1

I'm learning about security, and it seems that all of the security problems I have seen come from input from malicious actors.

I was told that it's possible to check for the existence of bugs in a program, but not possible to check that a program doesn't have any bugs. Following from this, this means that it's not possible to prove that a program is 100% secure (correct me if I'm wrong).

So I was thinking, is it possible for a program to be hacked in some way without explicitly taking user input?

And by hack, I mean making the program do something it wasn't designed to do.

For example: somehow forcing a program to take in user input by other means even though the actual program code doesn't take in user input.

Or subverting the execution of a simple Hello World program and making it execute a shell.

Is it possible to craft a program that doesn't explicitly take user input, but can still be hacked?

Improve this question
  • 6
    Two topics of interest for you: rowhammer and provably correct software – Conor Mancone Jan 3 '20 at 0:53
  • Can you provide an example of a program that does not take inputs? – schroeder♦ Jan 3 '20 at 12:50
  • @schroeder int main() { printf("Hello World\n"); return 0; } – NotAPro Jan 4 '20 at 23:16
  • Ok, but is that a program? There is a bit of a taxonomy exercise here that's important. You could ask, "can code that takes no inputs be abused/misused?" – schroeder♦ Jan 5 '20 at 10:09
  • I'm not sure I understand where you're coming from. Yes, it is a program: C is a programming language that is used to write programs. What I put is code of a program, that can be compiled and executed as a program. – NotAPro Jan 5 '20 at 22:23
7

Short answer: Yes, DLL path highjacking.

Long answer: Though a program may not explicitly ask for user input, the operating system supplies resources for that program to run. So the attacker can target the program, the resources prepared for that program, or the interaction between that program and other necessary components.

Improve this answer
  • It might depend on the definition of "hacked". One could argue that, if you perform DDL injection (or LD_PRELOAD hijacking, which is the equivalent on *nix) that it's no longer the same program. – forest Jan 4 '20 at 7:37
1

The point is, that a program has to take user input. It very easy to write a program that takes no input and cannot be „hacked“: Hello World would be an example.

But to perform any kind of useful function, a program will have to work with data that is supplied from the outside. All of that data is considered „user input“ in the sense that an attacker could manipulate it to make the program do unwanted things.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.