Tag Info

Hot answers tagged

19

It is mostly untrue. Using a compiler of a different version than the one used for the "mainstream" binary, or using it with different compilation flags, may result in a few things ordered differently, but chances are that most of the code elements will appear in the same order. Insofar as it changes anything with regards to buffer overflow leveraging, ...


14

As the question is given in the headline, "Does compiling from sources .. protect from buffer overflow attacks?", the answer is in general no. However, here is a guess at what your friend might have been thinking of: Current versions of the GNU C Compiler (GCC) can optionally use the GCC Stack-Smashing Protector when invoked with the -fstack-protector ...


12

A typcial example of non-trivial buffer handling is the parsing of binary files (or network packets) that can contain arbitrary-length strings. (Is there any ASN.1 parser that didn't have buffer overflows bugs at some time?) For example, consider the format of textual data chunks in PNG files: The keyword and text string are separated by a zero byte ...


11

The proper way is to use /dev/urandom, not /dev/random. There are very few cryptographic algorithm for which /dev/random is even theoretically better than /dev/urandom (this would be information-theoretic secure algorithms, not mundane things like AES or RSA). /dev/urandom produces randomness of cryptographic quality provided that it could get at some point ...


11

The statement, as you show it, is not vulnerable to anything. However, fprintf() is indeed an interpreter in its own right: what it takes as format string is not just a sequence of characters; it is source code for a specific language with directives beginning with a '%' sign. When you use your fprintf() function like that, sooner or later, some developer ...


11

What happens here is that the foo() function uses a so-called old-style declaration, i.e. as things were done in C before the first normalization (aka "ANSI C" from 1989). In pre-ANSI C, a function bar() which takes two arguments of types int and char * would be defined that way: void bar() int i; char *p; { /* do some stuff */ } and it would ...


9

There is plenty of malware out there that is written in .NET, but as a C# dev I can see why many malware authors avoid it: Easy to disassemble and reverse engineer. Easy for AV to detect use of certain classes and functions. Requires .NET on the box (older XP boxes might not have it, or might only have .NET 2.0) Harder to do anti-debug tricks in .NET than ...


9

In order to make C code "safe", even against a malicious developer, then you have to fix the core issues of C, which have all been repeatedly exploited for arbitrary code execution (exactly what you want to avoid): Weak types. In C, you can take a bunch of bytes, and interpret them as a pointer, an integer, or whatever. All it takes is a cast. As long as ...


8

Yes, for several reasons. One, someone with read access to the binary could potentially run the strings command and look for likely possibilities near the phrase 'localhost'. Two, if you ever decide to use the program elsewhere, you currently have the options of 1) setting up the exact same database on localhost with the exact same username and password ...


8

"The process exiting on SEGV by itself is not a problem in this case": this is already a large assumption. Whatever the process was doing will not be finished; the caller gets an error code; if the process had created temporary files then those files do not get erased. Making sure that there really is no problem is tricky. Also, what creates the SEGV is the ...


8

[Does] compiling your own binary for an application (with specific compilation flags) instead of using the "mainstream binary" make it more difficult for an attacker to leverage buffer overflows? It depends on the operating system, the language the application is written in, and the compiler. First, the programming language must be a compiled ...


8

It depends on the rand() implementation... the standard (POSIX / Single Unix) gives a sample implementation but any system is free to have something better. You can see the sample code there. If that exact code is used, then the internal state is a 32-bit integer, and it suffices to get two successive 16-bit output values to recompute the internal state. ...


8

It is possible to have issues with printf(), by using as format string a user-provided argument, i.e. printf(arg) instead of printf("%s", arg). I have seen it done way too often. Since the caller did not push extra arguments, a string with some spurious % specifiers can be used to read whatever is on the stack, and with %n some values can be written to ...


8

It is a race condition. You do the access(), then you do the open(). In the small time between the two calls, the file may have changed. Typically, the file is, say, /tmp/foo. Initially, the file is owned by some user (who is the bad guy of the story), and the target is some root-powered application. The application does the access(), sees that the file ...


7

What he is talking about is probably that in certain cases where the original binary has not been compiled with available protections, you can recompile it to enable them. Nowadays compilers and operating systems offer many advanced security protections, but sometimes it's up to the developer to apply them on his application, and some of them are applied at ...


7

I know this answer is going to be unpopular, but I would tell the people to stop programming in C or any unmanaged code. JIT optimizations in managed code frameworks are better optimizing (which is something which you shouldn't care about in the first place as a developer) in 2011. In the case of brownfield, legacy devshops-- they should utilize a different ...


7

I know this is sort of outside the specifics for C, but I feel it is appropriate for teaching any developers: Input validation and output encoding Get that idea drummed into them. Whether or not you end up doing a bit around SQL Injection, it is still worth teaching the 'do not trust anything outside your control' mentality! Update - Having a quick ...


7

RAND_bytes() automatically calls RAND_poll() if it has not already been done at least once. So you do not have to call it yourself. RAND_poll() feeds on what the operating system provides: on Linux, Solaris, FreeBSD and similar Unix-like systems, it will use /dev/urandom (or /dev/random if there is no /dev/urandom) to obtain a cryptographically secure ...


7

On 32-bit x86 processors, with the ELF format in use on Linux systems, the function call convention states (page 3-12) that: A function that returns an integral or pointer value places its result in register %eax. In your program, the last element of main() is a call to strcpy(). That function returns a copy of its first argument, here a pointer to the ...


7

I see lots of problems when people need to parse character data out of structs, especially when it's a buffer that is normally null terminated, but can be the size of the buffer without a terminator. short canary = 0x5678; struct customer { char name[4]; char suffix[3]; }; short fencepost = 0x1234; Have them fill customer with data like "Joe" and ...


6

Sounds like a fun project. I know you said "simple," but here are my thoughts anyway. The data you're writing the file over with isn't random, and one pass will still leave traces of the original data. It depends on the storage medium. For example, with magnetic devices, there's magnetic force microscopy. Even after ten rounds of the same thing, I'm not ...


6

The first problem is that it's not threadsafe, and the string buffer that is used doesn't contain a trustworthy value; i.e., you can't be sure the value you get back is any good. US-CERT goes into some detail. The results of getlogin() should not be trusted. The getlogin() function returns a pointer to a string that contains the name of the user ...


6

getlogin() works by checking a property of stdin. However, a malicious attacker can start your program with stdin redirected to some other user's controlling terminal, and that will fool getlogin(). Don't use getlogin() for security purposes. You'll want to look at getuid(), geteuid(), getpwuid(), and similar methods.


6

Send a mail to your sysadmin (you HAVE TO contact someone above you) or send it directly to the CIO, if you have to convince him, explain what you found and attach this part of the file named "a.c", that should suffice: * There are a number of commands that can be sent to the client: * * TSUNAMI <target> <secs> = A ...


6

I have to encrypt the file, because anyone who can change it can get one cent drinks. Encryption is used for confidentiality - to prevent unauthorized parties from reading the file. Since your goal is to prevent people from changing the file what you need is a digital signature. There are two kinds of digital signatures: asymmetric signatures and ...


6

In SSL/TLS, messages are sent as part of records. What should be expected is that the client first send a ClientHello message which itself is contained in one or several records. Record format is: record type: 1 byte (0x16 for "records contains some handshake message data") protocol version: 2 bytes (0x03 0x00 for SSL 3.0, 0x03 0x01 for TLS 1.0, and so on) ...


5

In kernel code, this bug is a serious vulnerability. User code can request to remap the page starting at address 0, and that mapping will apply to kernel code as well. So, if this happens, the kernel is now reading from (or writing to) user-controlled memory instead of kernel-controlled memory, which might violate the integrity (or confidentiality) of the ...



Only top voted, non community-wiki answers of a minimum length are eligible