaction requests CVE Info disclosure in SrvPeekNamedPipe But SrvSmbTransactionSecondary also calls SrvFindTransaction and writes data to transaction- >InData: leading to a buffer overflow on an adjacent Transaction object
31 EternalRomance CVE Type confusion between WriteAndX and Transaction requests CVE Info disclosure in SrvPeekNamedPipe How to build an arbitrary read?
32 EternalRomance CVE Type confusion between WriteAndX and Transaction requests CVE Info disclosure in SrvPeekNamedPipe Use the leak in SrvCompleteExecuteT ransaction to fingerprint the OS EternalRomance on Win7 32- bit Execute arbitrary code by sending a TRANS2_SESSION_SET UP subcommand Spray the pool with multiple Transactions and send one WriteAndX packet Trigger the buffer overflow to corrupt a transaction EternalRomance in action Overwrite fields in the transaction and read back the data to leak information Overwrite the TRANS2_SESSION_SET UP subcommand with a pointer to controlled data
33 EternalSynergy = [EternalChampion + EternalRomance]
34 EternalSynergy CVE Type confusion between WriteAndX and Transaction requests CVE Race condition with Transaction requests Race condition to leak a transaction object Same exploit in EternalChampion
35 EternalSynergy CVE Type confusion between WriteAndX and Transaction requests CVE Race condition with Transaction requests Several Transactions exchanged Same exploit in EternalRomance The main difference is the choice of an RWX section in NT to write the payload...
36 EternalSynergy CVE Type confusion between WriteAndX and Transaction requests CVE Race condition with Transaction requests Send an NtRename SMB followed by a secondary transaction and trigger a race EternalSynergy in action Read back the data and disclose a Transaction object EternalSynergy on Win8 64- bit Execute arbitrary code by sending a TRANS2_SESSION_SETUP subcommand Spray the pool with multiple Transactions and send one WriteAndX packet Trigger the buffer overflow to corrupt a transaction Overwrite fields in the transaction and read back the data to leak information Overwrite the TRANS2_SESSION_SETUP subcommand with a pointer to RWX data in NT
37 None of these worked on Windows 10
38 Mitigations blocking these exploits Null sessions have disappeared by default since Windows 8 Full ASLR, the HAL heap region is now randomized starting from RS2 Kernel NX since Windows 8, making the HAL heap region and the non paged pool allocations used in srv.sys non executable Kernel CFG (kcfg) with HVCI enabled since RS2 prevents indirect calls to hijack the flow RWX areas in ntoskrnl have now disappeared Windows 10 RS3 (Fall Creators Update) and Windows Server 2016 RS3 have SMB1 uninstalled by default under most circumstances
39 And what else?
40 Pool overflow in SrvSmbCreateWithExtraOptions Extended Requests in SrvSmbCreateWithExtraOptions were not properly checked leading to pool overflow
41 Pool overflow in SrvCompleteExecuteTransaction Confusion due to using SetupCount at one point, and MaxSetupCount at another, leading to pool overflow
42 OOB Write in RestartWriteNamedPipe RestartWriteNamedPipe was not checking whether there was enough space in OutParameters to write iosb- >Information
43 Abusing SrvSmbNtRename SrvSmbNtRename was a noop, making exploits easier (especially combined with the next issue). It now returns an error.
44 Uninitialized memory in SrvSmbTransactionSecondary Abusing datadisplacement in SrvSmbTransactionSecondary or SrvSmbNtTransactionSecondary could lead to create a Transaction with datacount = TotalDataCount but leaving the buffer uninitialized
45 Uninitialized memory in SrvSnapEnumerateSnapShots SrvSnapEnumerateSnapShots was leaking bytes when SnapShotCount = 0
46 Uninitialized memory in ProcessOs2Ioctl ProcessOs2Ioctl was leaking bytes when ansishare.length < LM20_NNLEN
47 Return values not correctly initialized in SrvSmbQuerySecurityDescriptor SrvSmbQuerySecurityDescriptorwas not resetting some fields before returning
48 Return values not correctly initialized in RestartNtIoctl RestartNtIoctl was not resetting some fields before returning
49 Return values not correctly initialized in RestartCallNamedPipe RestartCallNamedPipe
50 Is that all?
51 Enjoyed the talk? Join us! THANKS!
Secure Coding Techniques
Secure Coding Techniques "... the world outside your function should be treated as hostile and bent upon your destruction" [Writing Secure Code, Howard and LeBlanc] "Distrust and caution are the parents
LINUX VULNERABILITIES, WINDOWS EXPLOITS Escalating Privileges with WSL. Saar Amar Recon brx 2018
LINUX VULNERABILITIES, WINDOWS EXPLOITS Escalating Privileges with WSL Saar Amar Recon brx 2018 WHO AM I? Saar Amar Security Researcher @AmarSaar Pasten CTF team member saaramar OUTLINE World s quickest
The Life And Death of Kernel Object Abuse. Saif ElSherei (0x5A1F) & Ian Kronquist
The Life And Death of Kernel Object Abuse Saif ElSherei (0x5A1F) & Ian Kronquist Who? @Saif_Sherei Senior Security Software Engineer @ MSRC @IanKronquist Software Engineer on the Windows Device Group Security
SoK: Eternal War in Memory
SoK: Eternal War in Memory László Szekeres, Mathias Payer, Tao Wei, Dawn Song Presenter: Wajih 11/7/2017 Some slides are taken from original S&P presentation 1 What is SoK paper? Systematization of Knowledge
Is Exploitation Over? Bypassing Memory Protections in Windows 7
Is Exploitation Over? Bypassing Memory Protections in Windows 7 Alexander Sotirov alex@sotirov.net About me Exploit development since 1999 Published research into reliable exploitation techniques: Heap
Identifying Memory Corruption Bugs with Compiler Instrumentations. 이병영 ( 조지아공과대학교
Identifying Memory Corruption Bugs with Compiler Instrumentations 이병영 ( 조지아공과대학교 ) blee@gatech.edu @POC2014 How to find bugs Source code auditing Fuzzing Source Code Auditing Focusing on specific vulnerability
BLACKBERRY PWNAGE THE BLUEJAY STRIKES
BLACKBERRY PWNAGE THE BLUEJAY STRIKES Federico Muttis Core Security Technologies Session ID: HTA-T19 Session Classification: Advanced INFO @ THE MEDIA http://www.zdnet.com/blog/security/pwn2own-2011-blackberry-falls-to-webkit-browser-attack/8401
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 1 Programming Why do we write programs? Function What functions do we enable via our programs?
Memory Corruption 101 From Primitives to Exploit
Memory Corruption 101 From Primitives to Exploit Created by Nick Walker @ MWR Infosecurity / @tel0seh What is it? A result of Undefined Behaviour Undefined Behaviour A result of executing computer code
TAKING WINDOWS 10 KERNEL EXPLOITATION TO THE NEXT LEVEL LEVERAING WRITE- WHAT-WHERE VULNERABILITIES IN CREATORS UPDATE
TAKING WINDOWS 10 KERNEL EXPLOITATION TO THE NEXT LEVEL LEVERAING WRITE- WHAT-WHERE VULNERABILITIES IN CREATORS UPDATE Whoami Morten Schenk Security Advisor, Improsec ApS Twitter - @blomster81 Blog - https://improsec.com/blog/
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 Programming Why do we write programs? Function What functions do we enable via our programs?
TAKING WINDOWS 10 KERNEL EXPLOITATION TO THE NEXT LEVEL LEVERAING WRITE- WHAT-WHERE VULNERABILITIES IN CREATORS UPDATE
TAKING WINDOWS 10 KERNEL EXPLOITATION TO THE NEXT LEVEL LEVERAING WRITE- WHAT-WHERE VULNERABILITIES IN CREATORS UPDATE Whoami Morten Schenk Security Advisor, Improsec ApS Twitter - @blomster81 Blog: https://improsec.com/blog/
Play with FILE Structure Yet Another Binary Exploitation Technique. Abstract
Play with FILE Structure Yet Another Binary Exploitation Technique An-Jie Yang (Angelboy) angelboy@chroot.org Abstract To fight against prevalent cyber threat, more mechanisms to protect operating systems
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 Programming Why do we write programs? Function What functions do we enable via our programs?
Software Security II: Memory Errors - Attacks & Defenses
1 Software Security II: Memory Errors - Attacks & Defenses Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab1 Writeup 3 Buffer overflow Out-of-bound memory writes (mostly sequential) Allow
Covering the global threat landscape
Covering the global threat landscape ETERNALBLUE: A PROMINENT THREAT ACTOR OF 2017 2018 Pradeep Kulkarni, Sameer Patil, Prashant Kadam & Aniruddha Dolas Quick Heal Security Labs, India IN TRODUCTION Last
Secure C Coding...yeah right. Andrew Zonenberg Alex Radocea
Secure C Coding...yeah right Andrew Zonenberg Alex Radocea Agenda Some Quick Review Data Representation Pointer Arithmetic Memory Management Basic C Vulnerabilities Memory Corruption Ignoring Return values
12 th January MWR InfoSecurity Security Advisory. WebSphere MQ xcsgetmem Heap Overflow Vulnerability. Contents
Contents MWR InfoSecurity Security Advisory WebSphere MQ xcsgetmem Heap Overflow Vulnerability 12 th January 2009 2009-01-05 Page 1 of 9 Contents Contents 1 Detailed Vulnerability Description...5 1.1 Introduction...5
TURNING (PAGE) TABLES
TURNING (PAGE) TABLES BYPASSING ADVANCED KERNEL MITIGATIONS USING PAGE TABLES MANIPULATIONS BSidesLV 2018 ENSILO.COM ABOUT US Omri Misgav Security Research Team Leader @ ensilo Reverse Engineering, OS
Outline. Classic races: files in /tmp. Race conditions. TOCTTOU example. TOCTTOU gaps. Vulnerabilities in OS interaction
Outline CSci 5271 Introduction to Computer Security Day 3: Low-level vulnerabilities Stephen McCamant University of Minnesota, Computer Science & Engineering Race conditions Classic races: files in /tmp
TAKING WINDOWS 10 KERNEL EXPLOITATION TO THE NEXT LEVEL LEVERAING WRITE- WHAT-WHERE VULNERABILITIES IN CREATORS UPDATE
TAKING WINDOWS 10 KERNEL EXPLOITATION TO THE NEXT LEVEL LEVERAING WRITE- WHAT-WHERE VULNERABILITIES IN CREATORS UPDATE Whoami Morten Schenk Security Advisor, Improsec ApS Twitter - @blomster81 Blog: https://improsec.com/blog/
Core GraphicsMemory Corruption CVE PDF Indexed colorspace buffer overflow
security research Core GraphicsMemory Corruption CVE-2014-4377 PDF Indexed colorspace buffer overflow Apple CoreGraphics library fails to validate the input when parsing the colorspace specification of
ISA564 SECURITY LAB. Code Injection Attacks
ISA564 SECURITY LAB Code Injection Attacks Outline Anatomy of Code-Injection Attacks Lab 3: Buffer Overflow Anatomy of Code-Injection Attacks Background About 60% of CERT/CC advisories deal with unauthorized
KSMA: Breaking Android kernel isolation and Rooting with ARM MMU features. WANG, YONG a.k.a. Pandora Lab of Ali Security
KSMA: Breaking Android kernel isolation and Rooting with ARM MMU features WANG, YONG a.k.a. ThomasKing(@ThomasKing2014) Pandora Lab of Ali Security About WANG, YONG a.k.a. ThomasKing(@ThomasKing2014) Security
Intrusion Detection and Malware Analysis
Intrusion Detection and Malware Analysis Host Based Attacks Pavel Laskov Wilhelm Schickard Institute for Computer Science Software security threats Modification of program code viruses and self-replicating
CS 161 Computer Security
Paxson Spring 2017 CS 161 Computer Security Discussion 2 Question 1 Software Vulnerabilities (15 min) For the following code, assume an attacker can control the value of basket passed into eval basket.
Exploit Mitigation - PIE
Exploit Mitigation - PIE Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch ASCII Armor Arbitrary Write Overflow Local
Bypassing Mitigations by Attacking JIT Server in Microsoft Edge
Bypassing Mitigations by Attacking JIT Server in Microsoft Edge Ivan Fratric Infiltrate 2018 About me Security researcher at Google Project Zero Previously: Google Security Team, Academia (UNIZG) Doing
C and C++ Secure Coding 4-day course. Syllabus
C and C++ Secure Coding 4-day course Syllabus C and C++ Secure Coding 4-Day Course Course description Secure Programming is the last line of defense against attacks targeted toward our systems. This course
EURECOM 6/2/2012 SYSTEM SECURITY Σ
EURECOM 6/2/2012 Name SYSTEM SECURITY 5 5 5 5 5 5 5 5 5 5 50 1 2 3 4 5 6 7 8 9 10 Σ Course material is not allowed during the exam. Try to keep your answers precise and short. You will not get extra points
Defeat Exploit Mitigation Heap Attacks. compass-security.com 1
Defeat Exploit Mitigation Heap Attacks compass-security.com 1 ASCII Armor Arbitrary Write Overflow Local Vars Exploit Mitigations Stack Canary ASLR PIE Heap Overflows Brute Force Partial RIP Overwrite
MWR InfoSecurity Security Advisory. IBM Lotus Domino Accept- Language Stack Overflow. 20 th May Contents
Contents MWR InfoSecurity Security Advisory IBM Lotus Domino Accept- Language Stack Overflow 20 th May 2008 2008-05-20 Page 1 of 8 Contents Contents 1 Detailed Vulnerability Description...5 1.1 Introduction...5
Security Workshop HTS. LSE Team. February 3rd, 2016 EPITA / 40
Security Workshop HTS LSE Team EPITA 2018 February 3rd, 2016 1 / 40 Introduction What is this talk about? Presentation of some basic memory corruption bugs Presentation of some simple protections Writing
Applications. Cloud. See voting example (DC Internet voting pilot) Select * from userinfo WHERE id = %%% (variable)
Software Security Requirements General Methodologies Hardware Firmware Software Protocols Procedure s Applications OS Cloud Attack Trees is one of the inside requirement 1. Attacks 2. Evaluation 3. Mitigation
in memory: an evolution of attacks Mathias Payer Purdue University
in memory: an evolution of attacks Mathias Payer Purdue University Images (c) MGM, WarGames, 1983 Memory attacks: an ongoing war Vulnerability classes according to CVE Memory
Simple Overflow. #include <stdio.h> int main(void){ unsigned int num = 0xffffffff;
Simple Overflow 1 #include int main(void){ unsigned int num = 0xffffffff; printf("num is %d bits long\n", sizeof(num) * 8); printf("num = 0x%x\n", num); printf("num + 1 = 0x%x\n", num + 1); }
INITIALISING POINTER VARIABLES; DYNAMIC VARIABLES; OPERATIONS ON POINTERS
INITIALISING POINTER VARIABLES; DYNAMIC VARIABLES; OPERATIONS ON POINTERS Pages 792 to 800 Anna Rakitianskaia, University of Pretoria INITIALISING POINTER VARIABLES Pointer variables are declared by putting
Buffer overflow background
and heap buffer background Comp Sci 3600 Security Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Address Space and heap buffer
WINDOWS 10 RS2/RS3 GDI DATA-ONLY EXPLOITATION TALES
WINDOWS 10 RS2/RS3 GDI DATA-ONLY EXPLOITATION TALES NIKOLAOS SAMPANIS (@_sm4ck) nsampanis@census-labs.com OFFENSIVECON 2018 BERLIN www.census-labs.com > WHO AM I Computer security researcher at CENSUS
Fastbin_dup into stack exploitation
Fastbin_dup into stack exploitation This tutorial is about the fastbin_dup into stack heap exploitation. First we re going to analyze what is fastbin and how to exploit the heap by double freeing and reallocating
Other array problems. Integer overflow. Outline. Integer overflow example. Signed and unsigned
Other array problems CSci 5271 Introduction to Computer Security Day 4: Low-level attacks Stephen McCamant University of Minnesota, Computer Science & Engineering Missing/wrong bounds check One unsigned
CS161 Midterm 1 Review
CS161 Midterm 1 Review Midterm 1: March 4, 18:3020:00 Same room as lecture Security Analysis and Threat Model Basic security properties CIA Threat model A. We want perfect security B. Security is about
Patching Exploits with Duct Tape: Bypassing Mitigations and Backward Steps
SESSION ID: EXP-R01 Patching Exploits with Duct Tape: Bypassing Mitigations and Backward Steps James Lyne Global Head of Security Research Sophos / SANS Institute @jameslyne Stephen Sims Security Researcher
Hello? It s Me, Your Not So Smart Device. We Need to Talk.
SESSION ID: SBX1-R2 Hello? It s Me, Your Not So Smart Device. We Need to Talk. Alex Jay Balan Chief Security Researcher Bitdefender @jaymzu IoT is not optional 2 IoT is not optional IoT = hardware + OS
Leveraging CVE for ASLR Bypass & RCE. Gal De Leon & Nadav Markus
Leveraging CVE-2015-7547 for ASLR Bypass & RCE Gal De Leon & Nadav Markus 1 Who We Are Nadav Markus, Gal De-Leon Security researchers @ PaloAltoNetworks Vulnerability research and exploitation Reverse
THE GREAT ESCAPES OF VMWARE: A RETROSPECTIVE CASE STUDY OF VMWARE GUEST-TO-HOST ESCAPE VULNERABILITIES
THE GREAT ESCAPES OF VMWARE: A RETROSPECTIVE CASE STUDY OF VMWARE GUEST-TO-HOST ESCAPE VULNERABILITIES Presented By : Debasish Mandal & Yakun Zhang About Us: Debasish Mandal Security researcher on McAfee
Lecture 08 Control-flow Hijacking Defenses
Lecture 08 Control-flow Hijacking Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides adapted from Miller, Bailey, and Brumley Control Flow Hijack: Always control + computation
Verification & Validation of Open Source
Verification & Validation of Open Source 2011 WORKSHOP ON SPACECRAFT FLIGHT SOFTWARE Gordon Uchenick Coverity, Inc Open Source is Ubiquitous Most commercial and proprietary software systems have some open
Polishing Chrome for Fun and Profit
Polishing Chrome for Fun and Profit Nils & Jon 29/08/2013 Labs.mwrinfosecurity.com MWR Labs 1 Labs.mwrinfosecurity.com MWR Labs Agenda Introduction Google Chrome Pwn2Own Vulnerabilities Demo Labs.mwrinfosecurity.com
Offensive Security My First Buffer Overflow: Tutorial
Offensive Security My First Buffer Overflow: Tutorial César Bernardini University of Trento cesar.bernardini@unitn.it October 12, 2015 2 Cesar Bernardini Postdoctoral Fellow at UNITN PhD Student at INRIA-LORIA
CNIT 127: Exploit Development. Ch 18: Source Code Auditing. Updated
CNIT 127: Exploit Development Ch 18: Source Code Auditing Updated 4-10-17 Why Audit Source Code? Best way to discover vulnerabilities Can be done with just source code and grep Specialized tools make it
Memory corruption vulnerability exposure can be mitigated through memory hardening practices
Memory corruption vulnerability exposure can be mitigated through memory hardening practices OS vendors have a unique opportunity to fight memory corruption vulnerabilities through hardening the memory
Black Hat Webcast Series. C/C++ AppSec in 2014
Black Hat Webcast Series C/C++ AppSec in 2014 Who Am I Chris Rohlf Leaf SR (Security Research) - Founder / Consultant BlackHat Speaker { 2009, 2011, 2012 } BlackHat Review Board Member http://leafsr.com
Revisiting the Kernel Security Enhancements in ios 10 MOSEC Liang Tencent Keen Lab
Revisiting the Kernel Security Enhancements in ios 10 MOSEC 2017 Liang Chen @ Tencent Keen Lab Last year in ios 10 2016.6.13 first ios 10.0 beta was released 2016.7 Pangu team released ios 9.3.3 jailbreak.
Software Security: Buffer Overflow Defenses
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Defenses Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin,
Playing God With Format String Attacks. Bsides Jax 2016 Travis Phillips 10/22/2016
Playing God With Format String Attacks Bsides Jax 2016 Travis Phillips 10/22/2016 So Why This Talk? Been experimenting with them over the last year Found them simple in theory; difficult in practice. Found
(Early) Memory Corruption Attacks
(Early) Memory Corruption Attacks CS-576 Systems Security Instructor: Georgios Portokalidis Fall 2018 Fall 2018 Stevens Institute of Technology 1 Memory Corruption Memory corruption occurs in a computer
Countermeasures in Modern Operating Systems. Yves Younan, Vulnerability Research Team (VRT)
Countermeasures in Modern Operating Systems Yves Younan, Vulnerability Research Team (VRT) Introduction Programs in C/C++: memory error vulnerabilities Countermeasures (mitigations): make exploitation
Analysis of MS Multiple Excel Vulnerabilities
Analysis of MS-07-036 Multiple Excel Vulnerabilities I. Introduction This research was conducted using the Office 2003 Excel Viewer application and the corresponding security patch for MS-07-036 - Vulnerabilities
CS61 Section Notes. Section 5 (Fall 2011) Topics to be covered Common Memory Errors Dynamic Memory Allocation Assignment 3: Malloc
CS61 Section Notes Section 5 (Fall 2011) Topics to be covered Common Memory Errors Dynamic Memory Allocation Assignment 3: Malloc Common Memory Errors In lecture, we learned about several errors programmers
SA30228 / CVE
Generated by Secunia 29 May, 2008 5 pages Table of Contents Introduction 2 Technical Details 2 Exploitation 4 Characteristics 4 Tested Versions 5 Fixed Versions 5 References 5 Generated by Secunia 29 May,
Beyond Stack Smashing: Recent Advances in Exploiting. Jonathan Pincus(MSR) and Brandon Baker (MS)
Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns Jonathan Pincus(MSR) and Brandon Baker (MS) Buffer Overflows and How they Occur Buffer is a contiguous segment of memory of a fixed
Identifying and Analyzing Pointer Misuses for Sophisticated Memory-corruption Exploit Diagnosis
Identifying and Analyzing Pointer Misuses for Sophisticated Memory-corruption Exploit Diagnosis Mingwei Zhang ( ) Aravind Prakash ( ) Xiaolei Li ( ) Zhenkai Liang ( ) Heng Yin ( ) ( ) School of Computing,
Get the (Spider)monkey off your back
Get the (Spider)monkey off your back Exploiting Firefox through the Javascript engine by eboda and bkth from phoenhex Who are we? Security enthusiasts who dabble in vulnerability research on their free
KCon. Breaking ios Mitigation Jails to Achieve Your Own Private Jailbreak. Min(Spark) Alibaba Mobile Security
KCon Breaking ios Mitigation Jails to Achieve Your Own Private Jailbreak Min(Spark) Zheng @ Alibaba Mobile Security ONLY AVAILABLE AT THE SCENE ios status Apple sold more than 1 billion ios devices. More
Week 5, continued. This is CS50. Harvard University. Fall Cheng Gong
This is CS50. Harvard University. Fall 2014. Cheng Gong Table of Contents News... 1 Buffer Overflow... 1 Malloc... 6 Linked Lists... 7 Searching... 13 Inserting... 16 Removing... 19 News Good news everyone!
ECE 471 Embedded Systems Lecture 22
ECE 471 Embedded Systems Lecture 22 Vince Weaver http://www.eece.maine.edu/~vweaver vincent.weaver@maine.edu 31 October 2018 Don t forget HW#7 Announcements 1 Computer Security and why it matters for embedded
Software Security: Buffer Overflow Attacks
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks (continued) Autumn 2018 Tadayoshi (Yoshi) Kohno yoshi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
EternalBlue. Exploit Analysis and Port to Microsoft Windows 10
W H I T E PA P E R EternalBlue Exploit Analysis and Port to Microsoft Windows 10 Table of Contents Executive Summary 1 Background 2 The Shadow Brokers 2 Microsoft Windows MS17-010 Patch 2 Weaponized FUZZBUNCH
Università Ca Foscari Venezia
Stack Overflow Security 1 2018-19 Università Ca Foscari Venezia www.dais.unive.it/~focardi secgroup.dais.unive.it Introduction Buffer overflow is due to careless programming in unsafe languages like C
Microsoft Office Protected-View Out-Of- Bound Array Access
Microsoft Office Protected-View Out-Of- Bound Array Access 2017-11-23 Software Microsoft Office Affected Versions Microsoft Excel 2010, 2013, 2016 (x86 and x64) CVE Reference Author Severity Vendor CVE-2017-8502
Bypassing Browser Memory Protections
Bypassing Browser Memory Protections Network Security Instructor: Dr. Shishir Nagaraja September 10, 2011. 1 Introduction to the topic A number of memory protection mechanisms like GS, SafeSEH, DEP and
Examples of Code Roaches. First Draft List Cem Kaner September 11, 2005
Examples of Code Roaches First Draft List Cem Kaner September 11, 2005 Why a Potential-Bug List? Given a potential error, you can develop a method to test for it Foundation for Code inspections Glass box
CSE 127 Computer Security
CSE 127 Computer Security Alex Gantman, Spring 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on
Attacking the XNU Kernel in El Capitan. Luca Todesco BlackHat EU 2015
Attacking the XNU Kernel in El Capitan Luca Todesco (@qwertyoruiop) BlackHat EU 2015 About Me Independent vulnerability researcher from Venice, Italy Focusing on Apple s products,
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Fall 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on the
CNIT 127: Exploit Development. Ch 14: Protection Mechanisms. Updated
CNIT 127: Exploit Development Ch 14: Protection Mechanisms Updated 3-25-17 Topics Non-Executable Stack W^X (Either Writable or Executable Memory) Stack Data Protection Canaries Ideal Stack Layout AAAS:
CS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Discussion 1 January 26, 2011 Question 1 Buffer Overflow Mitigations Buffer overflow mitigations generally fall into two categories: (i) eliminating the cause
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Spring 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on
Overview AEG Conclusion CS 6V Automatic Exploit Generation (AEG) Matthew Stephen. Department of Computer Science University of Texas at Dallas
CS 6V81.005 Automatic Exploit Generation (AEG) Matthew Stephen Department of Computer Science University of Texas at Dallas February 20 th, 2012 Outline 1 Overview Introduction Considerations 2 AEG Challenges
Qiang Li && Zhibin Hu/Qihoo 360 Gear Team Ruxcon 2016
Qiang Li && Zhibin Hu/Qihoo 360 Gear Team Ruxcon 2016 Who are we Security researcher in Qihoo 360 Inc(Gear Team) Vulnerability discovery and analysis Specialize in QEMU currently 50+ security issues, 33
0x1A Great Papers in Computer Security
CS 380S 0x1A Great Papers in Computer Security Vitaly Shmatikov http://www.cs.utexas.edu/~shmat/courses/cs380s/ slide 1 Reference Monitor Observes execution of the program/process At what level? Possibilities:
SafeDispatch Securing C++ Virtual Calls from Memory Corruption Attacks by Jang, Dongseok and Tatlock, Zachary and Lerner, Sorin
SafeDispatch Securing C++ Virtual Calls from Memory Corruption Attacks by Jang, Dongseok and Tatlock, Zachary and Lerner, Sorin in NDSS, 2014 Alexander Hefele Fakultät für Informatik Technische Universität
A Heap of Trouble Exploiting the Linux Kernel SLOB Allocator
A Heap of Trouble Exploiting the Linux Kernel SLOB Allocator Dan Rosenberg 1 Who am I? Security consultant and vulnerability researcher at VSR in Boston App/net pentesting, code review, etc. Published
CMPSC 497 Other Memory Vulnerabilities
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CMPSC 497 Other Memory
Welcome to Lab! Feel free to get started until we start talking! The lab document is located on the course website:
Welcome to Lab! Feel free to get started until we start talking! The lab document is located on the course website: https://users.wpi.edu/~sjarvis/ece2049_smj/ece2049_labs.html You do not need to keep
18-642: Code Style for Compilers
18-642: Code Style for Compilers 9/25/2017 1 Anti-Patterns: Coding Style: Language Use Code compiles with warnings Warnings are turned off or over-ridden Insufficient warning level set Language safety
Exploiting a Coalmine Abusing Complex Bugs in Webkit's RenderArena
Exploiting a Coalmine Abusing Complex Bugs in Webkit's RenderArena Georg Wicherski Senior Security Researcher Wednesday, April 11, 2012 WebKit Based on KHTML (KDE) Apple forked in 2001 Chrome, (Mobile)
EURECOM 6/2/2012 SYSTEM SECURITY Σ
EURECOM 6/2/2012 Name SYSTEM SECURITY 5 5 5 5 5 5 5 5 10 50 1 2 3 4 5 6 7 8 9 Σ Course material is not allowed during the exam. Try to keep your answers precise and short. You will not get extra points
2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks
Runtime attacks are major threats to today's applications Control-flow of an application is compromised at runtime Typically, runtime attacks include injection of malicious code Reasons for runtime attacks
CS2141 Software Development using C/C++ Debugging
CS2141 Software Development using C/C++ Debugging Debugging Tips Examine the most recent change Error likely in, or exposed by, code most recently added Developing code incrementally and testing along
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY Fall Quiz I
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.858 Fall 2010 Quiz I All problems are open-ended questions. In order to receive credit you must answer
Back To The Epilogue
Back To The Epilogue How to Evade Windows' Control Flow Guard with Less than 16 Bytes Andrea Biondo * Prof. Mauro Conti Daniele Lain * SPRITZ Group University of Padua, IT GOALS - Return to function epilogue
Never Let Your Guard Down: Finding Unguarded Gates to Bypass Control Flow Guard with Big Data
Never Let Your Guard Down: Finding Unguarded Gates to Bypass Control Flow Guard with Big Data Ke Sun Ya Ou Yanhui Zhao Xiaomin Song Xiaoning Li wildsator@gmail.com perfectno2015@gmail.com wildyz.yky@gmail.com
OS COMPONENTS OVERVIEW OF UNIX FILE I/O. CS124 Operating Systems Fall , Lecture 2
OS COMPONENTS OVERVIEW OF UNIX FILE I/O CS124 Operating Systems Fall 2017-2018, Lecture 2 2 Operating System Components (1) Common components of operating systems: Users: Want to solve problems by using
CSCE 548 Building Secure Software Buffer Overflow. Professor Lisa Luo Spring 2018
CSCE 548 Building Secure Software Buffer Overflow Professor Lisa Luo Spring 2018 Previous Class Virus vs. Worm vs. Trojan & Drive-by download Botnet & Rootkit Malware detection Scanner Polymorphic malware
Secure Systems Engineering
Secure Systems Engineering Chester Rebeiro Indian Institute of Technology Madras Flaws that would allow an attacker access the OS flaw Bugs in the OS The Human factor Chester Rebeiro, IITM 2 Program Bugs
ios vulnerabilities technical details
ios vulnerabilities technical details CVE- 2017-6979 A race condition vulnerability in the IOSurface.kext driver allows an attacker to bypass the sanity checks for the creation of an IOSurface object.
CS-527 Software Security
CS-527 Software Security Memory Safety Asst. Prof. Mathias Payer Department of Computer Science Purdue University TA: Kyriakos Ispoglou https://nebelwelt.net/teaching/17-527-softsec/ Spring 2017 Eternal
Dnmaloc: a more secure memory allocator
Dnmaloc: a more secure memory allocator 28 September 2005 Yves Younan, Wouter Joosen, Frank Piessens and Hans Van den Eynden DistriNet, Department of Computer Science Katholieke Universiteit Leuven Belgium