Chapter 3: Program Security

• In this chapter
  1. Nonmalicious and malicious program flaws
  2. Viruses
  
  
  
• Errors, faults and failures
  • An error is a mistake in the software.
  • An error may lead to an incorrect state, or fault (one error may lead to many faults)
  • A fault may cause the system to depart from its required behavior. Such departure is a failure.
  
  
  
• A fault is internal, while a failure is external
  
  
• Inadvertent or intentional flaws? ("...whether the stone hits the pitcher or the pitcher hits the stone, it's going to be bad for the pitcher")
  
  
• Fixing Faults
  • "Penetrate and patch"
  • May result in worse security
  
  
• Difficulties
  1. Almost impossible to assure that a program does what is intended and nothing more
  2. Software engineers are not "security conscious"
  
  
• Types of flaws
  1. validation error
  2. domain error
  3. serialization and aliasing
  4. inadequate authentication/authorization
  5. boundary condition violation
  6. other exploitable logic errors
  
  
• Nonmalicious program errors
  
  
  • Buffer overflows --- like trying to pour 2 quarts of water into a 1 quart pitcher

    
         char array[10];
         for(i = 0; i < 10; ++i)
             array[i] = `A`;
         array[10] = `B`;
    
    

    
    
    
  • "Smashing the stack" --- redirect execution to attacker's code (attack of the decade)
    
    
  • Incomplete mediation
    
    
    1. Example: data checked when input on client, but not checked after returned to server

       
            http://www.things.com/orders/final&custID=112&num=555A
            &qty=20&price=10&shipping=5&total=205
       
       

       changed (by client) to

       
            http://www.things.com/orders/final&custID=112&num=555A
            &qty=20&price=10&shipping=5&total=25
       
       

    2. Example: Linux kernel
       
    
    
  • Combinations of program flaws
    
    
• Viruses and other malicious code
  
  
  • Malicious code can do much harm
    
    
  • Malicious code has been around for a long time (early 80's or before)
    
    
  • Work of Fred Cohen
    
    
  • Types of malicious code
    1. virus --- attaches itself to a program and copies itself to other programs
    2. trojan horse --- program with unexpected additional functionality
    3. logic bomb --- triggers action based on some event
    4. trapdoor --- allows unauthorized access
    5. worm --- propagates copies of itself through a network
    6. rabbit --- replicates itself without limit (exhausts resources)
    
    
  • How viruses attach
    
    
    
    
  • Virus replacing a program
    
    
    
    
  • Boot sector virus
    
    
    
    
  • Other places viruses live
    1. Memory resident
    2. Applications (macros, data, etc.)
    3. Libraries
    4. Compiler, debugger, virus checking programs, etc.
    
    
  • Virus signatures
    
    
  • Polymorphic and metamorphic viruses
    
    
  • Examples of malicious code
    
    
    1. Brain virus (1986)
       • What it does --- places itself in boot sector (and 6 other sectors, one of which contains original boot sector) and screens disk read calls, so that it is not detected
       • How it spreads --- with each read, it reads boot sector to see if it is yet infected; if not it infects as above
       • What was learned --- a prototype for many later viruses
       
       
    2. Morris worm (1988)
       • What it does --- the worm was designed to
         1. determine where it could spread
         2. spread its infection
         3. remain undiscovered
       • Its effect --- "flaw" in code so it tried to re-infect systems, which led to resource exhaustion; also many systems disconnected from network to avoid infection
       • How it worked --- exploited known Unix flaws
         • Where to spread --- 3 methods:
           1. user account password guessing (dictionary attack)
           2. exploit a bug in fingerd (buffer overflow)
           3. exploit trapdoor in sendmail (debug mode)
         • Spread infection --- bootstrap loader (99 lines of C) sent to victim machine and compiled and executed; it then fetched the rest of the worm (victim even authenticated the sending host!)
         • Remain undiscovered --- if transmission interrupted, code deleted; full code encrypted and downloaded code deleted; periodically changed its name and process identifier
       • What was learned --- sent shock waves through the Internet (of 1988); could have been much worse; led to Computer Emergency Response Team (CERT)
       
       
    3. Code Red (2001), Infected more than 250,000 systems in 9 hours; overall more than 750,000 servers affected (6,000,000 susceptible servers at the time)
       • What it did --- exploited buffer overflow in Microsoft Internet Information Server (IIS) software; then checks traffic on port 80 to infect other systems
       • What effect it had --- first version

         
                            HELLO!
                            Welcome to
                            http://www.worm.com !
                            Hacked by Chinese!
         
         

         Original version: From day 1 to 19 of a month it tried to spread; from 20 to 27 a DDoS attack on www.whitehouse.gov (later version included a Trojan horse allowing attacker remote access)
       • How it worked --- later version created a trapdoor via trojan; rebooted system to flush worm (but leaving back door and trojan)
       • What was learned --- might be a "beta test for information warfare"
       
       
    4. Flash worm (future), Slow worm, etc.