3

For buffer overflow attacks, my exam review says that there are drawbacks to choosing canary values at compile time vs runtime. Why would it be better to choose the canary value at runtime?

5
  • 2
    Please do some research before asking questions here: en.wikipedia.org/wiki/Buffer_overflow_protection#Canaries
    – schroeder
    Apr 8, 2015 at 19:14
  • If the canary was known at compile time, it could be guessed by attackers.
    – schroeder
    Apr 8, 2015 at 19:14
  • @schroeder When you say "guessed," you mean it can be bruteforced where it is in the program?
    – Jack
    Apr 8, 2015 at 19:15
  • yes- if the canary is known, it can be overwritten with itself to hide the fact that a BO occurred.
    – schroeder
    Apr 8, 2015 at 19:17
  • 1
    What exam? Just curious...
    – hft
    Apr 9, 2015 at 2:30

1 Answer 1

1

A canary value chosen at compile-time is constant from run to run, across all copies of the program. This means an attacker can figure it out by analyzing the program; once they know it, they can set up their overflow attack so that the overflow over-writes the canary with the same value it had originally, making the attack undetectable.

If the canary value is chosen at runtime, on the other hand, an attacker needs to guess it on the first try. If they guess wrong, the attack will be detected; ideally, this would trigger the application developer to find and fix the bug that permitted the overflow in the first place.

A minor benefit is that it increases the security against brute-force attacks slightly: for example, an attacker trying to guess a static 32-bit canary through trial-and-error will need to make an average of 2 billion guesses, where a runtime-chosen canary will take an average of around 3 billion guesses because the canary can change to a value the attacker has already tried.

6
  • I think your last paragraph about "A minor benefit" may be incorrect. Pretty sure you don't get an entire factor of 2 benefit. Can you support your statement with theory or experiment?
    – hft
    Apr 9, 2015 at 15:05
  • @hft, just basic statistics. If the canary is static, the average difficulty of guessing it is 2^(n-1), the same as any other brute-force attack on a fixed value: the odds that this guess is correct start at 2^n and rise on each guess because you've eliminated some of the search space. With a varying canary, the chance of a guess being successful is a constant 2^n, because the canary changes after each guess and you can't eliminate any of the search space.
    – Mark
    Apr 9, 2015 at 20:17
  • And I'm saying that reasoning is incorrect.
    – hft
    Apr 9, 2015 at 22:24
  • @hft, what's incorrect about it?
    – Mark
    Apr 10, 2015 at 0:05
  • Let N be defined as 2^n. In the case of a runtime canary I have a probability of 1/N of guessing correctly on each try, and each try is independent (regardless of if I guess in a sequence or not because the canary changes randomly each run). So, the probability of guessing correctly in M trys is 1-(1-1/N)^M. If I set this equal to 1/2 (50% chance I got it in M trys) I find M is approximately N*ln(2). Whereas the case of compile-time canary it seems like the average number of guesses would be N/2.
    – hft
    Apr 10, 2015 at 1:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .