Program

Security
Objective 2
s
 To learn the concept of secure programming
 Programming errors with security implications: buffer
overflows, incomplete access control
 Malicious code: viruses, worms, Trojan horses
 Controls against malicious code and vulnerabilities
 Controls against program flaws in execution
Lets start 3
with
 Why we need security at the program level?
 Because programs constitute most to a computing system
and Protecting programs is the heart of computer security.
 All kinds of programs, from apps via OS, DBMS,
networks

 How can we achieve it?

Issues:
1. How do we keep programs free from flaws?
2. How do we protect computing resources against programs
that contain flaws?
 Secure 4
programs
 Security implies some degree of trust that the program
enforces expected confidentiality, integrity, and availability.
 What is “Program security?”
Depends on who you ask
 user - fit for his task
 programmer - passes all “his/her” tests
 manager - conformance to all specs
 Fault tolerance terminology: 5
 Bug – mistake in interpreting a requirement, syntax
error
 Error – human made mistake , may lead to a fault
 Fault – misinterpreted requirements may lead to
several faults in the coding and testing phases
 Failure - system malfunction caused by fault, can
be discovered before or after system delivery
 Note:
 Faults- seen by “insiders” (e.g., programmers)
 Failures - seen by “outsiders” (e.g., independent
testers, users)

 Error/fault/failure example:
 Programmer’s indexing error, leads to buffer
overflow fault
 Buffer overflow fault causes system crash (a failure)
 Fixing 6
faults
 Software that has many faults early on is likely to have many
others still waiting to be found.
 Earlier paradigm to judge s/w security: penetrate and patch
 Red Team /Tiger Team tries to crack s/w
 If software withstands the attack => security is good

 Is this true? - Rarely.

Fixing 7
faults
Too often developers try to quick-fix problems
discovered by Tiger Team
 Quick patches often introduce new faults due
to:
 Pressure – causing narrow focus on fault, not context
 Non-obvious side effects
 Fixing one problem often caused a failure somewhere else
 system performance requirements not allowing
for security overhead
 Unexpected 8
Behavior
 Compare program requirements with behavior to identify
program security flaws
 Flaw is either a fault or failure
 Vulnerability is a class of flaws (e.g. buffer overflows)

 Program security flaws can derive from any kind of software

fault.
 Therefore we categorize the faults into inadvertent human
errors and intentionally induced faults.
 Unexpected 9
Behavior
 We don’t have techniques to eliminate or address all
program security flaws.
 There are 2 reasons for this distressing situation:
 Program controls apply at the level of the individual program and
programmer. Programmer concentrates on “Should do” checklist
and least bother about “shouldn’t do” checklist.
 Programming and software engineering techniques evolve more
rapidly
than computer security techniques.
 Types of 1
Flaws 0
 Intentional
 Malicious
 Non malicious
 Inadvertent
 Validation error (incomplete / inconsistent) : permission checks
 Domain error : controlled access to data
 Serialization and aliasing: program flow order
 Inadequate identification and authentication : basis for
authorization
 Boundary condition violation : failure on first and last case
 Other exploitable logic errors
 Non malicious program 1
errors 1

 most of the mistakes made by the programmers are

unintentional and non malicious.
 Many such errors will not lead to more serious vulnerabilities
but few
will put many security professionals in trouble.

 We look at three such classic error types and explain why they
are
relevant to security and how can they be prevented.
 Buffer 1
overflows 2

 Its like pouring 2 liters of water into a 1 liter jug.

 Definition
 A buffer is a space in memory in which data is held.
 As memory in finite => buffer capacity is finite
 Therefore, in programming languages the programmer must
declare the buffers maximum size.
Buffer overflow example - 1
C 3
char sample[10];
// compiler sets 10 bytes to store this buffer.

sample[10]=‘B’;
// out of bounds error, compiler detects this during compilation.

Now, what if we do
sample[i]=‘B’;

In some programming languages, buffer sizes need not be

predefined.
 C does not perform array bounds checking.
 Similar problem caused by pointers
 No reasonable way to define limits for pointers
 Buffer 1
overflows 4

 Where does ‘B’ go?

 Depends on what is adjacent to
‘sample[10]’
 Affects user’s data - overwrites user’s data
 Affects users code - changes user’s instruction
 Affects OS data - overwrites OS data
 Affects OS code - changes OS instruction
 Buffer 1
overflows 5
 Buffer 1
overflows 6
 Implications of buffer overflow:
 Attacker can insert malicious data values/instruction codes into
“overflow space”
 Buffer overflow affects OS code area
 Attacker code executed as if it were OS code
 Attacker might need to experiment to see what happens when he inserts
B
into OS code area

 Can raise attacker’s privileges (to OS privilege level)

 When B is an appropriate instruction
 Attacker can gain full control of OS
 Buffer
1
overflows 7
 Buffer overflow affects a call stack area
A scenario:
 Stack: [data][data][...]
 Pgm executes a subroutine
=> return address pushed onto stack
(so sub-routine knows where to return control to when
finished)
Stack: [ret_addr][data][data][...]
 Subroutine allocates dynamic buffer char sample[10]
=> buffer (10 empty spaces) pushed onto stack
Stack: [..........][ret_addr][data][data][...]
 Subroutine executes: sample[i] = ‘A’ for i
= 10 Stack: [..........][A][data][data][...]
Note: ret_address overwritten by B!
(Assume: size of ret_address is 1 char)
 Buffer 1
overflows 8
 Buffer overflow affects a call stack area
Stack: [..........][A][data][data][...]

 Subroutine finishes
 Buffer for char sample[10] is de-allocated
Stack: [A][data][data][...]
 RET operation pops B from stack (considers it ret.
addr)
Stack: [data][data][...]
 Pgm (which called the subroutine) jumps to B
=> shifts program control to where attacker
wanted
 Buffer 1
overflows 9

 C programming language specifications do not

specify how data is to be laid out in memory (incl.
stack layout)

 Some implementations of C may leave

space between arrays and variables on the
stack, for instance, to minimize possible
aliasing effects.

(Source:
Wikipedia)
 Buffer overflows- security 2
implication 0
 Even if the flaw came from a honest mistake, the flaw can still
cause
great harm. A malicious attacker can exploit these flaws.
 Buffer overflows- security 2
implication 1

 Web server attack similar to buffer overflow

attack: pass very long string to web server
 Buffer overflows still common
 Used by attackers
 to crash systems
 to exploit systems by taking over control

 Large number of vulnerabilities due to buffer

overflows still persists in many software’s and
systems
 Web server attack 2
example 2

 Parameter passing in the URL:

Consider:
http://www.somesite.com/subpage/userinput.asp?param1=(808)55
5-
1212&param2=2009Jan17

What can be the possible attack on this URL?

Passing a very long string is a slight variation on the classic buffer

overflow, but no less effective.
 Incomplete 2
mediation 3

 Consider the same previous example

http://www.somesite.com/subpage/userinput.asp?param1=(808)55
5-
1212&param2=2009Jan17

What happens if we pass values like 1800Jan01 or

1800Feb30 or
2048Min32 or 1Aardvark2Many?
1. Data type error
2. Continue to execute but ends up with a wrong result

What if we do all the validations properly on the client

browser?
 Security 2
implication 4

 Unchecked data values represent a serious potential

vulnerability.

 Example: A firm named “Things” started a e-commerce site to

sell
their products.
 Once a person places his order the return URL is as follows:
http://www.things.com/order.asp?custID=101&part=555A&qy=20&
pric
e=10&ship=boat&shipcost=5&total=205

If you’re a malicious attacker, what will you do?

Serious concern about this flaw was the length of time it could have
 Time of check to Time of use 2
errors 5

 Unintentional but with serious security consequences.

 Modern processors and OS usually change the order in which the
instructions and procedures are executed.
 Adjacent instructions may not even execute in the same order.

 Time-of-check to time-of-use (TOCTTOU) flaw is performed by

“bait
and switch” strategy.
 Also called as synchronization or serialization flaw.

 Time-of-check to time-of-use flaw exploits the time lag between

the
time we check and the time we use.
 TOCTTOU 2
6
Example problem: DBMS/OS

pgm1 reads value of X =

10 pgm1 adds X = X+ 5
 pgm2 reads X = 10, adds 3
to X, writes X = 13
pgm1 writes X = 15

X ends up with value 15 ,

where X should be = 18

Prevention:
 Be aware of time lags
 Use digital signatures and
certificates to “lock” data values
after checking them
 So nobody can modify
 TOCTTOU prevention in 2
DBMS 7

E.g., DBMS: locking to enforce proper serialization

(locks need not use signatures—fully controlled by
DBMS)
In the previous example:
will force writing X = 15 by pgm 1, before
pgm2 reads X (so pgm 2 adds 3 to 15)
OR:
will force writing X = 13 by pgm 2, before
pgm1 reads X (so pgm 1 adds 5 to 13)

 An intelligent attacker uses each of the previously mentioned

three flaws(buffer overflow, incomplete mediation, TOCTTOU) as
one step in a multistep attack.
Viruses and other Malicious 2
code 8
 Work done by a program is invisible to users and they will not be
aware of any malicious activity.
 Example:
1. When is the last time you saw a bit?
2. Do you know in what format a document file is stored?
3. If a document is stored on a disk, can you tell the exact location
where is it residing?
4. Which programs execute when we start our computer and how they
are executed?
 We cannot answer these question properly, since we don’t
see computer data directly.
Malicious code 2
9
 Malicious code executes just like any other program on the
system.
But, it is written to exploit the vulnerabilities of a system/software.
 Malicious code can change: data and other programs.
 Malicious can do anything like writing a message to the
screen, stopping a running program, erasing a stored record
etc. or sometimes malicious code will not do anything at all
and stay dormant in the system.
 Dormant malicious code just needs a trigger to become
active.

 Malicious codes are not new to computers, they have been

in existence for the past few decades.
 Kinds of malicious 3
code 0
 Malicious code or Rouge code is the general name for
unanticipated and undesired effects in programs.
 Agent is the writer of the program or the person who
causes its distribution.
 Virus is a program that can replicate itself and pass onto
other non
malicious programs.
 Virus can be: transient or resident
 Transient virus has a life that depends on the life of its host.
 Resident virus located itself in the memory and will be active in
the
system even after the attached program ends.
 Trojan horse is an unauthorized program that performs
functions unknown to the user.
Cont. 3
1
 Trojan horse gets installed along with an infected legitimate
program.
 Effects of a Trojan horse:
 Deleting, editing files.
 Transmitting files to intruders.
 Installing malicious code that can gain network access.
 Privilege elevation attacks etc.
 Logic bomb is a special class of malicious code that “detonates”
or goes off when a certain condition is met. Time bomb is a
logic bomb whose trigger is time or date.
 Trapdoor or backdoor is a feature in program, which provides
an alternate entry or access to the program avoiding the
direct calls and perhaps with special privileges.
Cont. 3
2
 Worm is a program that replicates itself and spreads across a
network of systems. Primary difference between a worm and a
virus is that, a worm operates through networks whereas a
virus spread through any medium.
 Rabbit is a virus or a worm that replicates itself without any
bound to exhaust the computing resources of a system.

 Often the term “Virus” is used to refer to any malicious code.

 Summary of malicious 3
code 3
Code type Characteristics
Virus Attaches itself to program and propagates copies of itself to
other programs.

Trojan horse Contains unexpected additional functionality

Logic bomb Triggers action when condition occurs

Time bomb Triggers action when specified time or date occurs

Trapdoor Allows unauthorized access to functionality

Worm Propagates copies of itself through network

Rabbit Replicates itself without limit to exhaust system resources

 How viruses 3
work? 4
 Program containing virus must be executed to spread virus
or
infect other pgms
 Even one pgm execution suffices to spread virus widely

 Virus actions: spread / infect

 Spreading – Example 1: Virus in a pgm on installation CD

 User activates pgm contaning virus when she runs
INSTALL or SETUP
 Virus installs itself in any/all executing pgms present in
memory
 Virus installs itself in pgms on hard disk

 From now on virus spreads whenever any of the

infected pgms (from memory or hard disk) executes
Cont. 3
5
 Spreading – Example 2: Virus in attachment to e-
mail msg
 User activates pgm contaning virus (e.g. macro in
MS Word) by just opening the attachment
=> Disable automatic opening of attachments!!!
 Virus installs itself and spreads
 Spreading – Example 3: Virus in downloaded file
 File with pgm or document (.doc, .xls, .ppt, etc.)
 You know the rest by now...

 Document virus
 Spreads via picture, document, spreadsheet,
slide presentation, database, ...
 E.g., via .jpg, via MS Office documents .doc, .xls, .ppt
etc.
Kinds of viruses- based on their way 3
of attaching 6
1. Appended Viruses
 Appends to program. Often virus code precedes the program code
execution by running its code before the 1st program instruction in exec
file.
 Executes whenever program gets executed.

Virus Virus
Code
Code
Original
Original
progra
m progra
m
 2. Surrounding viruses 3
 Surrounds program
 Executes before and after infected program 7
 Intercepts its input/output
 Erases its tracks
 The “after” part might be used to mask virus
existence.
Virus
Code(part a)

Original

progra
m

Virus
Code(part b)
 3. Integrating and replacing
3
 Integrates into pgm code viruses
Spread within infected pgms
 8
 (Replacing) virus V gains control over target pgm T by:
 Overwriting T on hard disk
OR
 Changing pointer to T with pointer to V
 OS has File Directory
 File Directory has an entry that points to file with code for T
 Virus replaces pointer to T’s file with pointer to V’s file
In both cases actions of V replace actions of T when user executes
what she thinks is “T”

Original Virus Modified

Code
progra Code
m
Document virus- one form of integrated
3
virus
9
 Virus implemented in a formatted document.
 Document consists of data and some commands like
macros, formatting controls, links etc.
 Commands are part of rich programming language.
 Attacker uses these command portions to integrate his
virus code
with the document.
 Ordinary user just sees the plain document but not the virus
code embedded in commands portion.
Characteristics of a 4
“Virus” 0

 Hard to detect
 Not easily destroyed or
deactivated
 Spreads infection widely
 Can re-infect programs
 Easy to create
 Machine and OS independent
 Homes for 4
viruses 1

 Most viruses are passed through e-mails or drive-by-downloads.

 Attackers lure the victims to open the emails / click the malicious
links that enable drive-by-download.
 Ways for virus to take control over program:
 Overwriting the complete program
 Changing the pointer to point to a virus code instead of program on
the
disk.
 One-time execution: majority of the viruses today execute
only once, spreading their effect in that once execution.
 Boot sector
4
viruses 2
 When OS is started, firmware detects the hardware
components present, tests them and then transfers the
control to the OS.
 OS is invoked dynamically and not coded in the firmware.
 OS resides on the disk. It is fetched into memory by a
program
called Bootstrap.
 Firmware reads fixed number of bytes from a fixed location
(boot sector) on the disk to a fixed location in the memory and
jumps to that address for execution.
 Often the boot sector size will be less than 512 bytes whereas
the bootstrap loader will be of larger size.
 To support this situation most of the hardware designers
support
“chaining”.
Cont. 4
3
 This chaining has both pros and cons.
 Virus writer will simply break the chain at any point, inserts a
pointer to the virus code, and reconnects the chain later.
 Memory resident
4
viruses
4
 Most of the user programs will execute, terminate and
disappear making space for other programs.
 Few specialized programs are called very often and loading
them each time takes a long time. So, OS keeps such
programs and resident programs in the memory.
 Ex: resident code that interprets the keys pressed on keyboard.
 Resident routines are also called as “terminate and stay
resident” TSR.
 Viruses attach with this programs in memory so that virus gets
control whenever this program is invoked.
 This viruses are also capable of modifying Windows tables
(registries).
 Other homes for
4
viruses
5
 Other home is application programs, like spreadsheets, word
processors having “macro” feature, by which user can record
series of commands and can repeat same by single invocation.
 Libraries are also excellent places for virus to reside. Often
libraries are called from legitimate code and also libraries are
shared between users.
 Compilers, loaders, linkers, runtime debuggers and even virus
control programs are good candidates for hosting viruses as they
are mostly shared.
 Virus
4
signatures 6
 Viruses executes in a particular way, using certain methods
leaving
some patterns.
 These patterns of virus can be used to design programs like
“virus scanners”.
 Patterns can be:
1. Storage patterns
2. Execution patterns
3. Transmission patterns

 Symantec reports on viruses gives statistical information on

viruses.
 Storage
4
pattern
7
 Often attached virus piece is invariant, so the start of the virus
codes
becomes detectable.
 Virus attaches itself to a file, increasing the size of the file.
 Else, virus can obliterate the actual code, which will not increase
the size of the code but impacts the program functioning.

 Virus scanner can use a code or checksum to detect changes to a

file. It can also look for suspicious statements like JUMP at the
starting instruction of the code.
 Execution
4
pattern
8
 Most of the operations that a virus does are the common
operations like removing directory, modifying files etc. which are
common in OS.
 Damage is bounded only by the creativity of the virus’s writer.
4
9
 Transmission
5
pattern
0
 Virus travel is not confined to any single medium or execution
pattern.
 A virus may come through a network, reside in disk, may get
attached to a program in execution, while executing may transfer
a copy of itself to memory staying there as a resident and etc.

 These transmissions have to be observed in order to detect

virus patterns in the system.
 Polymorphic 5
viruses 1

 Virus signatures or patterns are useful for a virus scanner to detect

their existence in the systems.
 Virus scanners look for such pre-defined patterns in the application
code.
 Intelligent virus writers can change these patterns just by sprinkling
some no-ops(jumps, adding 0 to a num, comparing with itself) to
distort the pattern.
 A virus that can change its pattern/appearance is called as a
polymorphic virus.

 Ex: if a virus writer has 100 bytes of code and 50 bytes of data;
there
can be ‘n’ arrangements of this code using several jump statements.
 Prevention of virus 5
infection 2
 Do not receive executable code from an unknown source.
 But today, non executable file can have executable code,
like macro’s in docs.
 Hidden extension types are another problem, which deceives
the user with a fake format.
 Hiding and making the files as read-only will not prevent the
attacks of virus.
 Some prevention steps possible are:
 Prevention of virus 5
infection 3
1. Use only commercial software acquired from reliable and
well established sources/vendors.
2. Use all new software on an isolated computer.
3. Open attachments only when you know them to be safe.
4. Make a recoverable system image and store it safely
5. Make and retain backup copies of executable system files.
6. Use virus detectors/scanners regularly and update them
frequently with latest virus definitions.
 Truths and misconceptions about
5
viruses 4
1. Viruses can infect only Microsoft Windows systems.
2. Viruses can modify “hidden” and “read-only” files.
3. Viruses can appear only in data files, or only in word
documents, or only in programs.
4. Viruses spread only on disk or only through emails.
5. Viruses cannot remain in memory after a complete shutdown or
on reboot.
6. Viruses cannot infect hardware.
7. Viruses can be malevolent, benign or benevolent.
 First example of malicious 5
code: 5
Brain Virus
 It changes the label of any disk it attacked to the word “BRAIN”.
 What is does?
 First locates itself in the upper memory
 Executes system call to reset the upper memory bound below itself.
(do not disturb mode)
 Traps interrupt number 19 (disk read) by resetting the interrupt
address table to point to it and then sets the address for interrupt
number 6 (un- used) to the former address of the interrupt 19.
 Virus screens the disk read calls, that would read the boot sector.
 It will allow all the other disk calls through the interrupt 6.
Brain 5
6
virus
How it spreads?
 Brain virus settles in the boot sector along with other 6 sectors.
 One of the 6 sectors contain he actual boot code.
 While 2 others contain the parts of the virus code.
 Rest 3 sectors contain the duplicate of the others.
 Virus marks these 6 sectors as “faulty”, so that OS will not use
them.
 Sitting in the memory, this virus will intercept all the disk reads to
boot sector, and verifies the 5th and 6th bytes for its signature.
 If signature found: already infected, if not found: infect them.
 What did we learn from Brain 5
virus? 7
 Uses standard tricks like hiding the virus in the boot sector,
intercepting and screening the interrupts.
 This virus just infects every device that tries performing a disk
read. It doesn’t have any other effect than passing its infection.
 This has served as a prototype for the viruses later.
 Many extensions to this has come ex: Lehigh virus that swept
across all the systems in Lehigh University.
 Internet 5
Worm 8
 Morris, a jr college student from Cornell university programmed
the
internet worm to accomplish three objectives:
1. Determine where it could spread to
2. Spread its infection
3. Remain undiscovered and undiscoverable

 What effect it had?

 Primary goal is resource exhaustion, it checks whether a system is
already infected or not, if so it negotiates with the existing
infection or the new infector will terminate.
 Unfortunately many copies did not terminate causing great loss
to servers and system in universities.
 Many system and machines were disconnected to stop the transfer
to other systems, coz of which work and research is halted for a
long time.
 How it worked? 5
9
 Exploited several known flaws and config failures in UNIX Berkeley
version 4.
 It accomplished three objectives as mentioned previously.
 Determine where to spread: used three techniques for
locating potential victims
1. Guessing passwords attack on machines.
2. Buffer overflow exploit in the program “finger”, that runs
continuously to respond to other computers.
3. Trapdoor in the “sendmail” program.
 6
 Spread infection 0
 Once a target machine is acquired, worm would send a bootstrap
loader to the target.
 This loader is a 99 lines C code that is to be compiled and executed
on the target machine.
 This will fetch the rest of the worm code from the sending machine.
 Worm supplies a OTP to the host, so as to differentiate a rogue
program
written by administrator to obtain a copy of worm for analysis.
 Remain undiscovered and undiscoverable
 If a transmission error occurs during the worm transfer, the loader
zeroed and deletes all the code on the host.
 As soon as the worm received its full code, it will bring the code to
memory, encrypt it and delete the copies in disk.
 Also, this worm will change its and name and process id frequently
to main undiscoverable.
Web bugs 6
2
 Not malicious, but do track the personal information.
 Web bugs are invisible. It is an image hidden in any type
of document that can display HTML tags.
 If you visit www.bluenile.com web bug code is
automatically downloaded as a one-by-one pixel image
from Avenue A marketing agency.
 Web bugs are mainly used to track the user activities on a page,
his interests, buying habits etc. so that advertising agencies can
use this data to give user suggestions.
 This web bug places a cookie on the system to capture the data.
Code 6
Red 1
 Devastating effect, propagates itself onto web servers running
Microsoft IIS web server.
 6 million web servers are infected across the globe.
 Takes two steps: infection and propagation
 Exploited buffer overflow vulnerability in IIS- DLL idq.dll to
reside in
servers memory.
 To propagate, code red uses IP addresses on port 80 of the PC
to see if that web server is vulnerable.
 After propagation, code red started DOS attack on all the
servers
flooding messages.