SECURE PROGRAMMING
A.A. 2018/2019 INTEGER SECURITY
System, Social and Mobile Security SECURITY FLAWS
The integers are formed by the natural numbers including 0 (0, 1, 2, 3, . . .) together with the negatives of the nonzero natural numbers (–1, –2, –3, . . .). Integers represent a growing and underestimated source of vulnerabilities in C programs, primarily because boundary. When developing secure systems, we cannot assume that a program will operate normally, given a range of expected inputs, because attackers are looking for input values that produce an abnormal effect.
System, Social and Mobile Security REPRESENTATION
So, how are integer represented in C? Sign magnitude or two’s complement? System, Social and Mobile Security TWO’S COMPLEMENT
Binary value Two's complement Unsigned
00000000 0 0 00000001 1 1 ⋮ ⋮ ⋮ 01111110 126 126 01111111 127 127 10000000 −128 128 10000001 −127 129 10000010 −126 130 ⋮ ⋮ ⋮ 11111110 −2 254 11111111 −1 255
In two's-complement, there is only one zero, represented as 00000000. Negating a number (whether negative or positive) is done by inverting all the bits and then adding one to that result
System, Social and Mobile Security HOW TO GET THE COMPLEMENTARY
From a number to its complement: from 5 to -5 Flip all the bits and then + 1 0000 0101 (value 5) ü1111 1010 (flip) ü1111 1011 (+1) You can do the inverse algorithm: when an integer number starts with 1 it means that it is negative ü1111 1011 value (-5) ü1111 1010 (-1) ü0000 0101 (flip)
System, Social and Mobile Security HOW MANY NUMBERS CAN I REPRESENT?
With n bits üFrom (-2N−1) to (2N−1 − 1) ü There is no “-0”, so it is possible to represent one more negative number
For instance, with 8 bits, üfrom -128 to + 127 1000 0000 0111 1111
The rule in the previous slide to get the complimentary does not work because 128 is not representable with 8 bits in two’s complement
System, Social and Mobile Security OPERATION EXAMPLES Ok! 11111 111 (carry) 0000 1111 (15) 0000 1111 (15) + 1111 1011 (−5) + 1111 1011 (−5) ======0000 1010 (10) Arithmetic overflow! 0111 (carry) 0111 (7) 0111 (7) + 0011 (3) + 0011 (3) ======1010 (−6) invalid!
Ok! 11110 000 (borrow) 0000 1111 (15) 0000 1111 (15) − 1111 1011 (−5) − 1111 1011 (−5) ======0001 0100 (20) System, Social and Mobile Security UNSIGNED TYPES
System, Social and Mobile Security WRAPAROUND
A computation involving unsigned operands can never overflow, because a result that cannot be represented by the resulting unsigned integer type is reduced modulo the number that is 1 greater than the largest value that can be represented by the resulting type.
System, Social and Mobile Security EXAMPLE
System, Social and Mobile Security EXAMPLE
for (unsigned i = n; --i >= 0; ) // will never terminate
This type of software failure occurred on Saturday, December 25, 2004, when Comair halted all operations and grounded 1,100 flights after a crash of its flight-crew- scheduling software. The software failure was the result of a 16-bit counter that limits the number of changes to 32,768 in any given month. Storms earlier in the month caused many crew reassignments, and the 16-bit value was exceeded.
System, Social and Mobile Security CHECKS
System, Social and Mobile Security CHECKS
System, Social and Mobile Security OPERATORS AND WRAPS
System, Social and Mobile Security SIGNED TYPES
System, Social and Mobile Security SIGNED TYPES
In C, each unsigned integer type, excluding the type _Bool, has a corresponding signed integer type that occupies the same amount of storage. üsigned char üshort int üint ülong int ülong long int
System, Social and Mobile Security WHY SO MANY SIGNED TYPES?
Most integer variables are used as sizes, counters, or indices that require only nonnegative values. So why not declare them as unsigned integers that have a greater range of positive values?
One possible explanation is the lack of an exception- handling mechanism in C. As a result, C programmers have developed various mechanisms for returning status from functions.
System, Social and Mobile Security WRAP WHEEL
Two’s complement
System, Social and Mobile Security FROM GREATEST TO LOWEST
System, Social and Mobile Security EXAMPLES
System, Social and Mobile Security TABLE OF OPERATORS
System, Social and Mobile Security SIGNED AND UNSIGNED CHAR
The CERT C Secure Coding Standard, “INT07-C. Use only explicitly signed or unsigned char type for numeric values” üIt is the only portable way to guarantee the signedness of the character types.
System, Social and Mobile Security TYPE CONVERSIONS
System, Social and Mobile Security HIERARCHY OF TYPES
When arithmetic operands have different types, the implicit type conversion is governed by the types’ conversion rank. üAny two unsigned integer types have different conversion ranks. If one is wider than the other, then it has a higher rank. üEach signed integer type has the same rank as the corresponding unsigned type. üThe standard integer types are ranked in the order: • _Bool < char < short < int < long < long long üThe floating-point types are ranked in the following order: • float < double < long double üThe lowest-ranked floating-point type, float, has a higher rank than any integer type. üEnum have the same rank as int.
System, Social and Mobile Security INTEGER PROMOTION
In any expression, you can always use a value whose type ranks lower than int in place of an operand of type int or unsigned int. In these cases, the compiler applies integer promotion: any operand whose type ranks lower than int is automatically converted to the type int, provided int is capable of representing all values of the operand’s original type. If int is not sufficient, the operand is converted to unsigned int. Operations in the CPU are executed on 4 bytes at least
System, Social and Mobile Security EXAMPLE
120 #include
At first look, the expression (a*b)/c seems to cause arithmetic overflow because signed characters can have values only from -128 to 127 (in most of the C compilers), and the value of subexpression ‘(a*b)’ is 1200 which is greater than 128. But integer promotion happens here in arithmetic done on char types and we get the appropriate result without any overflow.
System, Social and Mobile Security WHAT DOES IT HAPPEN?
The usual arithmetic conversions are applied as follows: üIf either operand has a floating-point type, then the operand with the lower conversion rank is converted to a type with the same rank as the other operand. Real types are converted only to real types. üIf both operands are integers, integer promotion is first performed on both operands. If after integer promotion the operands still have different types, conversion continues as follows: • If one operand has an unsigned type T whose conversion rank is at least as high as that of the other operand’s type, then the other operand is converted to type T. • Otherwise, one operand has a signed type T whose conversion rank is higher than that of the other operand’s type. The other operand is converted to type T only if type T is capable of representing all values of its previous type. If not, then both operands are converted to the unsigned type that corresponds to the signed type T. System, Social and Mobile Security int x = 0; EXAMPLES int i = -1; unsigned int limit = 200U; long n = 30L;
if ( i < limit ) x = limit * n;
printf(“%d\n”, x); 0
In this example, to evaluate the comparison in the if condition, the value of i, –1, must first be converted to the type unsigned int. The result is a large positive number (next slide). Hence, the if condition is false. In the if, the value of limit is converted to n’s type, long, if the value range of long contains the whole value range of unsigned int. If not— for example, if both int and long are 32 bits wide—then both multiplicands are converted to unsigned long. System, Social and Mobile Security CONVERSIONS TO UNSIGNED INTEGER TYPES Integer values are always preserved if they are within the range of the new unsigned type üBetween 0 and Utype_MAX For values outside the new unsigned type’s range, the value after conversion is the value obtained by adding (Utype_MAX + 1) as many times as necessary until the result is within the range of the new type.
unsigned short n = 1000; // The value 1000 is within the range of // unsigned short n = -1; // the value –1 must be converted.
–1 + (USHRT_MAX + 1) = USHRT_MAX, the final statement in the previous example is equivalent to n = USHRT_MAX;
System, Social and Mobile Security INTEGER VULNERABILITIES
System, Social and Mobile Security EXAMPLE
JPEG COM Marker Processing Vulnerability in Netscape Browsers
size_t is always an alias for an unsigned type
What if 1 is passed as length?
System, Social and Mobile Security CONVERSION ERRORS
malloc() takes size_t as argument
What if 1 negative?
System, Social and Mobile Security TRUNCATION
65,500 chars for argv[1] 536 chars for argv[2] +1 = 65,537
An UINT_MAX is 65535
A string of 1 char is allocated: buffer overflow!
System, Social and Mobile Security MITIGATION STRATEGIES
System, Social and Mobile Security ERRORS
As we have seen, integer vulnerabilities result from integer type range errors. For example, integer overflows occur when integer operations generate a value that is out of range for a particular integer type. Truncation errors occur when a value is stored in a type that is too small to represent the result. Conversions, particularly those resulting from assignment or casts, can result in values that are out of the range of the resulting type.
System, Social and Mobile Security EXAMPLE OF TRUNCATION b: 1 #include
printf("b: %d\n", b); printf("a: %lld\n", a); }
11111111 11111111 11111111 11111111 11111111 11111111 11111111 11111110 - 11111111 11111111 11111111 11111111 00000000 00000000 00000000 00000000 =
00000000 00000000 00000000 00000000 11111111 11111111 11111111 11111110 + 10000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 =
10000000 00000000 00000000 00000000 11111111 11111111 11111111 11111110
System, Social and Mobile Security INTEGER TYPE SELECTION
The first step in developing secure code is to select the appropriate data types. An integer type provides a model of a finite subset of the mathematical set of integers. Select integer types that can represent the range of possible runtime values, and then ensure that these ranges are not exceeded.
System, Social and Mobile Security SIZES
Say, for example, that you need to represent the size of an object as an integer. You could represent the size of the object as a short int, as in the following declaration: üshort total = strlen(argv[1])+ 1;
Variables of type size_t are guaranteed to be precise enough to represent the size of an object, as in the following example: üsize_t total = strlen(argv[1])+ 1;
“INT01-C. Use size_t for all integer values representing the size of an object.”
System, Social and Mobile Security EXAMPLE
Solved? NO…
Now yes
System, Social and Mobile Security TYPE RANGE CHECKING
Because all integer vulnerabilities are type range errors, type range checking—if properly applied—can eliminate all integer vulnerabilities
The CERT C Secure Coding Standard has several rules to prevent range errors: üINT30-C. Ensure that unsigned integer operations do not wrap. üINT31-C. Ensure that integer conversions do not result in lost or misinterpreted data. üINT32-C. Ensure that operations on signed integers do not result in overflow.
System, Social and Mobile Security PRE-CONDITION
One approach to eliminating integer exceptional conditions is to test the values of the operands before an operation to prevent overflow and wrapping from occurring.
System, Social and Mobile Security PRE-CONDITION WITH SIGNED
System, Social and Mobile Security POST-CONDITION
Postcondition tests can be used to detect unsigned integer wrapping, for example, because these operations are well defined as having modulo behavior.
System, Social and Mobile Security SECURE INTEGER LIBRARIES
Michael Howard has written parts of a safe integer library that detects integer overflow conditions using architecture-specific mechanisms.
System, Social and Mobile Security COMPILER CHECKS
GCC provides an -ftrapv compiler option that offers limited support for detecting integer overflows at runtime. üThe GCC runtime system generates traps for signed overflow on addition, subtraction, and multiplication operations for programs compiled with the -ftrapv flag.
System, Social and Mobile Security TESTING AND STATIC ANALYSIS
Static analysis, by either the compiler or a static analyzer, can be used to detect potential integer range errors in source code.
System, Social and Mobile Security ARIANE 5, JUNE 6 1996
Start. 37 seconds of flight. KABOOM! 10 years and 7 billion dollars are turning into dust.
The programmers were to blame for everything
System, Social and Mobile Security REASON
The investigation revealed that this software module contained seven variables involved in type conversion operations. It turned out that the developers performed the analysis for the vulnerability of all operations, capable of throwing an exception.
It was their conscious action – to add adequate protection to four variables, and leave three of them – including BH – unprotected. The ground for this decision was the certainty that overflow is not possible in these variables in general.
This confidence was supported by the evaluations, showing that the expected range of physical parameters that was taken as the basis for the determination of the values of the mentioned variables can never lead to an undesirable situation. And it was true — but for the trajectory evaluated for Ariane 4.
System, Social and Mobile Security ADA CODE
System, Social and Mobile Security REASON
Specifically a 64 bit floating point number relating to the horizontal velocity of the rocket with respect to the platform was converted to a 16 bit signed integer. The number was larger than 32,767, the largest integer storeable in a 16 bit signed integer, and thus the conversion failed.
System, Social and Mobile Security WHY
The new generation Ariane 5 rocket launched on an entirely different trajectory, for which no evaluations were carried out. Meanwhile, it turned out that the “horizontal velocity” (together with the initial acceleration) exceeded the estimated (for Ariane 4) more than five times.
The protection of all 7 (including BH) variables wasn’t provided because the developers had to look for ways to reduce unnecessary evaluation expenses, and they weakened the protection in that fragment where theoretically the accident could not happen.
System, Social and Mobile Security