Cyber Security Software Security: Understanding the Platform. Dr Chris Willcocks
|
|
|
- Margery Neal
- 5 years ago
- Views:
Transcription
1 Cyber Security Software Security: Understanding the Platform Dr Chris Willcocks
2 Let's take off our hats for Hilda Computer architectures are mostly simple technologies with clever wiring
3 Software Security 1. Understanding the computer architecture (getting close to the metal) 2. Understanding the stack 3. Stack and heap memory vulnerabilities 4. Smashing the stack 5. Dangerous system calls Coming up 6. Race condition attacks 7. Timing attacks Today and in the practical
4 Getting Close to the Metal
5 Getting Close to the Metal Core Core Core Shared Core Core L3 Core Core Core L2 SLOW! Cheap L1 Fast, expensive
6 Getting Close to the Metal Two types of memory: DRAM & SRAM 1 transistor per bit - slow - cheap 4+ transistors per bit - fast (~4 clock cycles) - expensive - takes up space on die
7 Computer Architecture Fast, expensive, close to core(s) Cheap, slow, far from core(s)
8 Getting Close to the Metal (GPU) GDDR5 SLOW, Cheap 0,0,1,1,0,1,0,1,0,0,1,1,1, 1,0,0,1,0,0,1,1,1,...
9 Getting Close to the Metal (GPU) Vector car_image Vector output Kernel( int core_index ) { float some_value = *... compile TEMP temp ATTRIB col0 = fragment.color OUTPUT out = result.color TEX temp, tex0, texture[0], 2D MUL out, col0, temp... 0,0,1,1,0,1,0,...
10 Getting Close to the Metal (GPU) Instruction State + Data State + Clock = Output State L2 Cache TEX tem MUL out L1 Cache ~15 billion transistors on 2017 GPU die
11 Getting Close to the Metal (GPU) 0,0,1,1,0,1,0,1,0,0,1,1,1, 1,0,0,1,0,0,1,1,1,... Program output:
12 Data, Instructions & Transforms 0,0,1,1,0,1, 1,0,0,1,1,1,... Core 0,0,1,1,0,1, 1,0,0,1,1,1,... Core Core Shared Core Core L3 Core Core Core 0,0,1,1,0,1,0,1,0,0,1,1,1, 1,0,0,1,0,0,1,1,1,... 0,0,1,1,0,1, 1,0,0,1,1,1,... L2 SLOW! Cheap 0,0,1,1,0,1, 1,0,0,1,1,1,... L1 Fast, expensive
13 A simple C program #include <stdio.h> int w; int absolute(int x) { if (x<0) return -x; return x; } int abs_mul(int x, int y) { return absolute(x*y); } int main() { int a; int b; a = 5; b = -2; w = abs_mul(a,b); printf("output = %d\n", w); return 0; } Global variable Function Local variables 1. Compile.c source to object file 2. Execute program 3. Disassemble object to assembly form 4. View assembly
14 Compiling and Executing Source code #include <stdio.h> Machine Instructions <main>: 681: 55 push 682: e5,rsp int absolute(int x) { if (x<0) return -x; return x; } 685: ec 10 sub rsp,0x10 689: c7 45 f DWORD PTR [-0x8],0x5 690: c7 45 fc fe ff ff ff DWORD PTR [-0x4],0xfffffffe 697: 8b 55 fc edx,dword PTR [-0x4] 69a: 8b 45 f8 eax,dword PTR [-0x8] int abs_mul(int x, int y) { return absolute(x*y); } 69d: 89 d6 esi,edx 69f: 89 c7 edi,eax 6a1: e8 bd ff ff ff call 663 <abs_mul> 6a6: DWORD PTR [rip+0x200988],eax 6ac: 8b eax,dword PTR [rip+0x200982] 6b2: 89 c6 esi,eax 6b4: 48 8d 3d lea rdi,[rip+0x99] 6bb: b eax,0x0 6c0: e8 6b fe ff ff call 530 <printf@plt> 6c5: b eax,0x0 6ca: c9 leave 6cb: c3 ret 6cc: 0f 1f nop int w; int main() { int a; int b; a = 5; b = -2; w = abs_mul(a,b); printf("output = %d\n", w); return 0; } Voltage signals DWORD PTR [rax+0x0] 0,0,1,1,1,0,0,1,1,1,...
15 Understanding Application memory Application memory #include <stdio.h> int w; Heap Memory int absolute(int x) { if (x<0) return -x; return x; } int abs_mul(int x, int y) { return absolute(x*y); } int main() { int a; int b; a = 5; b = -2; w = abs_mul(a,b); printf("output = %d\n", w); return 0; } Call Stack Does not grow Globals int w; Instructions push, rsp
16 Understanding the Stack The Stack <main>: 681: 55 push 682: e5,rsp 685: ec 10 sub rsp,0x10 689: c7 45 f DWORD PTR [-0x8],0x5 690: c7 45 fc fe ff ff ff DWORD PTR [-0x4],0xfffffffe 697: 8b 55 fc edx,dword PTR [-0x4] 69a: 8b 45 f8 eax,dword PTR [-0x8] 69d: 89 d6 esi,edx 69f: 89 c7 edi,eax 6a1: e8 bd ff ff ff call 663 <abs_mul> 6a6: DWORD PTR [rip+0x200988],eax 6ac: 8b eax,dword PTR [rip+0x200982] 6b2: 89 c6 esi,eax 6b4: 48 8d 3d lea rdi,[rip+0x99] 6bb: b eax,0x0 6c0: e8 6b fe ff ff call 530 6c5: b eax,0x0 6ca: c9 leave 6cb: c3 ret 6cc: 0f 1f nop LIFO datastructure DWORD PTR [rax+0x0] int w;
17 Understanding the Stack The Stack <main>: 681: 55 push 682: e5,rsp 685: ec 10 sub rsp,0x10 689: c7 45 f DWORD PTR [-0x8],0x5 690: c7 45 fc fe ff ff ff DWORD PTR [-0x4],0xfffffffe 697: 8b 55 fc edx,dword PTR [-0x4] 69a: 8b 45 f8 eax,dword PTR [-0x8] 69d: 89 d6 esi,edx 69f: 89 c7 edi,eax 6a1: e8 bd ff ff ff call 663 <abs_mul> 6a6: DWORD PTR [rip+0x200988],eax 6ac: 8b eax,dword PTR [rip+0x200982] 6b2: 89 c6 esi,eax 6b4: 48 8d 3d lea rdi,[rip+0x99] 6bb: b eax,0x0 6c0: e8 6b fe ff ff call 530 6c5: b eax,0x0 6ca: c9 leave 6cb: c3 ret 6cc: 0f 1f nop rsp int main() fixed size stack frame parent func DWORD PTR [rax+0x0] int w;
18 Understanding the Stack The Stack <main>: 681: 55 push 682: e5,rsp 685: ec 10 sub rsp,0x10 689: c7 45 f DWORD PTR [-0x8],0x5 690: c7 45 fc fe ff ff ff DWORD PTR [-0x4],0xfffffffe 697: 8b 55 fc edx,dword PTR [-0x4] 69a: 8b 45 f8 eax,dword PTR [-0x8] 69d: 89 d6 esi,edx 69f: 89 c7 edi,eax 6a1: e8 bd ff ff ff call 663 <abs_mul> 6a6: DWORD PTR [rip+0x200988],eax 6ac: 8b eax,dword PTR [rip+0x200982] 6b2: 89 c6 esi,eax 6b4: 48 8d 3d lea rdi,[rip+0x99] 6bb: b eax,0x0 6c0: e8 6b fe ff ff call 530 6c5: b eax,0x0 6ca: c9 leave 6cb: c3 ret 6cc: 0f 1f nop rsp int main() fixed size stack frame b a parent func DWORD PTR [rax+0x0] int w;
19 Understanding the Stack The Stack <main>: 681: 55 push 682: e5,rsp 685: ec 10 sub rsp,0x10 689: c7 45 f DWORD PTR [-0x8],0x5 690: c7 45 fc fe ff ff ff DWORD PTR [-0x4],0xfffffffe 697: 8b 55 fc edx,dword PTR [-0x4] 69a: 8b 45 f8 eax,dword PTR [-0x8] 69d: 89 d6 esi,edx 69f: 89 c7 edi,eax 6a1: e8 bd ff ff ff call 663 <abs_mul> 6a6: DWORD PTR [rip+0x200988],eax 6ac: 8b eax,dword PTR [rip+0x200982] 6b2: 89 c6 esi,eax 6b4: 48 8d 3d lea rdi,[rip+0x99] 6bb: b eax,0x0 6c0: e8 6b fe ff ff call 530 6c5: b eax,0x0 6ca: c9 leave 6cb: c3 ret 6cc: 0f 1f nop parent func ret b a parent func DWORD PTR [rax+0x0] int w;
20 Understanding the Stack The Stack <abs_mul>: 663: 55 push 664: e5,rsp 667: ec 08 sub rsp,0x8 66b: 89 7d fc DWORD PTR [-0x4],edi 66e: f8 DWORD PTR [-0x8],esi 671: 8b 45 fc eax,dword PTR [-0x4] 674: 0f af 45 f8 imul eax,dword PTR [-0x8] 678: 89 c7 edi,eax 67a: e8 cb ff ff ff call 64a <absolute> 67f: c9 leave 680: c3 ret rsp abs_mul stack frame parent func parent func ret b a parent func int w;
21 Understanding the Stack The Stack <abs_mul>: 663: 55 push 664: e5,rsp 667: ec 08 sub rsp,0x8 66b: 89 7d fc DWORD PTR [-0x4],edi 66e: f8 DWORD PTR [-0x8],esi 671: 8b 45 fc eax,dword PTR [-0x4] 674: 0f af 45 f8 imul eax,dword PTR [-0x8] 678: 89 c7 edi,eax 67a: e8 cb ff ff ff call 64a <absolute> 67f: c9 leave 680: c3 ret rsp y x parent func parent func ret b a parent func int w;
22 Understanding the Stack The Stack <abs_mul>: 663: 55 push 664: e5,rsp 667: ec 08 sub rsp,0x8 66b: 89 7d fc DWORD PTR [-0x4],edi 66e: f8 DWORD PTR [-0x8],esi 671: 8b 45 fc eax,dword PTR [-0x4] 674: 0f af 45 f8 imul eax,dword PTR [-0x8] 678: 89 c7 edi,eax 67a: e8 cb ff ff ff call 64a <absolute> 67f: c9 leave 680: c3 ret parent func ret y x parent func parent func ret b a parent func int w;
23 Understanding the Stack The Stack a <absolute>: 64a: 55 push 64b: e5,rsp 64e: 89 7d fc DWORD PTR [-0x4],edi 651: 83 7d fc 00 cmp DWORD PTR [-0x4],0x0 655: jns 65e <absolute+0x14> 657: 8b 45 fc eax,dword PTR [-0x4] 65a: f7 d8 neg eax 65c: eb 03 jmp 661 <absolute+0x17> 65e: 8b 45 fc eax,dword PTR [-0x4] 661: 5d pop 662: c3 ret rsp absolute stack frame parent func parent func ret y x parent func parent func ret b a parent func int w;
24 Understanding the Stack The Stack a <absolute>: 64a: 55 push 64b: e5,rsp 64e: 89 7d fc DWORD PTR [-0x4],edi 651: 83 7d fc 00 cmp DWORD PTR [-0x4],0x0 655: jns 65e <absolute+0x14> 657: 8b 45 fc eax,dword PTR [-0x4] 65a: f7 d8 neg eax 65c: eb 03 jmp 661 <absolute+0x17> 65e: 8b 45 fc eax,dword PTR [-0x4] 661: 5d pop 662: c3 ret rsp x parent func parent func ret y x parent func parent func ret b a parent func int w;
25 Understanding the Stack The Stack a <absolute>: 64a: 55 push 64b: e5,rsp 64e: 89 7d fc DWORD PTR [-0x4],edi 651: 83 7d fc 00 cmp DWORD PTR [-0x4],0x0 655: jns 65e <absolute+0x14> 657: 8b 45 fc eax,dword PTR [-0x4] 65a: f7 d8 neg eax 65c: eb 03 jmp 661 <absolute+0x17> 65e: 8b 45 fc eax,dword PTR [-0x4] 661: 5d pop 662: c3 ret cleanup rsp parent func ret y x parent func parent func ret b a parent func int w;
26 Understanding the Stack The Stack <abs_mul>: 663: 55 push 664: e5,rsp 667: 48 8d a4 24 d8 ef ff lea rsp,[rsp-0x1028] 66e: ff 66f: c or QWORD PTR [rsp],0x0 674: 48 8d a lea rsp,[rsp+0x1020] 67b: 00 67c: 89 7d fc DWORD PTR [-0x4],edi 67f: f8 DWORD PTR [-0x8],esi 682: 8b 45 fc eax,dword PTR [-0x4] 685: 0f af 45 f8 imul eax,dword PTR [-0x8] 689: 89 c7 edi,eax 68b: e8 ba ff ff ff call 64a <absolute> 690: c9 leave 691: c3 ret rsp return address here y x parent func parent func ret b a parent func int w;
27 Understanding the Stack The Stack <abs_mul>: 663: 55 push 664: e5,rsp 667: 48 8d a4 24 d8 ef ff lea rsp,[rsp-0x1028] 66e: ff 66f: c or QWORD PTR [rsp],0x0 674: 48 8d a lea rsp,[rsp+0x1020] 67b: 00 67c: 89 7d fc DWORD PTR [-0x4],edi 67f: f8 DWORD PTR [-0x8],esi 682: 8b 45 fc eax,dword PTR [-0x4] 685: 0f af 45 f8 imul eax,dword PTR [-0x8] 689: 89 c7 edi,eax 68b: e8 ba ff ff ff call 64a <absolute> 690: c9 leave 691: c3 ret cleanup rsp parent func ret b a parent func int w;
28 Understanding the Stack The Stack <main>: 681: 55 push 682: e5,rsp 685: ec 10 sub rsp,0x10 689: c7 45 f DWORD PTR [-0x8],0x5 690: c7 45 fc fe ff ff ff DWORD PTR [-0x4],0xfffffffe 697: 8b 55 fc edx,dword PTR [-0x4] 69a: 8b 45 f8 eax,dword PTR [-0x8] 69d: 89 d6 esi,edx 69f: 89 c7 edi,eax 6a1: e8 bd ff ff ff call 663 <abs_mul> 6a6: DWORD PTR [rip+0x200988],eax 6ac: 8b eax,dword PTR [rip+0x200982] 6b2: 89 c6 esi,eax 6b4: 48 8d 3d lea rdi,[rip+0x99] 6bb: b eax,0x0 6c0: e8 6b fe ff ff call 530 6c5: b eax,0x0 6ca: c9 leave 6cb: c3 ret 6cc: 0f 1f nop return address here rsp b a parent func DWORD PTR [rax+0x0] int w;
29 Understanding the Stack The Stack <main>: 681: 55 push 682: e5,rsp 685: ec 10 sub rsp,0x10 689: c7 45 f DWORD PTR [-0x8],0x5 690: c7 45 fc fe ff ff ff DWORD PTR [-0x4],0xfffffffe 697: 8b 55 fc edx,dword PTR [-0x4] 69a: 8b 45 f8 eax,dword PTR [-0x8] 69d: 89 d6 esi,edx 69f: 89 c7 edi,eax 6a1: e8 bd ff ff ff call 663 <abs_mul> 6a6: DWORD PTR [rip+0x200988],eax 6ac: 8b eax,dword PTR [rip+0x200982] 6b2: 89 c6 esi,eax 6b4: 48 8d 3d lea rdi,[rip+0x99] 6bb: b eax,0x0 6c0: e8 6b fe ff ff call 530 6c5: b eax,0x0 6ca: c9 leave 6cb: c3 ret 6cc: 0f 1f nop cleanup rsp DWORD PTR [rax+0x0] int w;
30 Understanding the Stack When program thread starts, the operating system reserves some amount of space for the stack. Stack memory does not grow during runtime. int stack_overflow() { return stack_overflow(); } Caused by Badly written recursive functions Too much local memory allocated (esp with multi-threading) What happens if we need to allocate a large amount of local memory? We would need to know the size of it at compile time. But what if you wanted it to grow dynamically at runtime without know it beforehand?
31 Introducing the Heap also called Dynamic Memory (not related to the heap data structure) Application memory Heap Memory Heap Memory Call Stack Does not grow Globals int w; Instructions push, rsp Can grow while the application is running
32 Pointers #include <stdio.h> #include <stdlib.h> int main() { int *p; int x; Pointers *x are just integer numbers that point to the memory address. We can assign pointers to the address of &x variables. p = &x; x = 4; printf("ex1 printf("ex2 printf("ex3 printf("ex4 printf("ex5 printf("ex6 printf("ex7 = = = = = = = %p\n", %d\n", %d\n", %d\n", %d\n", %p\n", %p\n", p); *p); p[0]); p[ 1]); p[-1]); &p[1]); &p[2]); return 0; } We can read memory from outside
33 Using the Heap C int main() { float *ptr; functions new delete ptr = (float*)malloc(3*sizeof(float)); *ptr = 42; free(ptr); operators return 0; } Java malloc free C++ #include <stdlib.h> new lots of stuff resides on the heap Python In CPython, all objects live on the heap rsp malloc manages a pool of memory and *sometimes* makes calls to sbrk which zeros out new requests 0xf10 parent func 0xf0c 0xf10 0xf14 0xf18 0xf2c 0xf20 0xf24 0xf
34 Using the Heap C int main() { float *ptr; functions new delete ptr = (float*)malloc(3*sizeof(float)); *ptr = 42; free(ptr); operators return 0; } Java malloc free C++ #include <stdlib.h> new lots of stuff resides on the heap Python In CPython, all objects live on the heap rsp malloc manages a pool of memory and *sometimes* makes calls to sbrk which zeros out new requests 0xf10 parent func 0xf0c 0xf10 0xf14 0xf18 0xf2c 0xf20 0xf24 0xf
35 Using the Heap C int main() { float *ptr; functions new delete ptr = (float*)malloc(3*sizeof(float)); *ptr = 42; free(ptr); operators return 0; } Java malloc free C++ #include <stdlib.h> new lots of stuff resides on the heap Python In CPython, all objects live on the heap rsp malloc manages a pool of memory and *sometimes* makes calls to sbrk which zeros out new requests 0xf10 parent func 0xf0c 0xf10 0xf14 0xf18 0xf2c 0xf20 0xf24 0xf
36 Using the Heap #include <stdio.h> #include <stdlib.h> int main() { float *p; int i; p = (float*)malloc(100*sizeof(float)); Memory not guaranteed to be initialized to zero Can malloc memory to same size of some sensitive data for (i=0; i<100; ++i) p[i] = (float)rand()/(float)rand_max; free(p); Same size, so likely to get same memory p = (float*)malloc(100*sizeof(float)); p[0] = ; p[3] = 5.0; printf("p[0] = %f\n", p[0]); printf("p[1] = %f\n", p[1]); printf("p[2] = %f\n", p[2]); printf("p[3] = %f\n", p[3]); free(p); return 0; } Where did that come from?
37 Questions Which memory type is faster? Stack or Heap? Where does heap memory reside physically? Where does stack memory reside physically? What happens when stack memory leaves scope? What happens when heap memory leaves scope? In Java? ArrayList<Integer> v = new ArrayList<Integer>(); v.add(1); v.add(2); v.add(3); ; In C++? std::vector<int> v; v.push_back(1); v.push_back(2); v.push_back(3);...
38 What is good software? fast, secure, efficient, withstands the test of time, simple, intuitive, Sean Barrett, a legendary software veteran, creator of the famous stb libraries such as stb_image, a tiny single file public domain header that enables you to read JPG, PNG, TGA, BMP, PSD, instead of including huge monolithic libraries. Make it easily usable. Do anything you want with it. The suckless group, developers of well-written and extendable software, such as the DWM window manager - just 2146 lines of easy-to-understand C code. Simplicity, clarity, frugality Do one task, do it well Keep It Simple, Stupid! Inventing on principle, Immediate feedback! Writing secure software involves understanding the platform, and all the things that come between you (the developer) and the platform.
39 Understanding the Platform The key to writing good, secure, software is to understand the platform. Hardware is the base platform (for software). Lots of things get in the way: Compilers, Abstractions, Software Libraries, GUIs, Operating Systems, User Patches, Web Browsers,... Offtopic but relevant, assuming Lemi was a Durham University computer science student, what should Lemi have done? Stealing Webpages Rendered on Your Browser by Exploiting GPU Vulnerabilities
40 The Last Practical Challenge practical (more difficult than the others). Start: Work in groups of 2-5 unless you like a solo challenge. Have your own VM and do the tasks yourselves, but collaborate on solutions. You are not expected to finish it, and: you do not need to finish this one at home Username: level1 Password: level1 Double-click README and exploit.py in files. See how far you can get! Special thanks to Ross Bradley for his help in putting this together. Take your time to explore Kali linux and its rich tools.
Introduction to Intel x86-64 Assembly, Architecture, Applications, & Alliteration. Xeno Kovah
Introduction to Intel x86-64 Assembly, Architecture, Applications, & Alliteration Xeno Kovah 2014-2015 xeno@legbacore.com All materials is licensed under a Creative Commons Share Alike license. http://creativecommons.org/licenses/by-sa/3.0/
Cyber Security Software Security: Exploits and Mitigations. Dr Chris Willcocks
Cyber Security Software Security: Exploits and Mitigations Dr Chris Willcocks Recap Application memory Heap Memory Heap Memory Call Stack Does not grow Globals int w; Instructions push rbp rbp, rsp Can
Program Exploitation Intro
Program Exploitation Intro x86 Assembly 04//2018 Security 1 Univeristà Ca Foscari, Venezia What is Program Exploitation "Making a program do something unexpected and not planned" The right bugs can be
EECE.3170: Microprocessor Systems Design I Summer 2017 Homework 4 Solution
1. (40 points) Write the following subroutine in x86 assembly: Recall that: int f(int v1, int v2, int v3) { int x = v1 + v2; urn (x + v3) * (x v3); Subroutine arguments are passed on the stack, and can
Autodesk AutoCAD DWG-AC1021 Heap Corruption
security research Autodesk AutoCAD DWG-AC1021 Heap Corruption Mar 2013 AutoCAD is a software for computer-aided design (CAD) and technical drawing in 2D/3D, being one of the worlds leading CAD design tools.
Overview of Compiler. A. Introduction
CMPSC 470 Lecture 01 Topics: Overview of compiler Compiling process Structure of compiler Programming language basics Overview of Compiler A. Introduction What is compiler? What is interpreter? A very
LdPinch Report. Feng Zhu Jinpeng Wei
LdPinch Report Feng Zhu (fzhu001@fiu.edu), Jinpeng Wei (weijp@cs.fiu.edu) 1 Malware General Information Malware Name: LdPinch (named by ThreatExpert) File size: 641,536 bytes File type: PE32 executable
CSE 351 Midterm - Winter 2015
CSE 351 Midterm - Winter 2015 February 09, 2015 Please read through the entire examination first! We designed this exam so that it can be completed in 50 minutes and, hopefully, this estimate will prove
Practical Malware Analysis
Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the
1 Number Representation(10 points)
Name: Sp15 Midterm Q1 1 Number Representation(10 points) 1 NUMBER REPRESENTATION(10 POINTS) Let x=0xe and y=0x7 be integers stored on a machine with a word size of 4bits. Show your work with the following
CS , Spring 2004 Exam 1
Andrew login ID: Full Name: CS 15-213, Spring 2004 Exam 1 February 26, 2004 Instructions: Make sure that your exam is not missing any sheets (there should be 15), then write your full name and Andrew login
Reverse Engineering Low Level Software. CS5375 Software Reverse Engineering Dr. Jaime C. Acosta
1 Reverse Engineering Low Level Software CS5375 Software Reverse Engineering Dr. Jaime C. Acosta Machine code 2 3 Machine code Assembly compile Machine Code disassemble 4 Machine code Assembly compile
15-213/18-243, Fall 2010 Exam 1 - Version A
Andrew login ID: Full Name: Section: 15-213/18-243, Fall 2010 Exam 1 - Version A Tuesday, September 28, 2010 Instructions: Make sure that your exam is not missing any sheets, then write your Andrew login
CSE 351 Midterm - Winter 2015 Solutions
CSE 351 Midterm - Winter 2015 Solutions February 09, 2015 Please read through the entire examination first! We designed this exam so that it can be completed in 50 minutes and, hopefully, this estimate
Roadmap: Security in the software lifecycle. Memory corruption vulnerabilities
Secure Programming Lecture 3: Memory Corruption I (introduction) David Aspinall, Informatics @ Edinburgh 24th January 2019 Roadmap: Security in the software lifecycle Security is considered at different
Secure Programming Lecture 3: Memory Corruption I (Stack Overflows)
Secure Programming Lecture 3: Memory Corruption I (Stack Overflows) David Aspinall, Informatics @ Edinburgh 24th January 2017 Outline Roadmap Memory corruption vulnerabilities Instant Languages and Runtimes
Buffer Overflows Defending against arbitrary code insertion and execution
www.harmonysecurity.com info@harmonysecurity.com Buffer Overflows Defending against arbitrary code insertion and execution By Stephen Fewer Contents 1 Introduction 2 1.1 Where does the problem lie? 2 1.1.1
Computer Systems Lecture 9
Computer Systems Lecture 9 CPU Registers in x86 CPU status flags EFLAG: The Flag register holds the CPU status flags The status flags are separate bits in EFLAG where information on important conditions
CPS104 Recitation: Assembly Programming
CPS104 Recitation: Assembly Programming Alexandru Duțu 1 Facts OS kernel and embedded software engineers use assembly for some parts of their code some OSes had their entire GUIs written in assembly in
Do not turn the page until 5:10.
University of Washington Computer Science & Engineering Autumn 2018 Instructor: Justin Hsia 2018-10-29 Last Name: First Name: Student ID Number: Name of person to your Left Right All work is my own. I
Older geometric based addressing is called CHS for cylinder-head-sector. This triple value uniquely identifies every sector.
Review: On Disk Structures At the most basic level, a HDD is a collection of individually addressable sectors or blocks that are physically distributed across the surface of the platters. Older geometric
CPSC213/2014W1 Midterm EXTRA Practice
CPSC213/2014W1 Midterm EXTRA Practice DEC/HEX/BIN NUMERACY 1. Convert into decimal: 1a. 0x33 1b. 0x57 1c. 0xaf 1d. 0x7a 1e. 0x1234 1f. 0x69bd 1g. 0x1a64 1h. 0xdead 2. Convert into hex numbers of the specified
CSE 509: Computer Security
CSE 509: Computer Security Date: 2.16.2009 BUFFER OVERFLOWS: input data Server running a daemon Attacker Code The attacker sends data to the daemon process running at the server side and could thus trigger
Buffer Overflow. An Introduction
Buffer Overflow An Introduction Workshop Flow-1 Revision (4-10) How a program runs Registers Memory Layout of a Process Layout of a StackFrame Layout of stack frame using GDB and looking at Assembly code
Betriebssysteme und Sicherheit Sicherheit. Buffer Overflows
Betriebssysteme und Sicherheit Sicherheit Buffer Overflows Software Vulnerabilities Implementation error Input validation Attacker-supplied input can lead to Corruption Code execution... Even remote exploitation
Introduction to Computer Systems , fall th Lecture, Sep. 28 th
Introduction to Computer Systems 15 213, fall 2009 9 th Lecture, Sep. 28 th Instructors: Majd Sakr and Khaled Harras Last Time: Structures struct rec { int i; int a[3]; int *p; }; Memory Layout i a p 0
Overview REWARDS TIE HOWARD Summary CS 6V Data Structure Reverse Engineering. Zhiqiang Lin
CS 6V81-05 Data Structure Reverse Engineering Zhiqiang Lin Department of Computer Science The University of Texas at Dallas September 2 nd, 2011 Outline 1 Overview 2 REWARDS 3 TIE 4 HOWARD 5 Summary Outline
CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 21: Generating Pentium Code 10 March 08
CS412/CS413 Introduction to Compilers Tim Teitelbaum Lecture 21: Generating Pentium Code 10 March 08 CS 412/413 Spring 2008 Introduction to Compilers 1 Simple Code Generation Three-address code makes it
CPSC 213. Introduction to Computer Systems. Procedures and the Stack. Unit 1e Feb 11, 13, 15, and 25. Winter Session 2018, Term 2
CPSC 213 Introduction to Computer Systems Winter Session 2018, Term 2 Unit 1e Feb 11, 13, 15, and 25 Procedures and the Stack Overview Reading Companion: 2.8 Textbook: 3.7, 3.12 Learning Goals explain
ntroduction to C CS 2022: ntroduction to C nstructor: Hussam Abu-Libdeh (based on slides by Saikat Guha) Fall 2011, Lecture 1 ntroduction to C CS 2022, Fall 2011, Lecture 1 History of C Writing code in
Computer Systems C S Cynthia Lee
Computer Systems C S 1 0 7 Cynthia Lee 2 Today s Topics Code optimization! Optimization reality check Don t let it be your Waterloo. 4 Optimization Reality Check Optimization is really exciting but it
Rev101. spritzers - CTF team. spritz.math.unipd.it/spritzers.html
Rev101 spritzers - CTF team spritz.math.unipd.it/spritzers.html Disclaimer All information presented here has the only purpose of teaching how reverse engineering works. Use your mad skillz only in CTFs
CS356: Discussion #8 Buffer-Overflow Attacks. Marco Paolieri
CS356: Discussion #8 Buffer-Overflow Attacks Marco Paolieri (paolieri@usc.edu) Previous Example #include void unreachable() { printf("impossible.\n"); void hello() { char buffer[6]; scanf("%s",
PRESENTED BY: SANTOSH SANGUMANI & SHARAN NARANG
PRESENTED BY: SANTOSH SANGUMANI & SHARAN NARANG Table of contents Introduction Binary Disassembly Return Address Defense Prototype Implementation Experimental Results Conclusion Buffer Over2low Attacks
Return-orientated Programming
Return-orientated Programming or The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86) Hovav Shacham, CCS '07 Return-Oriented oriented Programming programming
Towards the Hardware"
CSC 2400: Computer Systems Towards the Hardware Chapter 2 Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32) 1 High-Level Language Make programming
Intro to x86 Binaries. From ASM to exploit
Intro to x86 Binaries From ASM to exploit Intro to x86 Binaries I lied lets do a quick ctf team thing Organization Ideas? Do we need to a real structure right now? Mailing list is OTW How do we get more
Do not turn the page until 12:30.
University of Washington Computer Science & Engineering Autumn 2016 Instructor: Justin Hsia 2016-12-13 Last Name: First Name: Student ID Number: Section you attend (circle): Chris Yufang John Kevin Sachin
Assembly Programmer s View Lecture 4A Machine-Level Programming I: Introduction
Assembly Programmer s View Lecture 4A Machine-Level Programming I: Introduction E I P CPU isters Condition Codes Addresses Data Instructions Memory Object Code Program Data OS Data Topics Assembly Programmer
CS356: Discussion #7 Buffer Overflows. Marco Paolieri
CS356: Discussion #7 Buffer Overflows Marco Paolieri (paolieri@usc.edu) Array Bounds class Bounds { public static void main(string[] args) { int[] x = new int[10]; for (int i = 0; i
CNIT 127: Exploit Development. Ch 1: Before you begin. Updated
CNIT 127: Exploit Development Ch 1: Before you begin Updated 1-14-16 Basic Concepts Vulnerability A flaw in a system that allows an attacker to do something the designer did not intend, such as Denial
Memory Allocation in C
Memory Allocation in C When a C program is loaded into memory, it is organized into three areas of memory, called segments: the text segment, stack segment and heap segment. The text segment (also called
Subprograms, Subroutines, and Functions
Subprograms, Subroutines, and Functions Subprograms are also called subroutines, functions, procedures and methods. A function is just a subprogram that returns a value; say Y = SIN(X). In general, the
Execution Example. Building the network. This will illustrate some specific properties of a CorTeX simulation.
Execution Example This will illustrate some specific properties of a CorTeX simulation. Building the network Let s start with building the network and select a very basic model. To compare with other existing
CVE EXPLOIT USING 108 BYTES AND DOWNLOADING A FILE WITH YOUR UNLIMITED CODE BY VALTHEK
CVE-2017-11882 EXPLOIT USING 108 BYTES AND DOWNLOADING A FILE WITH YOUR UNLIMITED CODE BY VALTHEK First words of thank to Embedy Company to discover the initial exploit and POC of 44 bytes máximum, Ridter
Dynamic Memory Allocation. Zhaoguo Wang
Dynamic Memory Allocation Zhaoguo Wang Why dynamic memory allocation? Do not know the size until the program runs (at runtime). #define MAXN 15213 int array[maxn]; int main(void) { int i, n; scanf("%d",
Beyond Stack Smashing: Recent Advances in Exploiting. Jonathan Pincus(MSR) and Brandon Baker (MS)
Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns Jonathan Pincus(MSR) and Brandon Baker (MS) Buffer Overflows and How they Occur Buffer is a contiguous segment of memory of a fixed
CS , Fall 2004 Exam 1
Andrew login ID: Full Name: CS 15-213, Fall 2004 Exam 1 Tuesday October 12, 2004 Instructions: Make sure that your exam is not missing any sheets, then write your full name and Andrew login ID on the front.
Processor state. Information about currently executing program. %rax, %rdi, ... %r14 %r15. %rsp. %rip CF ZF SF OF. Temporary data
Processor state Information about currently executing program Temporary data %rax, %rdi, current parameters, local variables Location of runtime stack %rsp Location of current instruction %rip Status of
Buffer-Overflow Attacks on the Stack
Computer Systems Buffer-Overflow Attacks on the Stack Introduction A buffer overflow occurs when a program, while writing data to a buffer, overruns the buffer's boundary and overwrites memory in adjacent
CIS-331 Exam 2 Fall 2015 Total of 105 Points Version 1
Version 1 1. (20 Points) Given the class A network address 117.0.0.0 will be divided into multiple subnets. a. (5 Points) How many bits will be necessary to address 4,000 subnets? b. (5 Points) What is
CSCE 212H, Spring 2008 Lab Assignment 3: Assembly Language Assigned: Feb. 7, Due: Feb. 14, 11:59PM
CSCE 212H, Spring 2008 Lab Assignment 3: Assembly Language Assigned: Feb. 7, Due: Feb. 14, 11:59PM February 7, 2008 1 Overview The purpose of this assignment is to introduce you to the assembly language
CS , Fall 2007 Exam 1
Andrew login ID: Full Name: CS 15-213, Fall 2007 Exam 1 Wednesday October 17, 2007 Instructions: Make sure that your exam is not missing any sheets, then write your full name and Andrew login ID on the
CSC 2400: Computer Systems. Using the Stack for Function Calls
CSC 24: Computer Systems Using the Stack for Function Calls Lecture Goals Challenges of supporting functions! Providing information for the called function Function arguments and local variables! Allowing
CIS-331 Fall 2013 Exam 1 Name: Total of 120 Points Version 1
Version 1 1. (24 Points) Show the routing tables for routers A, B, C, and D. Make sure you account for traffic to the Internet. NOTE: Router E should only be used for Internet traffic. Router A Router
Subprograms: Arguments
Subprograms: Arguments ICS312 Machine-Level and Systems Programming Henri Casanova (henric@hawaii.edu) Activation Records The stack is useful to store and rieve urn addresses, transparently managed via
Buffer Overflow Attack (AskCypert CLaaS)
Buffer Overflow Attack (AskCypert CLaaS) ---------------------- BufferOverflow.c code 1. int main(int arg c, char** argv) 2. { 3. char name[64]; 4. printf( Addr;%p\n, name); 5. strcpy(name, argv[1]); 6.
CIT Week13 Lecture
CIT 3136 - Week13 Lecture Runtime Environments During execution, allocation must be maintained by the generated code that is compatible with the scope and lifetime rules of the language. Typically there
CMPSC 497 Buffer Overflow Vulnerabilities
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CMPSC 497 Buffer Overflow
CS5460: Operating Systems
CS5460: Operating Systems Lecture 2: OS Hardware Interface (Chapter 2) Course web page: http://www.eng.utah.edu/~cs5460/ CADE lab: WEB L224 and L226 http://www.cade.utah.edu/ Projects will be on Linux
CIS-331 Fall 2014 Exam 1 Name: Total of 109 Points Version 1
Version 1 1. (24 Points) Show the routing tables for routers A, B, C, and D. Make sure you account for traffic to the Internet. Router A Router B Router C Router D Network Next Hop Next Hop Next Hop Next
Buffer Overflow. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University
Buffer Overflow Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu x86-64/linux Memory Layout Stack Runtime stack (8MB limit) Heap Dynamically allocated
CNIT 127: Exploit Development. Ch 2: Stack Overflows in Linux
CNIT 127: Exploit Development Ch 2: Stack Overflows in Linux Stack-based Buffer Overflows Most popular and best understood exploitation method Aleph One's "Smashing the Stack for Fun and Profit" (1996)
CS24: INTRODUCTION TO COMPUTING SYSTEMS. Spring 2018 Lecture 4
CS24: INTRODUCTION TO COMPUTING SYSTEMS Spring 2018 Lecture 4 LAST TIME Enhanced our processor design in several ways Added branching support Allows programs where work is proportional to the input values
CIS-331 Exam 2 Fall 2014 Total of 105 Points. Version 1
Version 1 1. (20 Points) Given the class A network address 119.0.0.0 will be divided into a maximum of 15,900 subnets. a. (5 Points) How many bits will be necessary to address the 15,900 subnets? b. (5
Buffer Overflow. Jinkyu Jeong Computer Systems Laboratory Sungkyunkwan University
Buffer Overflow Jinkyu Jeong (jinkyu@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu SSE2030: Introduction to Computer Systems, Spring 2018, Jinkyu Jeong (jinkyu@skku.edu)
15-213/18-243, Spring 2011 Exam 1
Andrew login ID: Full Name: Section: 15-213/18-243, Spring 2011 Exam 1 Thursday, March 3, 2011 (v1) Instructions: Make sure that your exam is not missing any sheets, then write your Andrew login ID, full
Introduction Presentation A
CSE 2421/5042: Systems I Low-Level Programming and Computer Organization Introduction Presentation A Read carefully: Bryant Chapter 1 Study: Reek Chapter 2 Skim: Reek Chapter 1 08/22/2018 Gojko Babić Some
IA-32 Architecture. CS 4440/7440 Malware Analysis and Defense
IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security professionals constantly analyze assembly language code } Many exploits are written in assembly } Source code
Processes. Johan Montelius KTH
Processes Johan Montelius KTH 2017 1 / 47 A process What is a process?... a computation a program i.e. a sequence of operations a set of data structures a set of registers means to interact with other
SA31675 / CVE
Generated by Secunia 10 September, 2008 5 pages Table of Contents Introduction 2 Technical Details 2 Exploitation 4 Characteristics 4 Tested Versions 4 Fixed Versions 5 References 5 Generated by Secunia
X86 Addressing Modes Chapter 3" Review: Instructions to Recognize"
X86 Addressing Modes Chapter 3" Review: Instructions to Recognize" 1 Arithmetic Instructions (1)! Two Operand Instructions" ADD Dest, Src Dest = Dest + Src SUB Dest, Src Dest = Dest - Src MUL Dest, Src
EECS 213 Introduction to Computer Systems Dinda, Spring Homework 3. Memory and Cache
Homework 3 Memory and Cache 1. Reorder the fields in this structure so that the structure will (a) consume the most space and (b) consume the least space on an IA32 machine on Linux. struct foo { double
x86 assembly CS449 Fall 2017
x86 assembly CS449 Fall 2017 x86 is a CISC CISC (Complex Instruction Set Computer) e.g. x86 Hundreds of (complex) instructions Only a handful of registers RISC (Reduced Instruction Set Computer) e.g. MIPS
Advanced Buffer Overflow
Pattern Recognition and Applications Lab Advanced Buffer Overflow Ing. Davide Maiorca, Ph.D. davide.maiorca@diee.unica.it Computer Security A.Y. 2016/2017 Department of Electrical and Electronic Engineering
CSC 8400: Computer Systems. Machine-Level Representation of Programs
CSC 8400: Computer Systems Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32) 1 Compilation Stages
A process. the stack
A process Processes Johan Montelius What is a process?... a computation KTH 2017 a program i.e. a sequence of operations a set of data structures a set of registers means to interact with other processes
MODULE 5: Pointers, Preprocessor Directives and Data Structures
MODULE 5: Pointers, Preprocessor Directives and Data Structures 1. What is pointer? Explain with an example program. Solution: Pointer is a variable which contains the address of another variable. Two
Lecture 4 CIS 341: COMPILERS
Lecture 4 CIS 341: COMPILERS CIS 341 Announcements HW2: X86lite Available on the course web pages. Due: Weds. Feb. 7 th at midnight Pair-programming project Zdancewic CIS 341: Compilers 2 X86 Schematic
Functions. Ray Seyfarth. August 4, Bit Intel Assembly Language c 2011 Ray Seyfarth
Functions Ray Seyfarth August 4, 2011 Functions We will write C compatible function C++ can also call C functions using extern "C" {...} It is generally not sensible to write complete assembly programs
Ramblr. Making Reassembly Great Again
Ramblr Making Reassembly Great Again Ruoyu Fish Wang, Yan Shoshitaishvili, Antonio Bianchi, Aravind Machiry, John Grosen, Paul Grosen, Christopher Kruegel, Giovanni Vigna Motivation Available Solutions
UW CSE 351, Winter 2013 Midterm Exam
Full Name: Student ID: UW CSE 351, Winter 2013 Midterm Exam February 15, 2013 Instructions: Make sure that your exam is not missing any of the 9 pages, then write your full name and UW student ID on the
Lab 2: Buffer Overflows
Department of Computer Science: Cyber Security Practice Lab 2: Buffer Overflows Introduction In this lab, you will learn how buffer overflows and other memory vulnerabilities are used to takeover vulnerable
Illustration of the problem
NTIC : Using a customized malloc on Solaris 8 and 0. This page last changed on Jun 24, 2008 by sable. Sungard GP3 uses a virtual machine called "Magnum Runtime" to execute applications written with an
Buffer-Overflow Attacks on the Stack
Computer Systems Buffer-Overflow Attacks on the Stack Introduction A buffer overflow occurs when a program, while writing data to a buffer, overruns the buffer's boundary and overwrites memory in adjacent
CS , Spring 2002 Exam 2
Full Name: CS 15-213, Spring 2002 Exam 2 March 28, 2002 Instructions: Make sure that your exam is not missing any sheets, then write your full name and Andrew login ID on the front. Write your answers
CSC 591 Systems Attacks and Defenses Return-into-libc & ROP
CSC 591 Systems Attacks and Defenses Return-into-libc & ROP Alexandros Kapravelos akaprav@ncsu.edu NOEXEC (W^X) 0xFFFFFF Stack Heap BSS Data 0x000000 Code RW RX Deployment Linux (via PaX patches) OpenBSD
WebAssembly. neither Web nor Assembly, but Revolutionary
WebAssembly neither Web nor Assembly, but Revolutionary The WebAssembly revolution has begun Jay Phelps Chief Software Architect previously Support, Dev Rel, Staff Augmentation, Mentorship, and more www.thisdot.co
Assembly level Programming. 198:211 Computer Architecture. (recall) Von Neumann Architecture. Simplified hardware view. Lecture 10 Fall 2012
19:211 Computer Architecture Lecture 10 Fall 20 Topics:Chapter 3 Assembly Language 3.2 Register Transfer 3. ALU 3.5 Assembly level Programming We are now familiar with high level programming languages
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it 29.11.2012 Secure Software Engineering Andreas Follner 1 Andreas Follner Graduated earlier
Lab 10: Introduction to x86 Assembly
CS342 Computer Security Handout # 8 Prof. Lyn Turbak Wednesday, Nov. 07, 2012 Wellesley College Revised Nov. 09, 2012 Lab 10: Introduction to x86 Assembly Revisions: Nov. 9 The sos O3.s file on p. 10 was
4. Specifications and Additional Information
4. Specifications and Additional Information AGX52004-1.0 8B/10B Code This section provides information about the data and control codes for Arria GX devices. Code Notation The 8B/10B data and control
Machine Language, Assemblers and Linkers"
Machine Language, Assemblers and Linkers 1 Goals for this Lecture Help you to learn about: IA-32 machine language The assembly and linking processes 2 1 Why Learn Machine Language Last stop on the language
Introduction to Intel x86-64 Assembly, Architecture, Applications, & Alliteration. Xeno Kovah
Introduction to Intel x86-64 Assembly, Architecture, Applications, & Alliteration Xeno Kovah 2014-2015 xeno@legbacore.com All materials is licensed under a Creative Commons Share Alike license. http://creativecommons.org/licenses/by-sa/3.0/
CS 537: Introduction to Operating Systems Fall 2015: Midterm Exam #1
CS 537: Introduction to Operating Systems Fall 2015: Midterm Exam #1 This exam is closed book, closed notes. All cell phones must be turned off. No calculators may be used. You have two hours to complete
Biography. Background
From Over ow to Shell An Introduction to low-level exploitation Carl Svensson @ KTH, January 2019 1 / 28 Biography MSc in Computer Science, KTH Head of Security, KRY/LIVI CTF: HackingForSoju E-mail: calle.svensson@zeta-two.com
Outline. x86 Architecture
Data Representation Code Representation Summary Data Representation Code Representation Summary Code Representation Summary Outline CS 6V81-05: System Security and Malicious Code Analysis 1 2 Data Representation
Here is a C function that will print a selected block of bytes from such a memory block, using an array-based view of the necessary logic:
Pointer Manipulations Pointer Casts and Data Accesses Viewing Memory The contents of a block of memory may be viewed as a collection of hex nybbles indicating the contents of the byte in the memory region;
Illustration of the problem
NTIC : Using a customized malloc on AIX 5.2 and 5.3 This page last changed on Jun 24, 2008 by sable. Sungard GP3 uses a virtual machine called "Magnum Runtime" to execute applications written with an inhouse
THEORY OF COMPILATION
Lecture 10 Activation Records THEORY OF COMPILATION EranYahav www.cs.technion.ac.il/~yahave/tocs2011/compilers-lec10.pptx Reference: Dragon 7.1,7.2. MCD 6.3,6.4.2 1 You are here Compiler txt Source Lexical