Buffer overflow

BUFFER
OVERFLOW
Course Code: MISS1201
Course Name: Intrusion Management and Ethical Hacking
Abu Juha Ahmed Muid
Roll: 2054911004
MISS-2020
Bangladesh University of Professionals

content
 What’s a buffer?
 What is buffer overflow?
 Use of the Stack
 Who is vulnerable to buffer overflow attacks?
 How do attackers exploit buffer overflows?
 What are the different types of buffer overflow attacks?
 Buffer Overflow Example

 The size and complexity of software systems is growing, increasing the number of
bugs. Many of these bugs constitute security vulnerabilities. Most common of
these bugs is the buffer overflow vulnerability

What’s a buffer?
 A buffer, or data buffer, is an area of physical memory
storage used to temporarily store data while it is being
moved from one place to another. These buffers typically live in
RAM memory. Computers frequently use buffers to help
improve performance; most modern hard drives take advantage
of buffering to efficiently access data, and many online services
also use buffers. For example, buffers are frequently used in
online video streaming to prevent interruption. When a video is
streamed, the video player downloads and stores perhaps 20%
of the video at a time in a buffer and then streams from that
buffer. This way, minor drops in connection speed or quick
service disruptions won’t affect the video stream performance.
 Buffers are designed to contain specific amounts of data. Unless
the program utilizing the buffer has built-in instructions to
discard data when too much is sent to the buffer, the program
will overwrite data in memory adjacent to the buffer.

What is buffer overflow?
 Buffer overflow is an anomaly that occurs when software writing data to a buffer overflows the buffer’s
capacity, resulting in adjacent memory locations being overwritten. In other words, too much information
is being passed into a container that does not have enough space, and that information ends up replacing
data in adjacent containers.
 Buffer overflows can be exploited by attackers with a goal of modifying a computer’s memory in order to
undermine or take control of program execution.
M I S S S T U D E N T

Use of the Stack
 The stack is a region in a program's memory space
that is only accessible from the top. There are two
operations, push and pop, to a stack. A push stores a
new data item on top of the stack, a pop removes the
top item. Every process has its own memory space (at
least in a decent OS), among them a stack region and
a heap region. The stack is used heavily to store local
variables and the return address of a function.

Use of the Stack
 The stack is a region in a program's memory space that is only accessible from the
top. There are two operations, push and pop, to a stack. A push stores a new data
item on top of the stack, a pop removes the top item. Every process has its own
memory space (at least in a decent OS), among them a stack region and a heap
region. The stack is used heavily to store local variables and the return address of a
function.
A
B
C
D D
C
B
A
Push Pop

Who is vulnerable to buffer overflow attacks?
 Certain coding languages are more susceptible to buffer overflow than others. C
and C++ are two popular languages with high vulnerability, since they contain no
built-in protections against accessing or overwriting data in their memory.
Windows, Mac OSX, and Linux all contain code written in one or both of these
languages.
 More modern languages like Java, PERL, and C# have built-in features that help
reduce the chances of buffer overflow, but cannot prevent it altogether.

How do attackers exploit buffer overflows?
 An attacker can deliberately feed a carefully crafted input into a program that will cause
the program to try and store that input in a buffer that isn’t large enough, overwriting
portions of memory connected to the buffer space. If the memory layout of the
program is well-defined, the attacker can deliberately overwrite areas known to contain
executable code. The attacker can then replace this code with his own executable code,
which can drastically change how the program is intended to work.
 For example if the overwritten part in memory contains a pointer (an object that points
to another place in memory) the attacker’s code could replace that code with another
pointer that points to an exploit payload. This can transfer control of the whole program
over to the attacker’s code.

What are the different types of buffer overflow
attacks?
 There are a number of different buffer overflow attacks which employ
different strategies and target different pieces of code.
 Stack overflow attack - This is the most common type of buffer overflow
attack and involves overflowing a buffer on the call stack.
 Heap overflow attack - This type of attack targets data in the open
memory pool known as the heap.
 Integer overflow attack - In an integer overflow, an arithmetic operation
results in an integer (whole number) that is too large for the integer type
meant to store it; this can result in a buffer overflow.
 Unicode overflow - A unicode overflow creates a buffer overflow by
inserting unicode characters into an input that expect ASCII characters.

How to protect against buffer overflow attacks
 Luckily, modern operating systems have runtime protections which help
mitigate buffer overflow attacks. Let’s explore 2 common protections that
help mitigate the risk of exploitation:
 Address space randomization - Randomly rearranges the
address space locations of key data areas of a process. Buffer overflow
attacks generally rely on knowing the exact location of important
executable code, randomization of address spaces makes that nearly
impossible.
 Data execution prevention - Marks certain areas of memory
either executable or non-executable, preventing an exploit from running
code found in a non-executable area.
 Software developers can also take precautions against buffer overflow
vulnerabilities by writing in languages that have built-in protections or
using special security procedures in their code.

Buffer Overflow Example
 Function: the calling function written by
the developer
 Parameters: the parameters needed by the
function
 Return: it tells the program what to do
after it has executed the function
 Basepointer: marks the start of a function
stack frame
 Buffer: the allocated space for data
 As you can see in the image above, memory is made of different parts. Between the stack and the heap,
there is a buffer area, which allows both to grow during run time.
 If we look at a stack in detail, we can see different sections:

Buffer Overflow Example
 In this example, we have a program that
allocated 20 bits of buffer. If we inject
more than that amount, say 30 bits, the
data will overflow.
 Because of the nature of the memory, the
data will overflow upwards towards the
function. Once it gets to the return
section, that is where the problems start.
 If an attacker injects data in the return
that points to the address of malicious
code, the program will run it, causing
severe consequences.

 Shellcodes are typically injected into computer memory by exploiting stack or
heap-based buffer overflows vulnerabilities, or format string attacks.

 GCC, the GNU Compiler Collection
 https://gcc.gnu.org/
 apt-get install gcc in linux
 GDB: The GNU Project Debugger
 https://www.gnu.org/software/gdb/
 apt-get install gdb

Buffer overflow

More Related Content

What's hot

Similar to Buffer overflow

Recently uploaded

Buffer overflow