Buffer Overflows and Defenses

Feb 01, 2014

530 likes | 682 Views

Buffer Overflow. a very common attack mechanismfrom 1988 Morris Worm to Code Red, Slammer, Sasser and many othersprevention techniques knownstill of major concern due tolegacy of widely deployed buggycontinued careless programming techniques. Buffer Overflow Basics. caused by programming error

Share Presentation

Embed Code

Link

meli

Download Presentation

Buffer Overflows and Defenses

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

Buffer Overflows

Buffer Overflows. Nick Feamster CS 6262 Spring 2009 (credit to Vitaly S. from UT for slides). Morris Worm and Buffer Overflow. One of the worm’s propagation techniques was a buffer overflow attack against a vulnerable version of fingerd on VAX systems

544 views • 23 slides

Preventing Buffer Overflows (and more)

Preventing Buffer Overflows (and more). An overview of scientific approaches Secologic Meeting 11.07.2005 Martin Johns. Overview. (mostly) scientific presented tools Commercial tools exist but are rarely explicit about their internal algorithms Most approaches concentrate on the C language

844 views • 67 slides

Buffer Overflows

Buffer Overflows. James Walden Northern Kentucky University. Topics. What is a Buffer Overflow? Buffer Overflow Examples Program Stacks Smashing the Stack Shellcode Mitigations. Buffer Overflows. A program accepts too much input and stores it in a fixed length buffer that’s too small.

816 views • 50 slides

Exploiting Buffer Overflows on

Exploiting Buffer Overflows on. AIX/PowerPC HP-UX/PA-RISC Solaris/SPARC. Buffer Overflow. “ Buffer overflow ” is a famous/infamous hacking technique in computer security. Buffer overflow conditions are caused by missed boundary checks of user-supplied data.

203 views • 16 slides

More on Buffer Overflows

More on Buffer Overflows. Buffer Overflow. Recap: very simply, a buffer overflow is when a program overruns the boundary of a buffer’s allocated space and overwrites adjacent memory. char A[8]; unsigned short B; s trcpy (A, “excessive”);. A simple vulnerability.

264 views • 10 slides

Buffer Overflows

Buffer Overflows. Lesson 14. Example of poor programming/errors. Buffer Overflows result of poor programming practice use of functions such as gets and strcpy these don’t check input for boundaries may allow individual to gain root or admin access

600 views • 15 slides

Stack-Based Buffer Overflows

Stack-Based Buffer Overflows. Attacker Can take over a system remotely across a network. local malicious users To elevate their privileges and gain super user access to a system. Exploit the way OS handle their

486 views • 15 slides

Buffer Overflows

Buffer Overflows. Many of the following slides are based on those from Complete Powerpoint Lecture Notes for Computer Systems: A Programmer's Perspective (CS:APP) Randal E. Bryant and David R. O'Hallaron http:// csapp.cs.cmu.edu/public/lectures.html

310 views • 15 slides

Buffer overflows

Buffer overflows. Serious Note. Try a web search for “buffer overflow exploit”. Check alt.2600, rootshell.com, antionline.com – you can find long lists of exploits based on buffer overflow.

523 views • 29 slides

Buffer Overflows and Defenses

Buffer Overflows and Defenses. CS 419: Computer Security Lecture 10 and 11. Buffer Overflow. a very common attack mechanism from 1988 Morris Worm to Code Red, Slammer, Sasser and many others prevention techniques known still of major concern due to legacy of widely deployed buggy

733 views • 53 slides

Stack-based buffer overflows

Stack-based buffer overflows. Yves Younan DistriNet, Department of Computer Science Katholieke Universiteit Leuven Belgium Yves.Younan@cs.kuleuven.ac.be. Overview. Introduction Buffer overflows Stack-based buffer overflows Shellcode Code injection Conclusion. Introduction.

443 views • 19 slides

Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade

Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade. Crispin Cowan SANS 2000. Buffer Overflows. Inject and execute attack code at the privilege of the vulnerable program. “exec(/bin/sh)”. Inject Code. On the stack (automatic variables)

347 views • 16 slides

Buffer Overflows (stack based)

Alberto Ornaghi <alor@sikurezza.org> Lorenzo Cavallaro <sullivan@sikurezza.org>. Buffer Overflows (stack based). Table of contents. Introduzione all’IA-32 Problema Code Injection Shellcode. Introduzione. Record di attivazione.

469 views • 34 slides

Buffer Overflows and Stack Smashing

Buffer Overflows and Stack Smashing. It Happens. CERT/CC 1999: 50% of all major security bugs were from buffer overflow. Today 2005: We’ve known what can cause buffer overflows for quite a while and the problem is still big.

403 views • 22 slides

Stack Buffer Overflows

Stack Buffer Overflows. Advanced Systems Programming. Topics How stack buffer overflow exploits work Examples of real exploits. Internet Worm and IM War. November, 1988 Internet Worm attacks thousands of Internet hosts. How did it happen? July, 1999

312 views • 19 slides

Buffer overflows

Buffer overflows. Address space layout Input buffers on the stack Overflowing buffers and injecting code Defenses against buffer overflows. not drawn to scale. IA32 Linux Memory Layout. FF. Stack. 8MB. Stack Runtime stack (8MB limit) Heap Dynamically allocated storage

505 views • 20 slides

Buffer overflows and exploits

Buffer overflows and exploits. C memory layout. We talked about the heap and stack last time. Heap: dynamically allocated data (so grows and shrinks depending on objects created) Stack: grows and shrinks as functions are called and return On intel machines, stack grows “down”.

398 views • 39 slides

Buffer Overflows

Buffer Overflows. This presentation is an amalgam of presentations by Mark Michael, Randy Marchany and Ed Skoudis. I have edited and added material. Dr. Stephen C. Hayne. What is a Buffer Overflow?. Seminal paper on this technique by Aleph One titled “Smashing the Stack for Fun and Profit”

423 views • 37 slides

More Related