Software Security: Preventing Vulnerabilities in Coding - Prof. William Pugh, Assignments of Programming Languages

Download Software Security: Preventing Vulnerabilities in Coding - Prof. William Pugh and more Assignments Programming Languages in PDF only on Docsity!

Software Security

CMSC 433

Bill Pugh

Software Security

• Making sure that if your software is misused, it doesn’t do any of the vast number of things you didn’t intend for the software to do

Compiler

• Code generateCode(AST method) { if (method.getName() .equals(“authenticateLogin)) { return ... code with trap door ...; .. generate code normally

Slightly cool, but not very

interesting

• Get spotted in a code audit

Trusted code base

• Trusted code base is the code that, if compromised, causes all of your security to fail
• Typically, includes all your software, your compiler, your operating system, ...
• Feeling comfy?

Software defects

• Traditional approach to correctness
  • define precondition
  • show that if precondition satisfied, output satisfied postcondition
• Didn’t examine what happened if input didn’t satisfy precondition

Buffer overflows

• In C, arrays are just locations in memory
• if you write past the allocated end of the array, you write into something else
• possibly other variables, return address
• can both rewrite return address and deliver payload
• http://insecure.org/stf/smashstack.html

Stack layout

int main(int argc, char *argv[]) { int value; char buf1[80]; … } argv argc return address frame pointer buf value

C String functions

char buf[20]; char * prefix = “http://”; strcpy(buf,prefix); strncat(buf, path, sizeof(buf));

C String functions

char buf[20]; char * prefix = “http://”; strcpy(buf,prefix); strncat(buf, path, sizeof(buf) - strlen(buf));

safe copy

#define MAX_BUF 256 void doStuff(char * in) { short len; char buf[MAX_BUF]; len = strlen(in); if (len > MAX_BUF) return; strcpy(buf, in); .. do stuff with buf ... }

Huh…?

• C doesn't seem to give any warnings when invoking a function that returns an unsigned long long
• and assign the result to something smaller - like a signed short or a char
• Even with -Wall and -pendantic-errors

The little known %n

• One of the least known and most dangerous format specified - %n expects the corresponding parameter to be the address of an int value - writes the number of characters written so far into that address
• sprintf(buf, “%d%n”, x, &y)
  • stores into y the number of characters needed to represent x

Now we have a way

to update memory

• Some hackers are very clever
• Figured out how to turn several instances of this into an exploit - force a program to execute an arbitary payload