3 Programs & Programming.pdf

1 SECURITY IN COMPUTING, FIFTH EDITION Chapter 3: Programs and Programming  2 Introduction Programs are just strings of 0s and 1s, representing elementary machine commands such as move one data item, compare two data ite...

1 SECURITY IN COMPUTING, FIFTH EDITION Chapter 3: Programs and Programming  2 Introduction Programs are just strings of 0s and 1s, representing elementary machine commands such as move one data item, compare two data items, or branch to a different command. The Intel 32- and 64-bit instruction set has about 30 basic primitives (such as move, compare, branch, increment and decrement, logical operations, arithmetic operations, trigger I/O, generate and service interrupts, push, pop, call, and return) and specialized instructions to improve performance on computations such as floating point operations or cryptography. Security failures can result from intentional or nonmalicious causes; both can cause harm. Program flaws can have two kinds of security implications: They can cause integrity problems leading to harmful output or action, and they offer an opportunity for exploitation by a malicious actor.  3 Introduction Memory is a limited but flexible resource; any memory location can hold any piece of code or data. To make managing computer memory efficient, operating systems jam one data element next to another, without regard for data type, size, content, or purpose. Users and programmers seldom know, much less have any need to know, precisely which memory location a code or data item occupies. Computers use a pointer or register known as a program counter that indicates the next instruction. As long as program flow is sequential, hardware bumps up the value in the program counter to point just after the current instruction as part of performing that instruction. Instructions and data are all binary strings; only the context of use says a byte, for example, 0x41 represents the letter A, the number 65, or the instruction to move the contents of register 1 to the stack pointer. If you happen to put the data string “A” in the path of execution, it will be executed as if it were an instruction.  4 Memory Allocation Data vs. Instructions High addresses Stack Heap Static data Code Low addresses Code and data separated, with the heap growing up The same hex value in the same spot in memory toward high addresses and the stack growing down can either be a meaningful data value or a from the high addresses. meaningful instruction depending on whether the computer treats it as code or data. Instructions move from the bottom (low addresses) of memory up; left unchecked, execution would proceed through the local data area and into the heap and stack.  5 Buffer Overflows Occur when data is written beyond the space allocated for it, such as a 10th byte in a 9-byte array In a typical exploitable buffer overflow, an attacker’s inputs are expected to go into regions of memory allocated for data, but those inputs are instead allowed to overwrite memory holding executable code The trick for an attacker is finding buffer overflow opportunities that lead to overwritten memory being executed, and finding the right code to input char sample; int i; This is a very simple buffer overflow. for (i=0; i