Survey of Protections from Buffer-Overflow Attacks

Buffer-overflow attacks began two decades ago and persist today. Over that time, many solutions to provide protection from buffer-overflow attacks have been proposed by a number of researchers. They all aim to either prevent or protect against buffer-overflow attacks. As defenses improved, attacks adapted and became more sophisticated. Given the maturity of field and the fact that some solutions now exist that can prevent most buffer-overflow attacks, we believe it is time to survey these schemes and examine their critical issues. As part of this survey, we have grouped approaches into three board categories to provide a basis for understanding buffer-overflow protection schemes

StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks

This paper presents a systematic solution to the persistent problem of buffer overflow attacks. Buffer overflow attacks gained notoriety in 1988 as part of the Morris Worm incident on the Internet. While it is fairly simple to fix individual buffer overflow vulnerabilities, buffer overflow attacks continue to this day. Hundreds of attacks have been discovered, and while most of the obvious vulnerabilities have now been patched, more sophisticated buffer overflow attacks continue to emerge. We describe StackGuard: a simple compiler technique that virtually eliminates buffer overflow vulnerabilities with only modest performance penalties. Privileged programs that are recompiled with the StackGuard compiler extension no longer yield control to the attacker, but rather enter a fail-safe state. These programs require no source code changes at all, and are binary-compatible with existing operating systems and libraries. We describe the compiler technique (a simple patch to gcc), as well as a set of variations on the technique that tradeoff between penetration resistance and performance. We present experimental results of both the penetration resistance and the performance impact of this technique

Buffer Overflow Management with Class Segregation

We consider a new model for buffer management of network switches with Quality of Service (QoS) requirements. A stream of packets, each attributed with a value representing its Class of Service (CoS), arrives over time at a network switch and demands a further transmission. The switch is equipped with multiple queues of limited capacities, where each queue stores packets of one value only. The objective is to maximize the total value of the transmitted packets (i.e., the weighted throughput). We analyze a natural greedy algorithm, GREEDY, which sends in each time step a packet with the greatest value. For general packet values $(v_1 < \cdots < v_m)$, we show that GREEDY is $(1+r)$-competitive, where $r = \max_{1\le i \le m-1} \{v_i/v_{i+1}\}$. Furthermore, we show a lower bound of $2 - v_m / \sum_{i=1}^m v_i$ on the competitiveness of any deterministic online algorithm. In the special case of two packet values (1 and $\alpha > 1$), GREEDY is shown to be optimal with a competitive ratio of $(\alpha + 2)/(\alpha + 1)$

Analyzing The Stack-Based Buffer Overflow Problem.

It is interesting to know that a buffer overflow problem still exist today despite of many researches have been conducted in a period of more than 20 years. This study takes an opportunity to analyze one of the dominant buffer overflow problem type, a stack-based buffer overflow. A controlled experimental demonstration has been carried out to emulate a stack-based buffer overflow exploit. During the process, main conditions why and how the exploit happens will be identified, analyzed and documented. The findings showed that more works can be done at the coding stage to prevent the problem before the damage (exploit) occurs which normally happen after the software product has been distributed. In this case more resources have been wasted such as cost, man-hour and time. Hence, several practical suggestions with its own advantageous have been highlighted for further research and implementation. In addition, the findings should be very useful inputs in designing and implementing new buffer overflow detection and prevention mechanisms

Buffer overflow attacks & countermeasures

Often security website’ headlines read: "Buffer overflow in vendor’s product allows intruders to take over computer!” What can software engineering education do about this situation? In this document we have tried to point out how dangerous buffer overflow attacks can be and the amount of damage they are capable of incurring. We have shown several vulnerable applications both past as well as recent. The objective of this study is to take one inside the buffer overflow attack and bridge the gap between the “descriptive account” and the “technically intensive account”. The intent is to provide a logical, detailed, and technical explanation of the buffer overflow problem and the exploit that can be well understood by all. We have successfully coded several exploits and developed programs to demonstrate the effectiveness of such attacks

Statically Detecting Likely Buffer Overflow Vulnerabilities

Buffer overflow attacks may be today’s single most important security threat. This paper presents a new approach to mitigating buffer overflow vulnerabilities by detecting likely vulnerabilities through an analysis of the program source code. Our approach exploits information provided in semantic comments and uses lightweight and efficient static analyses. This paper describes an implementation of our approach that extends the LCLint annotation-assisted static checking tool. Our tool is as fast as a compiler and nearly as easy to use. We present experience using our approach to detect buffer overflow vulnerabilities in two security-sensitive programs

Metamorphic Viruses with Built-In Buffer Overflow

Metamorphic computer viruses change their structure—and thereby their signature—each time they infect a system. Metamorphic viruses are potentially one of the most dangerous types of computer viruses because they are difficult to detect using signature-based methods. Most anti-virus software today is based on signature detection techniques. In this project, we create and analyze a metamorphic virus toolkit which creates viruses with a built-in buffer overflow. The buffer overflow serves to obfuscate the entry point of the actual virus, thereby making detection more challenging. We show that the resulting viruses successfully evade detection by commercial virus scanners. Several modern operating systems (e.g., Windows Vista and Windows 7) employ address space layout randomization (ASLR), which is designed to prevent most buffer overflow attacks. We show that our proposed buffer overflow technique succeeds, even in the presence of ASLR. Finally, we consider possible defenses against our proposed technique

Buffer overflow vulnerabilities in CUDA: a preliminary analysis

We present a preliminary study of buffer overflow vulnerabilities in CUDA software running on GPUs. We show how an attacker can overrun a buffer to corrupt sensitive data or steer the execution flow by overwriting function pointers, e.g., manipulating the virtual table of a C++ object. In view of a potential mass market diffusion of GPU accelerated software this may be a major concern.Comment: 12 pages, 2 figure

Counter-Measures against Stack Buffer Overflows in GNU/Linux Operating Systems

AbstractWe address the particular cyber attack technique known as stack buffer overflow in GNU/Linux operating systems, which are widely used in HPC environments. The buffer overflow problem has been around for quite some time and continues to be an ever present issue. We develop a mechanism to successfully detect and react whenever a stack buffer overflow occurs. Our solution requires no compile-time support and so can be applied to any program, including legacy or closed source software for which the source code is not available. This makes it especially useful in HPC environments where given their complexity and scope of the computing system, incidents like overflows might be difficult to detect and react to accordingly