Week 4 - Software Vulnerabilities and Common Exploits

There are two main components to hacking, finding "bugs" in the software that allows the user to interact with a program in an unintended way and configuration vulnerabilities (an example of a configuration vulnerability is a weak password). Hacking used to primarily focus on a company's perimeter systems (parts of the system that are exposed to the internet), but as defense against those types of attacks have been improved hackers are now targeting the internal systems aka the system's users.

Memory corruption is a key area that attackers can examine to try and gain access to the system. The definition used by the lecturer this week is: "Accessing (reading/writing) memory (stack/heap) in an invalid (originally unintended) way which results in an undefined behavior (what we are looking to control)." There are four common categories of memory corruption: lifetime control, uninitiated memory, array index calculations, and buffer length calculations.

A standard attack involves the stack overflow vulnerability. This isn't in reference to the website, this occurs when a program tries to use more memory than what was allocated to it. By overwriting memory that was not intended to be written to, the attacker can gain control of the computer that is executing the code. For example if the return address is overwritten the attacker could redirect the execution of the program and have a new process that they wrote take control from that point.

Another common attacks involves the heap rather than the stack. This attack is called the "use after free" vulnerability. There are only a few steps taken to take advantage of this vulnerability in a piece of code. First the object is freed, then the object is replaced with the attacker's. The attacker then positions some shell code where it will be executed, and then the object is used once again. This is frequently done using Javascript and a browser.

Definitions introduced this week:
exploitation - taking advantage of a vulnerability
exploit - a piece of code/input/data (usually input) that is provided to the program to cause a condition
vulnerability trigger - the series of steps taken to invoke the software bug that allows the attacker to gain control of the system
payload - the action to be performed when control is gained, this is usually some shell code
low fragmentation heap - beginning in Windows 7 buckets are created after a specific size after the eighteen allocation of that size. The memory blocks are not resized down the road.

Tools introduced this week:
Metasploit - an open-source tool that is used to evaluate how secure a network is
Windbg - a tool that can be used to view the disassembly of a program, set breakpoints, view registry contents, and view memory contents (the stack and the heap). Here is a lovely Windbg cheat sheet:

sourced from Wikileaks, https://wikileaks.org/ciav7p1/cms/page_13762778.html

Comments

Post a Comment

Popular posts from this blog

Week 5 - Windows Internals

Image
This week we will be primarily focusing on rootkits. A rootkit is a piece of malware that conceals its activities and existence from the user. The ushering in of this new era of malware came into focus in 2006 when Sony released a disk to try and prevent copying of music. In this piece of software any file that started with $sys$ was hidden from the user. Attackers saw the potential of this and gained control of this method. The majority of rootkits operate in a 32 bit Windows environment however some rootkits target a 64 bit environment. Most rootkits are at the kernel level because at this level they have full access and control to the system. The slide below is a nice illustration what the computer architecture looks like and where rootkits are located. slide source from lecture, OSU CS 373 Definitions for this week: thread - the smallest unit of execution within an operating system. The slide below has a nice demonstration of how a thread is executed hooking - redirecting...
Read more

Week 1 - Introduction to Malware

This week we were introduced to the basics of malware. The first commercial anti-virus was released in the early 1990s where updates would be distributed monthly via floppy disks. An important component in current and future anti-malware is collaboration efforts between companies. If one company remains siloed in their efforts they can miss behavior that a different company may see from the same piece of malware. The primary vector for malware is users. Next is USB drives. Some basic definitions that were covered are: DGA - domain generating algorithm that creates lots of domain names that can be used as rendezvous points for command and control servers Malware - shorthand for malicious software viruses - these are a type of malware that are polymorphic and parasitic worm - this type of virus is not necessarily parasitic, the main purpose is to spread as quickly as possible trojan - backdoor and downloader means that the hacker is controlling the host machine remotely. Tro...
Read more