DOCSLIB.ORG

Ljubljana, 2015 Zbornik Digitalna Forenzika, Seminarske Naloge 2014/2015

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Ljubljana, 2015 Zbornik Digitalna Forenzika, Seminarske Naloge 2014/2015 2014/2015 Ljubljana, 2015 Zbornik Digitalna forenzika, Seminarske naloge 2014/2015 Editors: Andrej Brodnik, Luka Krsnik, Anˇze Mikec, Nejc Novak, ˇstudenti Ljubljana : Univerza v Ljubljani, Fakulteta za raˇcunalniˇstvo in informatiko, 2015. c These proceedings are for internal purposes and under copyright of University of Ljubljana, Faculty of Computer and Information Science. Any redistribution of the contents in any form is prohibited. All rights reserved. Kazalo 1 Povzetki (abstracts) 4 1.1 Distributed filesystem forensics: XtreemFS as a case study . .4 1.2 Pregled "Asset Risk Scoring in Enterprise Network with Mutually Reinforced Reputation Propagation" . .4 1.3 Pregled analiz in gradnja kriminalnih mreˇz . .4 1.4 Uspeˇsnostkampanj z nezaˇzelenopoˇstoin botneti . .5 1.5 Forenziˇcnaanaliza z DNSSEC . .5 1.6 Preiskovanje napadov povezanih z izvornimi vrati 0 . .5 1.7 Detecting NAT gateways and differenting host devices behind NAT for purposes of digital forensic investigations . .6 1.8 Steganografija v LTE (Long Term Evolution) sistemi . .6 1.9 Overview of PeerShark and other software for detecting peer-to-peer botnets . .6 1.10 Cloud Forensics: iCloud . .6 1.11 Towards a Forencsic-Aware Database Solution: Using a secured Database Replication Protocol and Transaction Management for Digital Investigations . .7 1.12 Prednosti in slabosti ˇzive in mrtve forenziˇcneanalize . .7 1.13 VMI-PL: Jezik za nadzor navideznih platform z vpogledom v navidezne stroje . .7 1.14 Impacts of increasing volume of digital forensics data: A survey and future research chal- lenges . .8 1.15 Video Evidence as Used in Court of Law and its Source Identification . .8 1.16 Pridobivanje skritih sporoˇciliz steganografskih slik . .8 1.17 Analiza stisnjenega RAM-a na operacijskih sistemih Mac OS X in Linux . .8 1.18 Skrivanje podatkov v ˇsifriranih video vsebinah H.264/AVC s pomoˇcjozamenjave kodnih besed ...............................................9 1.19 Samodejno prepoznavanje kopiranih kriminalnih spletnih strani z metodo gruˇcenja . .9 I Digitalna forenzika na diskih 11 Distributed filesstem forensics: XtreemFS as a case study . 12 1 II Digitalna forenzika na omreˇzjih 18 Pregled "Asset Risk Scoring in Enterprise Network with Mutually Reinforced Reputation Propagation" . 19 Pregled analiz in gradenj kriminalnih mreˇz . 23 Uspeˇsnostkampanj z nezaˇzelenopoˇsto in botneti . 30 Forenziˇcnaanaliza z DNSSEC . 37 Preiskovanje napadov povezanih z izvornimi vrati 0 . 42 Detecting NAT gateways and differenting host devices behind NAT for purposes of digital forensic investigations . 51 Steganografija v LTE sistemih . 58 Overview of PeerShark and other software for detecting peer-to-peer botnets . 66 Cloud Forensics - iCloud . 72 III Digitalna forenzika na sistemih 79 Towards a Forencsic-Aware Database Solution: Using a secured Database Replication Protocol and Transaction Management for Digital Investigations . 80 Prednosti in slabosti ˇzive in mrtve forenziˇcneanalize . 87 VMI-PL: Jezik za nadzor navideznih platform z vpogledom v navidezne stroje . 94 IV Druga podroˇcjadigitalne forenzike 97 Impacts of increasing volume of digital forensics data: A survey and future research chal- lenges . 98 Video Evidence as Used in Court of Law and its Source Identification . 108 Pridobivanje skritih sporoˇciliz steganografskih slik . 116 Analiza stisnjenega RAM-a na operacijskih sistemih Mac OS X in Linux . 123 Skrivanje podatkov v ˇsifriranihvideo vsebinah H.264/AVC s pomoˇcjozamenjave kodnih besed ............................................... 131 Samodejno prepoznavanje kopiranih kriminalnih spletnih strani z metodo gruˇcanja. 138 2 Uvod Forenziˇcnaznanost je znanstvena metoda, ki zbira, prouˇcujein hrani informacije preteklosti, ki jih lahko uporabimo na sodiˇsˇcih.Z razvojem na razliˇcnih podroˇcjihse je znanost moˇcnorazˇsirila,zato najverje- tneje ne obstaja nihˇce,ki bi poznal celotno podroˇcjeforenzike. Forenziˇcnoznanost tvori veˇcpodvej. To so npr. digitalna forenzika, bioforenzika, forenziˇcnakemija itd. Zbornik se osredotoˇcana digitalno forenziko. To je veja forenziˇcneznanosti, ki se nanaˇsana materialne dokaze iz digitalnih naprav. Digitalno forenziko bi lahko dalje razdelili na raˇcunalniˇsko (datoteˇcno)fo- renziko (hranjenje in analiza raˇcunalnikov), omreˇznoforenziko (hranjenje in analiza prometa ter logov omreˇzja),mobilno forenziko (hranjenje in analiza pametnih telefonov ter sistemov GPS) in forenziko slabogramja (hranjenje in analiza zlonamerne kode). Studentjeˇ magistrskega ˇstudijaFakultete za raˇcunalniˇstvo in informatiko Univerze v Ljubljani, ki smo obiskovali predmet Digitalna forenzika, smo med ˇstudijskimletom dobili nalogo, katere rezultat je ta zbornik. Med nalogo smo bili razdeljeni v skupine z najveˇctremi ˇclani.Vsaka skupina je dobila ˇclanek, ki se je navezoval na eno izmed vej digitalne forenzike in je bil v ˇcasupisanja aktualen (veˇcinajih je izˇsla v letu 2014). Skupine so dodeljeni ˇclanekmorale prebrati, raziskati podobne ˇclanke in napisati njihovo obnovo, za boljˇsooceno pa so lahko tudi izvedle eksperiment, ki je bil opisan v ˇclanku. Vse te naloge, ki smo jih lahko napisali v slovenˇsˇciniali angleˇsˇcini,so strnjene v seminarsko nalogo. Vsak ˇstudent je po zapisani seminarski nalogi dobil dva druga ˇclanka, ki ju je moral recenzirati (kot bi rokovali s pravimi ˇclanki).Po recenziji so bile vse naloge ˇse enkrat pregledane in popravljene. Ta zbornik predstavlja skupek vseh konˇcnihseminarskih nalog, ki so bile narejene v ˇstudijskem letu 2014/2015. Namenjen je vsem, ki jih zanima podroˇcjedigitalne forenzike ali pa le specifiˇcnatema, opi- sana v zborniku. Upam, da ob prebiranju izveste kaj novega, zanimivega in uporabnega. Luka Krsnik 3 Poglavje 1 Povzetki (abstracts) 1.1 Distributed filesystem forensics: XtreemFS as a case study Clanekˇ opisuje postopek forenziˇcnepreiskave porazdeljenih datoteˇcnihsistemov v oblaku, pri ˇcemer se osredotoˇcina znan datoteˇcnisistem XtreemFS. Porazdeljeni datoteˇcnisistemi nam nudijo cenovno ugodne in efektivne reˇsitve za shranjevanje velikih koliˇcinpodatkov v oblaku. Tudi te tehnologije so lahko izkoriˇsˇcenev zlonamerne namene, zato potrebujemo postopke in orodja za digitalno forenziˇcno preiskavo. V ˇclankuavtorja uporabita predlagan sploˇsenpostopek preiskave porazdeljenih datoteˇcnih sistemov na sistemu XtreemFS, pri ˇcemerga razˇsiritas speciˇcnimilastnostmi sistema XtreemFS, ki jih je potrebno upoˇstevati pri zbiranju dokaznega gradiva. Avtorja na koncu ˇclanka tudi predlagata natanˇcen proces zbiranja digitalnih dokazov iz porazdeljenih datoteˇcnihsistemov. 1.2 Pregled "Asset Risk Scoring in Enterprise Network with Mutually Reinforced Reputation Propagation" Clanekˇ Asset Risk Scoring in Enterprise Network with Mutually Reinforced Reputation Propagation predstavlja metodo za vrednotenje ogroˇzenostiv omreˇzjuimenovano MUSE (Mutually-reinforced Un- supervised Scoring for Enterprise risk). Pregledali bomo algoritme, na katerih je metoda osnovana in podroˇcjeuporabe, ki mu je namenjena. Metoda uporablja ideje, ki so ˇzeznane iz analiz varnosti na spletu in jih uporabi za analizo omreˇzjav podjetju. Dobljene rezultate je mogoˇceuporabiti za bolj uˇcinkovito zaznavanje groˇzenjter za pomoˇcpri preiskavi. Na koncu bomo predstavili ˇsepodrobnosti same metode in njeno analizo. 1.3 Pregled analiz in gradnja kriminalnih mreˇz V zaˇcetnemdelu priˇcujoˇcegabesedila je predstavljen ˇclanekConstructing and Analyzing Criminal Ne- tworks, v katerem se avtorji ˇclanka spraˇsujejo,ali lahko s pomoˇcjojavno pridobljenih e-poˇstnih naslovov (s pomoˇcjoFacebook profilov) kriminalcev zgradijo smiselno mreˇzoin na tak naˇcinodkrijejo kriminalne 4 skupine, vodje teh skupin in osebe, ki kriminalne skupine povezujejo. V ˇclankuavtorji predstavijo me- todologijo, orodja in mere, ki so jih uporabili pri raziskovanju, vse troje pa je predstavljeno tudi v tem ˇclanku. Kratek pregled obstojeˇcih raziskav, ki je predstavljen v besedilu, zagotovo ne zajema vseh ob- javljenih del in celotnega obravnavanega podroˇcja,obsega pa dela s podroˇcjasocialnih mreˇzin analiz ter s podroˇcjakriminalnih socialnih mreˇz.Podobna metodologija, orodja in mere, kot so jih uporabljali omenjeni avtorji, so uporabljene tudi v zadnjem delu ˇclanka, ki opisuje uporabo teh orodij na mreˇzi plezalnega centra Ljubljana. 1.4 Uspeˇsnostkampanj z nezaˇzelenopoˇstoin botneti Poˇsiljanjenezaˇzelenepoˇstepovzroˇcateˇzave tako konˇcnimnaslovnikom kot tudi vmesnim ˇclenom - po- nudnikom raznih spletnih storitev, lastnikom raˇcunalnikov, ki so del botnetov in mreˇzni arhitekturi. Poˇsiljateljise posluˇzujejoveliko razliˇcnihmetod za doseganje ˇcimviˇsjeuˇcinkovitosti in uspeˇsnostioz. dostavljivosti nezaˇzelenihsporoˇcil- v tem delu smo naredili kratek pregled stanja na tem podroˇcjuin skuˇsamoizpostaviti najpomembnejˇse. Nezaˇzelenasporoˇcilase ˇsirijone le v domeni elektronske poˇste, temveˇctudi preko veliko drugih elektronskih kanalov. Za laˇzjein uˇcinkovitejˇsepoˇsiljanje se avtorji kampanj posluˇzujejobotnetov - omreˇzjaokuˇzenihraˇcunalnikov, ki sluˇzijo namenu poˇsiljanja nezaˇzelene poˇste.V delu je predstavljena arhitektura botnetov in opisan eden izmed najveˇcjih,Cutwail. 1.5 Forenziˇcnaanaliza z DNSSEC Zastrupljanje DNS predpomnilnika je pogosta oblika raˇcunalniˇskega napada, s katero je mogoˇcenadzoro- vati ˇzrtvinspletni promet, ji uvajati omejitve pri dostopu, oziroma do nje prenaˇsati ˇskodljivo programsko opremo. Njegovo obvladovanje je eden kljuˇcnihdejavnikov za zagotavljanje pravilnosti in dostopnosti internetnega omreˇzjain
Load more

Recommended publications
  • Tesi Final Marco Oliverio.Pdf
    i Abstract Advancements in exploitation techniques call for the need of advanced defenses. Modern operating systems have to face new sophisticate attacks that do not rely on any programming mistake, rather they exploit leaking information from computational side effects (side-channel attacks) or hardware glitches (rowhammer attacks). Mitigating these new attacks poses new challanges and involves delicate trade-offs, balancing security on one side and performance, simplicity, and compatibility on the other. In this disseration we explore the attack surface exposed by page fusion, a memory saving optimization in modern operating systems and, after that, a secure page fusion implementation called VUsion is shown. We then propose a complete and compatible software solution to rowhammer attacks called ZebRAM. Lastly, we show OpenCAL, a free and general libray for the implementation of Cellular Automata, that can be used in several security scenarios. iii Acknowledgements I would like to thank my Supervisor prof. Andrea Pugliese for the encouragement and the extremely valuable advice that put me in a fruitful and exciting research direction. A hearty acknowledgment goes to Kaveh Razavi, Cristiano Giuffrida, Herbert Bos and all the VUSec group of the Vrije Universiteit of Amsterdam. I felt at home from day one and I found myself surrounded by brilliant researchers and good friends. v Contents Abstract i Acknowledgements iii Introduction1 1 VUsion3 1.1 Introduction...................................3 1.2 Page Fusion...................................5 1.2.1 Linux Kernel Same-page Merging...................5 1.2.2 Windows Page Fusion.........................7 1.3 Threat Model..................................8 1.4 Known Attack Vectors.............................8 1.4.1 Information Disclosure.........................8 1.4.2 Flip Feng Shui.............................9 1.5 New Attack Vectors..............................
    [Show full text]
  • An In-Depth Study with All Rust Cves
    Memory-Safety Challenge Considered Solved? An In-Depth Study with All Rust CVEs HUI XU, School of Computer Science, Fudan University ZHUANGBIN CHEN, Dept. of CSE, The Chinese University of Hong Kong MINGSHEN SUN, Baidu Security YANGFAN ZHOU, School of Computer Science, Fudan University MICHAEL R. LYU, Dept. of CSE, The Chinese University of Hong Kong Rust is an emerging programing language that aims at preventing memory-safety bugs without sacrificing much efficiency. The claimed property is very attractive to developers, and many projects start usingthe language. However, can Rust achieve the memory-safety promise? This paper studies the question by surveying 186 real-world bug reports collected from several origins which contain all existing Rust CVEs (common vulnerability and exposures) of memory-safety issues by 2020-12-31. We manually analyze each bug and extract their culprit patterns. Our analysis result shows that Rust can keep its promise that all memory-safety bugs require unsafe code, and many memory-safety bugs in our dataset are mild soundness issues that only leave a possibility to write memory-safety bugs without unsafe code. Furthermore, we summarize three typical categories of memory-safety bugs, including automatic memory reclaim, unsound function, and unsound generic or trait. While automatic memory claim bugs are related to the side effect of Rust newly-adopted ownership-based resource management scheme, unsound function reveals the essential challenge of Rust development for avoiding unsound code, and unsound generic or trait intensifies the risk of introducing unsoundness. Based on these findings, we propose two promising directions towards improving the security of Rust development, including several best practices of using specific APIs and methods to detect particular bugs involving unsafe code.
    [Show full text]
  • Ensuring the Spatial and Temporal Memory Safety of C at Runtime
    MemSafe: Ensuring the Spatial and Temporal Memory Safety of C at Runtime Matthew S. Simpson, Rajeev K. Barua Department of Electrical & Computer Engineering University of Maryland, College Park College Park, MD 20742-3256, USA fsimpsom, [email protected] Abstract—Memory access violations are a leading source of dereferencing pointers obtained from invalid pointer arith- unreliability in C programs. As evidence of this problem, a vari- metic; and dereferencing uninitialized, NULL or “manufac- ety of methods exist that retrofit C with software checks to detect tured” pointers.1 A temporal error is a violation caused by memory errors at runtime. However, these methods generally suffer from one or more drawbacks including the inability to using a pointer whose referent has been deallocated (e.g. with detect all errors, the use of incompatible metadata, the need for free) and is no longer a valid object. The most well-known manual code modifications, and high runtime overheads. temporal violations include dereferencing “dangling” point- In this paper, we present a compiler analysis and transforma- ers to dynamically allocated memory and freeing a pointer tion for ensuring the memory safety of C called MemSafe. Mem- more than once. Dereferencing pointers to automatically allo- Safe makes several novel contributions that improve upon previ- ous work and lower the cost of safety. These include (1) a method cated memory (stack variables) is also a concern if the address for modeling temporal errors as spatial errors, (2) a compati- of the referent “escapes” and is made available outside the ble metadata representation combining features of object- and function in which it was defined.
    [Show full text]
  • Improving Memory Management Security for C and C++
    Improving memory management security for C and C++ Yves Younan, Wouter Joosen, Frank Piessens, Hans Van den Eynden DistriNet, Katholieke Universiteit Leuven, Belgium Abstract Memory managers are an important part of any modern language: they are used to dynamically allocate memory for use in the program. Many managers exist and depending on the operating system and language. However, two major types of managers can be identified: manual memory allocators and garbage collectors. In the case of manual memory allocators, the programmer must manually release memory back to the system when it is no longer needed. Problems can occur when a programmer forgets to release it (memory leaks), releases it twice or keeps using freed memory. These problems are solved in garbage collectors. However, both manual memory allocators and garbage collectors store management information for the memory they manage. Often, this management information is stored where a buffer overflow could allow an attacker to overwrite this information, providing a reliable way to achieve code execution when exploiting these vulnerabilities. In this paper we describe several vulnerabilities for C and C++ and how these could be exploited by modifying the management information of a representative manual memory allocator and a garbage collector. Afterwards, we present an approach that, when applied to memory managers, will protect against these attack vectors. We implemented our approach by modifying an existing widely used memory allocator. Benchmarks show that this implementation has a negligible, sometimes even beneficial, impact on performance. 1 Introduction Security has become an important concern for all computer users. Worms and hackers are a part of every day internet life.
    [Show full text]
  • A Rule Based Approach for Spam Detection
    A RULE BASED APPROACH FOR SPAM DETECTION Thesis submitted in partial fulfillment of the requirements for the award of degree of Master of Engineering In Computer Science & Engineering By: Ravinder Kamboj (Roll No. 800832030) Under the supervision of: Dr. V.P Singh Mrs. Sanmeet Bhatia Assistant Professor Assistant Professor Computer Science & Engineering Department of SMCA COMPUTER SCIENCE AND ENGINEERING DEPARTMENT THAPAR UNIVERSITY PATIALA – 147004 JULY- 2010 i ii Abstract Spam is defined as a junk Email or unsolicited Email. Spam has increased tremendously in the last few years. Today more than 85% of e-mails that are received by e-mail users are spam. The cost of spam can be measured in lost human time, lost server time and loss of valuable mail. Spammers use various techniques like spam via botnet, localization of spam and image spam. According to the mail delivery process anti-spam measures for Email Spam can be divided in to two parts, based on Emails envelop and Email data. Black listing, grey listing and white listing techniques can be applied on the Email envelop to detect spam. Techniques based on the data part of Email like heuristic techniques and Statistical techniques can be used to combat spam. Bayesian filters as part of statistical technique divides the income message in to words called tokens and checks their probability of occurrence in spam e-mails and ham e-mails. Two types of approaches can be followed for the detection of spam e-mails one is learning approach other is rule based approach. Learning approach required a large dataset of spam e-mails and ham e-mails is required for the training of spam filter; this approach has good time characteristics filter can be retrained quickly for new Spam.
    [Show full text]
  • Buffer Overflows Buffer Overflows
    L15: Buffer Overflow CSE351, Spring 2017 Buffer Overflows CSE 351 Spring 2017 Instructor: Ruth Anderson Teaching Assistants: Dylan Johnson Kevin Bi Linxing Preston Jiang Cody Ohlsen Yufang Sun Joshua Curtis L15: Buffer Overflow CSE351, Spring 2017 Administrivia Homework 3, due next Friday May 5 Lab 3 coming soon 2 L15: Buffer Overflow CSE351, Spring 2017 Buffer overflows Address space layout (more details!) Input buffers on the stack Overflowing buffers and injecting code Defenses against buffer overflows 3 L15: Buffer Overflow CSE351, Spring 2017 not drawn to scale Review: General Memory Layout 2N‐1 Stack Stack . Local variables (procedure context) Heap . Dynamically allocated as needed . malloc(), calloc(), new, … Heap Statically allocated Data . Read/write: global variables (Static Data) Static Data . Read‐only: string literals (Literals) Code/Instructions Literals . Executable machine instructions Instructions . Read‐only 0 4 L15: Buffer Overflow CSE351, Spring 2017 not drawn to scale x86‐64 Linux Memory Layout 0x00007FFFFFFFFFFF Stack Stack . Runtime stack has 8 MiB limit Heap Heap . Dynamically allocated as needed . malloc(), calloc(), new, … Statically allocated data (Data) Shared Libraries . Read‐only: string literals . Read/write: global arrays and variables Code / Shared Libraries Heap . Executable machine instructions Data . Read‐only Instructions Hex Address 0x400000 0x000000 5 L15: Buffer Overflow CSE351, Spring 2017 not drawn to scale Memory Allocation Example Stack char big_array[1L<<24]; /* 16 MB */ char huge_array[1L<<31]; /* 2 GB */ int global = 0; Heap int useless() { return 0; } int main() { void *p1, *p2, *p3, *p4; Shared int local = 0; Libraries p1 = malloc(1L << 28); /* 256 MB */ p2 = malloc(1L << 8); /* 256 B */ p3 = malloc(1L << 32); /* 4 GB */ p4 = malloc(1L << 8); /* 256 B */ Heap /* Some print statements ..
    [Show full text]
  • Memory Vulnerability Diagnosis for Binary Program
    ITM Web of Conferences 7 03004 , (2016) DOI: 10.1051/itmconf/20160703004 ITA 2016 Memory Vulnerability Diagnosis for Binary Program Feng-Yi TANG, Chao FENG and Chao-Jing TANG College of Electronic Science and Engineering National University of Defense Technology Changsha, China Abstract. Vulnerability diagnosis is important for program security analysis. It is a further step to understand the vulnerability after it is detected, as well as a preparatory step for vulnerability repair or exploitation. This paper mainly analyses the inner theories of major memory vulnerabilities and the threats of them. And then suggests some methods to diagnose several types of memory vulnerabilities for the binary programs, which is a difficult task due to the lack of source code. The diagnosis methods target at buffer overflow, use after free (UAF) and format string vulnerabilities. We carried out some tests on the Linux platform to validate the effectiveness of the diagnosis methods. It is proved that the methods can judge the type of the vulnerability given a binary program. 1 Introduction (or both) the memory area. These headers can contain some information like size, used or not, and etc. Memory vulnerabilities are difficult to detect and diagnose Therefore, we can monitor the allocator so as to especially for those do not crash the program. Due to its determine the base address and the size of the allocation importance, vulnerability diagnosis problem has been areas. Then, check all STORE and LOAD accesses in intensively studied. Researchers have proposed different memory to see which one is outside the allocated area. techniques to diagnose memory vulnerabilities.
    [Show full text]
  • Review on Email Spam Filtering Techniques
    International Journal of Scientific Engineering and Applied Science (IJSEAS) – Volume-2, Issue-3, March 2016 ISSN: 2395-3470 www.ijseas.com Review on Email Spam Filtering Techniques Shiva Sharma1, U. Dutta 2 Computer Science and Engineering Department, Maharana Pratap College of technology Putli Ghar Road, Near Collectorate, Gwalior-474006, Madhya Pradesh, India ABSTRACT- In this paper we present email online messages, blogs, forums, whatsapp and spam filtering and email authorship instant messaging services. Among all CMC, identification. Electronic mail is used by email has remained a key source of written millions of people to communicate around the communication, especially in the last few years. world daily and is a mission-critical Due to its salient features, it is the preferred application for many businesses. Over the last source of written communication for almost 10 years, unsolicited bulk email has become a every population (a part from illiterate) major problem for email users called senders connected to the Internet. It is a very quick, and receivers. And the recent years spam asynchronous written communication channel became as a big problem of internet and that is used for various purposes ranging from electronic communication known as users. formal to informal communication. Email There is developed lot of techniques to fight messages can be sent to a single receiver or them. We presents the overview of existing e- broadcasted to groups known as users. An email mail spam filtering methods is given. The message can reach to a number of receivers classification, valuation and juxtaposition of simultaneously and instantly at singe time. traditional and learning based methods are These days, the majority of individuals even provided.
    [Show full text]
  • A Buffer Overflow Study
    A Bu®er Overflow Study Attacks & Defenses Pierre-Alain FAYOLLE, Vincent GLAUME ENSEIRB Networks and Distributed Systems 2002 Contents I Introduction to Bu®er Overflows 5 1 Generalities 6 1.1 Process memory . 6 1.1.1 Global organization . 6 1.1.2 Function calls . 8 1.2 Bu®ers, and how vulnerable they may be . 10 2 Stack overflows 12 2.1 Principle . 12 2.2 Illustration . 12 2.2.1 Basic example . 13 2.2.2 Attack via environment variables . 14 2.2.3 Attack using gets . 16 3 Heap overflows 18 3.1 Terminology . 18 3.1.1 Unix . 18 3.1.2 Windows . 18 3.2 Motivations and Overview . 18 3.3 Overwriting pointers . 19 3.3.1 Di±culties . 20 3.3.2 Interest of the attack . 20 3.3.3 Practical study . 20 3.4 Overwriting function pointers . 24 3.4.1 Pointer to function: short reminder . 24 3.4.2 Principle . 24 3.4.3 Example . 25 3.5 Trespassing the heap with C + + . 28 3.5.1 C++ Background . 28 3.5.2 Overwriting the VPTR . 31 3.5.3 Conclusions . 32 3.6 Exploiting the malloc library . 33 3.6.1 DLMALLOC: structure . 33 3.6.2 Corruption of DLMALLOC: principle . 34 II Protection solutions 37 4 Introduction 38 1 5 How does Libsafe work? 39 5.1 Presentation . 39 5.2 Why are the functions of the libC unsafe ? . 39 5.3 What does libsafe provide ? . 40 6 The Grsecurity Kernel patch 41 6.1 Open Wall: non-executable stack .
    [Show full text]
  • Buffer Overflow and Format String Overflow Vulnerabilities 3
    Syracuse University SURFACE Electrical Engineering and Computer Science College of Engineering and Computer Science 2002 Buffer Overflow and ormatF String Overflow ulnerV abilities Kyung-suk Lhee Syracuse University Steve J. Chapin Syracuse University Follow this and additional works at: https://surface.syr.edu/eecs Part of the Computer Sciences Commons Recommended Citation Lhee, Kyung-suk and Chapin, Steve J., "Buffer Overflow and ormatF String Overflow ulnerV abilities" (2002). Electrical Engineering and Computer Science. 96. https://surface.syr.edu/eecs/96 This Article is brought to you for free and open access by the College of Engineering and Computer Science at SURFACE. It has been accepted for inclusion in Electrical Engineering and Computer Science by an authorized administrator of SURFACE. For more information, please contact [email protected]. SOFTWARE|PRACTICE AND EXPERIENCE Softw. Pract. Exper. 2002; 00:1{7 Bu®er Overflow and Format String Overflow Vulnerabilities Kyung-Suk Lhee and Steve J. Chapin¤,y Center for Systems Assurance, Syracuse University, Syracuse, NY 13210 SUMMARY Bu®er overflow vulnerabilities are among the most widespread of security problems. Numerous incidents of bu®er overflow attacks have been reported and many solutions have been proposed, but a solution that is both complete and highly practical is yet to be found. Another kind of vulnerability called format string overflow has recently been found, and though not as popular as bu®er overflow, format string overflow attacks are no less dangerous. This article surveys representative techniques of exploiting bu®er overflow and format string overflow vulnerabilities and their currently available defensive measures. We also describe our bu®er overflow detection technique that range checks the referenced bu®ers at run time.
    [Show full text]
  • The History of Digital Spam
    The History of Digital Spam Emilio Ferrara University of Southern California Information Sciences Institute Marina Del Rey, CA [email protected] ACM Reference Format: This broad definition will allow me to track, in an inclusive Emilio Ferrara. 2019. The History of Digital Spam. In Communications of manner, the evolution of digital spam across its most popular appli- the ACM, August 2019, Vol. 62 No. 8, Pages 82-91. ACM, New York, NY, USA, cations, starting from spam emails to modern-days spam. For each 9 pages. https://doi.org/10.1145/3299768 highlighted application domain, I will dive deep to understand the nuances of different digital spam strategies, including their intents Spam!: that’s what Lorrie Faith Cranor and Brian LaMacchia ex- and catalysts and, from a technical standpoint, how they are carried claimed in the title of a popular call-to-action article that appeared out and how they can be detected. twenty years ago on Communications of the ACM [10]. And yet, Wikipedia provides an extensive list of domains of application: despite the tremendous efforts of the research community over the last two decades to mitigate this problem, the sense of urgency ``While the most widely recognized form of spam is email spam, the term is applied to similar abuses in other media: instant remains unchanged, as emerging technologies have brought new messaging spam, Usenet newsgroup spam, Web search engine spam, dangerous forms of digital spam under the spotlight. Furthermore, spam in blogs, wiki spam, online classified ads spam, mobile when spam is carried out with the intent to deceive or influence phone messaging spam, Internet forum spam, junk fax at scale, it can alter the very fabric of society and our behavior.
    [Show full text]
  • Chapter 10 Buffer Overflow Buffer Overflow
    Chapter 10 Buffer Overflow Buffer Overflow ● Common attack mechanism ○ first wide use by the Morris Worm in 1988 ● Prevention techniques known ○ NX bit, stack canaries, ASLR ● Still of major concern ○ Recent examples: Shellshock, Hearthbleed Buffer Overflow/Buffer Overrun Definition: A condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated, overwriting other information. Attackers exploit such a condition to crash a system or to insert specially crafted code that allows them to gain control of the system. Buffer Overflow Basics ● Programming error when a process attempts to store data beyond the limits of a fixed-sized buffer ● Overwrites adjacent memory locations ○ locations may hold other program variables, parameters, or program control flow data ○ buffer could be located on the stack, in the heap, or in the data section of the process ● Consequences: ○ corruption of program data ○ unexpected transfer of control ○ memory access violations Basic Buffer Overflow Example Basic Buffer Overflow Stack Values Buffer Overflow Attacks Attacker needs: ● To identify a buffer overflow vulnerability in some program that can be triggered using externally sourced data under the attacker’s control ● To understand how that buffer is stored in memory and determine potential for corruption Identifying vulnerable programs can be done by: ● inspection of program source ● tracing the execution of programs as they process oversized input ● using tools such as fuzzing to automatically identify
    [Show full text]