Software Security

Question 1

Processes

Answer 1

• executes programs etc.
• multiprocess with scheduling
• can create new processes -> forks

Question 2

Intel CPU Registers

Answer 2

rax -> for values to return
rbx -> base addressing
rbp -> base pointer
rsp -> stack pointer

Question 3

Memory Layout: The Stack in x64

Answer 3

...
8th parameter
7th parameter
return address
saved rbp
local variables 
red zone
...

Question 4

Buffer Overflow: Code Execution

Answer 4

• Overwrite return address with pointer to shellcode

- Saved rip will blindly be interpreted as address to return to upon ret

Question 5

NOP sleds

Answer 5

• attackers cannot predict exact location of shellcode

- write many nop’s and then hopefully code is executed

Question 6

Canaries

Answer 6

• place canary on stack before rip, rbp

- before ret compare to actual canary

Question 7

Random Canaries, Terminator Canaries

Answer 7

• Random canaries use a random value pre-generated at program start
• Terminator canaries consist of bytes that terminate C strings

Question 8

Limitations of Stack Canaries

Answer 8

• only against stack overflow
• Byte-by-byte trial-and-error on canary
• > try first byte if correct continue if crashes directly then to next number

Question 9

Non-Executable Stack

Answer 9

• A non-executable stack prevents classical shellcode attacks
• MMU enforces non-executable stack

Question 10

Shadow Stack

Answer 10

• store rip twice and check if the same

Question 11

Format Strings Attack

Answer 11

• if %s or equals aren’t use bad!

- with input as %p (pointers) %n (stores data on stack) we can manipulate

Question 12

Code-Reuse Attacks

Answer 12

• assuming stack not executable
• use already existing code to attack
• we can return to libc or use a ROP (Return-Oriented Programming)

Question 13

Address Space Layout Randomization (ASLR)

Answer 13

• randomize data and code addresses
• needs compiler and linker support
• if absolute addresses are used problems may happen

Question 14

Fine-Grained ASLR

Answer 14

• also reorders functions

- shuffles instructions within a function

Question 15

JIT-ROP

Answer 15

• if one pointer to code is leaked rest can be leaked

- uses JIT environment to read code pages and find pointer etc.

Question 16

Execute-no-Read

Answer 16

• removes read permission from code pages
• conflict with a lot of things
• > so map just a small amount of code pages

Question 17

Control Flow Integrity CFI

Answer 17

• enforce control flow foreseen by developer

Question 18

Uninitialized Stack Variables

Answer 18

• if variable isn’t initialised someone can read them in a second insertion or something

Question 19

Overwriting Function Pointers

Answer 19

• if attacker (e.g. with an overflow) controls the function pointer can access it
  Def. fat pointers
  -> give the size of a buffer with an check

Question 20

Use-after-Free (Dangling Pointers)

Answer 20

• free dosen’t erase content of a buffer
• potentially fee space is used in an buffer with the same size
• we can put data in it
• just set a buffer before freeing =NULL