Attack Vectors

Question 1

Kinds of Attacker Goals

Answer 1

• Denial of Service
• Leak information
• Code execution
  -> extend intended application functionality to execute arbitrary code instead
  -> can be achieved by injecting new code or repurposing existing code through different means
• Privilege escalation

Question 2

Software Attack Types

Answer 2

• Code Execution:
  -> Control-Flow Hijacking: redirect control-flow
  -> Code Injection: Inject new code into the process
  -> Code Reuse: Reuse existing code in the process
• Data Corruption: Corrupt sensitive (privileged) data
• Information Leak: Output sensitive data

Question 3

Attack Type: Code Execution

Answer 3

• Code execution requires control over control flow
  1. Attacker must overwrite a code pointer
  -> RIP on the stack
  -> Function pointer
  -> Virtual table pointer
  2. Force program to dereference corrupted code pointer

Question 4

Attack Type: Code Execution - Hijacking Control-Flow

Answer 4

• CFH is an attack primitive that allows the adversary to redirect flow to locations that would not be reached in a benign execution
• CFH requires:
  -> Knowledge of the location of the code pointer
  -> Knowledge of the code target
  -> Existing code and control-flow must use the compromised pointer

Question 5

Attack Type: Code Execution - Code Corruption

Answer 5

• The attacker locates existing code and modifies it to execute the attacker’s computation
• Code corruption requires:
  -> Knowledge of the code location
  -> Area must be writable
  -> Program must execute that code on benign code path

Question 6

Attack Type: Code Execution - Code Injection

Answer 6

• Instead of modifying/overwriting existing code, inject new code into the address space of the process
• Code injection requires:
  -> Knowledge of the location of a writable memory area
  -> Memory area must be executable
  -> Control-flow must be hijacked/redirected to injected code
  -> Construction of shellcode

Question 7

Attack Type: Code Execution - Code Reuse

Answer 7

• Instead of injecting code, reuse existing code of the program. The main idea is to stitch together existing code snippets to execute new arbitrary behavior
• Code reuse requires:
  -> Knowledge of a writable memory area that contains invocation frames (gadget address and state such as register values)
  -> Knowledge of executable code snippets (gadgets)
  -> Control-flow must be hijacked/redirected to prepared invocation frames
  -> Construction of ROP payload (Return-Oriented Programming)