Your SlideShare is downloading. ×
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Software Security
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

Software Security

452

Published on

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
452
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
33
Comments
0
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide
  • Fragmentation, ping of death DOS attacks rely on buffer overflows. Use buffer overflow Java demo app from http://nsfsecurity.pr.erau.edu/bom/
  • Transcript

    • 1. CIT 380: Securing Computer Systems Software Security CIT 380: Securing Computer Systems Slide #
    • 2. Topics
      • Why Software?
      • Vulnerability Databases
      • Buffer Overflows
      • Integer Overflows
      • Attack Techniques
      • Metasploit
      CIT 380: Securing Computer Systems Slide #
    • 3. The Problem is Software
      • “ Malicious hackers don’t create security holes; they simply exploit them. Security holes and vulnerabilities – the real root cause of the problem – are the result of bad software design and implementation.”
      • John Viega & Gary McGraw
      CIT 380: Securing Computer Systems Slide #
    • 4. Why is Software Security poor?
      • Security is seen as something that gets in the way of software functionality.
      • Security is difficult to assess and quantify.
      • Security is often not a primary skill or interest of software developers.
      • Time spent on security is time not spent on adding new and interesting functionality .
      CIT 380: Securing Computer Systems Slide #
    • 5. The Trinity of Trouble
      • Complexity
        • Continually increasing.
        • Windows 3.1 (3mloc) to Windows XP (40mloc)
      • Extensibility
        • Plugins.
        • Mobile code.
      • Connectivity
        • Network access.
        • Wireless networking.
      CIT 380: Securing Computer Systems Slide #
    • 6. Software Complexity
      • 5-50 bugs per/kloc 8
        • 5/kloc: rigorous quality assurance testing (QA)
        • 50/kloc: typical feature testing
      CIT 380: Securing Computer Systems Slide # System Lines of Code MS Word 95 2 million MS Windows 3.1 3 million Boeing 777 7 million Space Shuttle 10 million Netscape 17 million MS Windows XP 40 million
    • 7. Vulnerabilities
      • Vulnerability : A defect in software that allows security policy to be violated.
        • Confidentiality
        • Integrity
        • Availability
      • Exploit : A program that exercises a vulnerability.
      CIT 380: Securing Computer Systems Slide #
    • 8. Vulnerability Databases
      • Collect vulnerability reports.
        • Vendors maintain databases with patches for their own software.
        • Security firms maintain databases of vulnerabilities that they’ve discovered.
      • Well known vulnerability databases
        • CERT
        • CVE
        • NVD
        • OSVDB
      CIT 380: Securing Computer Systems Slide #
    • 9. Why Vulnerability Databases?
      • Know about vulnerabilities to software that you have deployed so you can mitigate them.
      • Learn about vulnerability trends. If a JPG library bug is discovered, does the same type of bug exist in GIF or PNG libraries?
      • Learn about security problems to prevent when you’re programming.
      CIT 380: Securing Computer Systems Slide #
    • 10. CVE: Common Vulnerabilities and Exposures
      • Problem: Different researchers and vendors call vulnerabilities by different names.
      • Solution: CVE, a dictionary that provides
        • A common public name for each vulnerability.
        • A common standardized description.
        • Allows different tools / databases to interoperate.
      CIT 380: Securing Computer Systems Slide #
    • 11. CVE-2002-1185
      • Name: CVE-2002-1185
      • Status: Entry
      • Description: Internet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure."
      • References
        • VULNWATCH:20021211 PNG Deflate Heap Corruption Vulnerability
        • BUGTRAQ:20021212 PNG Deflate Heap Corruption Vulnerability
        • EEYE:AD20021211
        • MS:MS02-066
        • XF:ie-png-bo(10662)
        • BID:6216
        • OVAL:oval:org.mitre.oval:def:393
      CIT 380: Securing Computer Systems Slide #
    • 12. NVD: National Vulnerability DB
      • Collects all publicly available government vulnerability resources.
          • HTML and XML output at http://nvd.nist.gov/
          • Uses CVE naming scheme.
          • Links to industry and govt reports.
          • Provides CVSS severity numbers.
          • Links to OVAL repository.
      CIT 380: Securing Computer Systems Slide #
    • 13. Buffer Overflows
      • A program accepts too much input and stores it in a fixed length buffer that’s too small.
        • char A[8];
        • short B;
      CIT 380: Securing Computer Systems Slide #
        • gets(A);
      A A A A A A A A B B 0 0 0 0 0 0 0 0 0 3 A A A A A A A A B B o v e r f l o w s 0
    • 14. The Stack
      • Stack is LIFO.
      • Every function call allocates a stack frame.
      • Return address is address where function was called from and will return to.
      CIT 380: Securing Computer Systems Slide # Buffer 1 (Local Variable 1) Buffer 2 (Local Variable 2) Return Address Function Arguments Writes go up
    • 15. Smashing the Stack
      • Program accepts input into local variable 1.
      • Attacker sends too much data for buffer, overwriting the return address.
      • Attacker data contains machine code for shell.
      • Return address overwritten with address of machine code.
      • When function returns, attacker’s code is executed.
      CIT 380: Securing Computer Systems Slide # Machine code exec(/bin/bash) Buffer 2 (Local Variable 2) Pointer to machine code. Function Arguments Writes go up
    • 16. NOP Slide
      • Attacker includes NOPs in front of executable code in case address isn’t precise.
      • If pointer points at NOPs, execution will continue to machine code.
      • IDS attempt to detect buffer overflows by looking for long strings of NOPs (x90).
      CIT 380: Securing Computer Systems Slide # NOP NOP NOP Machine code exec(/bin/bash) Buffer 2 (Local Variable 2) Pointer to machine code. Function Arguments Writes go up
    • 17. Integer Overflow
      • An integer overflow is when integer operations produce a value that exceeds the computer’s maximum integer value, causing the value to “wrap around” to a negative value or zero.
      CIT 380: Securing Computer Systems Slide #
    • 18. 32-bit Integer Quiz
      • What two non-zero integers x and y satisfy the equation x * y = 0?
      • What negative integer (-x) has no corresponding positive integer (x)?
      • List two integers x and y, such that x + y < 0.
      CIT 380: Securing Computer Systems Slide #
    • 19. Quiz Answers
      • 65536 * 65536 = 0
      • or 256 * 16777256 = 0
      • or any x * y = 2 32
      • 2. -2147483648
      • 2147483647 + 1 = -2147483648
      CIT 380: Securing Computer Systems Slide #
    • 20. Are Integer Overflows Important?
      • Broward County November 2004 election
        • Amendment 4 vote was reported as tied.
        • Software from ES&S Systems reported a large negative number of votes.
        • Discovery revealed that Amendment 4 had passed by a margin of over 60,000 votes.
      CIT 380: Securing Computer Systems Slide #
    • 21. Fuzz Testing
      • Black-box input based testing technique.
        • Uses random data.
        • Easily automated.
        • If application crashes or hangs, it fails.
      • Results of 1995 study 9 .
        • 15-43% of utilities from commerical UNIX systems failed.
        • 9% of Linux utilities failed.
        • 6% of GNU utilities failed.
        • 50% of X-Windows utilities failed.
      CIT 380: Securing Computer Systems Slide #
    • 22. Metasploit
      • Modular exploit system
        • Exploit collection: over 100 exploits.
        • Payloads: machine code to run
        • Command line and web interfaces.
      • Payloads
        • Bind shell : opens shell backdoor on port.
        • Reverse shell : send shell back to attacker.
        • Windows VNC : remote desktop access.
        • Create user : add new administrative user.
      CIT 380: Securing Computer Systems Slide #
    • 23. Metasploit
      • http://www.metasploit.com/
      CIT 380: Securing Computer Systems Slide #
    • 24. Using Metasploit
      • Select an exploit
        • use exploit_name
      • Enter the target
        • set RHOST ip_address_of_target
      • Select the payload
        • set payload payload_name
        • set LHOST ip_address_of_your_host
      • Run
        • exploit
      CIT 380: Securing Computer Systems Slide #
    • 25. Advantages of Metasploit
      • Ease of use
        • One interface to many exploits.
      • Flexibility
        • Can choose whatever payload you need.
      • Faster development time
        • Payloads already written.
      • Reliability
        • Framework and payloads are well tested.
      CIT 380: Securing Computer Systems Slide #
    • 26. Uses of Metasploit
      • Vulnerability verification
        • Scanners report possible vulnerabilities.
        • Metasploit will give you remote access.
      • IDS/IPS testing
        • Test IDS/IPS with real exploit code.
      • Penetration testing
        • Easy to develop custom exploits for pen testing.
      • Convincing management
        • Remote access is more convincing than a report.
      CIT 380: Securing Computer Systems Slide #
    • 27. References
      • Matt Bishop, Introduction to Computer Security , Addison-Wesley, 2005.
      • Simson Garfinkel, Gene Spafford, and Alan Schartz, Practical UNIX and Internet Security, 3 rd edition , O’Reilly & Associates, 2003.
      • Mark Graff and Kenneth van Wyk, Secure Coding: Principles & Practices , O’Reilly, 2003.
      • Greg Hoglund and Gary McGraw, Exploiting Software: How to Break Code , Addison-Wesley, 2004.
      • Michael Howard, David LeBlanc, and John Viega, 19 Deadly Sins of Software Security , McGraw-Hill Osborne, 2005.
      • Michael Howard, David LeBlanc, Writing Secure Code, 2 nd edition , Microsoft Press, 2003.
      • Michael Howard and Steve Lipner, The Security Development Lifecycle , Microsoft Press, 2006.
      • Gary McGraw, Software Security , Addison-Wesley, 2006.
      • John Viega and Gary McGraw, Building Secure Software , Addison-Wesley, 2002.
      • David Wheeler, Secure Programming for UNIX and Linux HOWTO, http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/index.html , 2003.
      CIT 380: Securing Computer Systems Slide #

    ×