Memory Corruption and Hacker Folklore

Nice work by haroon from Thinkst Applied Research, he is making an interactive timeline of the history of memory corruption vulnerabilities and exploit techniques. You can submit events using this form

Bypassing DEP on Win2003 SP2

David Kennedy “ReL1K” published
Bypassing Hardware based Data Execution Prevention on Windows 2003 Service Pack 2 PDF (497KB)

Good, you can learn from David experience writing an exploit for Windows 2003 SP2. This is the kind of research you have to do to exploit a simple buffer overflow in modern operating systems with protections. What he does manually in this article sometimes is harder or impossible without the help of some automated tool to analyze thousand of different system modules.

Return-Oriented Programming: Exploits Without Code Injection

...We describe return-oriented programming, a generalization of return-into-libc that allows an attacker to undertake arbitrary, Turing-complete computation without injecting code.New computations are constructed by linking together code snippets that end with a “ret” instruction. The ret instructions allow an attacker who controls the stack to chain instruction sequences together. Because the executed code is stored in memory marked executable, W^X and DEP will not prevent it from running.
...

PDF

Adventures with a certain Xen vulnerability - Rafal Wojtczuk

  Rafal Wojtczuk paper about the exploitation of a XEN vulnerability 

The Evil Hacker escapes from DomU and gets into Dom0. Using clever
ret-into-libc technique he succeeds with his attack on x86 architecture,
despite the NX and ASLR deployed in Dom0 OS (Fedora Core 8). The Evil
Hacker is also not discouraged by the fact that the target
OS has SELinux protection enabled - he demonstrates how the particular
SELinux policy for Xen, used by default on FC8, can be bypassed.
Ultimately he gets full root access in Dom0. Rafal also discusses
variation of the exploitation on x86_64 architecture - he partially
succeeds, but his x64 exploit doesn't work in certain circumstances.
...

PDF

Aplication-Specific Attacks - Leveraging the ActionScript Virtual Machine

Memory corruption vulnerabilities are becoming increasingly difficult to exploit, largely due to the protection mechanisms being integrated into most modern operating systems. As general protection mechanisms evolve, attackers are engaging in more specific, low-level application-targeted attacks. In order to refine general countermeasures (or at least raise awareness of their shortcomings), it is important to first understand how memory corruption vulnerabilities are exploited in some unique scenarios.

[...]

Aplication-Specific Attacks - Leveraging the ActionScript Virtual Machine by Mark Dowd PDF

gcc silently discards some wraparound checks...buf+len < buf?

David LeBlanc's Web Log
Vulnerability Note VU#162289

Basically, what it says is that code which looks like this:


char *buf;
int len;

gcc will assume that buf+len >= buf.

As a result, code that performs length checks similar to the following:

len = 1<<30;
[...]
if(buf+len < buf) /* length check */
[...perform some manipulation on len...]

are compiled away by these versions of gcc

User Supplied Format String Vulnerability - everything ever written

2005

Format String Vulnerabilities in Perl Programs
Steve Christey

2002

Advances in format string exploitation
Gerardo Richarte, Ricardo Quesada

Howto remotely and automatically exploit a format bug
Frédéric Raynal

2001

Exploiting Format Strings Vulnerabilities
scut team-teso
v1.1
v1.2

Format String Attack on alpha system
Seunghyun Seo (truefinder)

Format String Technique
sloth@nopninjas.com

Analysis of Format String Bugs
Andreas Thuemmel


Detecting Format String Vulnerabilities with Type Qualifiers
David Wagner

Large-Scale Analysis of Format String Vulnerabilities in Debian Linux
David Wagner

What are format bugs ?
Christophe BLAESS Christophe GRENIER Frédéreric RAYNAL
French

2000

More info on format bugs
Pascal Bouchareine
Español

Format String Attacks
Tim Newsham
TXT

Format Bugs: What are they, Where did they come from,...How to exploit them
Lamagra
Español

Paper sobre format bugs
venomous


Exploiting the Libc Locale Subsystem Format String Vulnerability on Solaris/SPARC
Solar Eclipse

100 Most Influential Books Ever Written


See: scut/teso-team Format String paper

Double Free Vulnerabilities on Windows

by Matt Conover 2007

To learn to exploit real heap memory corruption vulnerabilities on Windows one of the things you have to do is to read every Matt Conover's publication. The next are two posts in the Symantec Security Response Blog about double free() bugs. More articles and publications by him will be posted later in this blog.

In light of the recent CSRSS double free bug, I wanted to provide some information on the exploitation of double frees on Windows on XP SP2 and later. Prior to XP SP2, double frees were trivial to exploit, but now the security cookie (in each heap chunk) and safe unlinking checks make it more difficult to exploit. So this blog entry will discuss the exploitability on XP SP2 and later heap implements.

Double Free Vulnerabilities Part 1

Double Free Vulnerabilities Part 2

Smashing The Modern Stack For Fun And Profit

Craig J. Heffner article about the problems he found while reading and following the examples in Smashing The Stack For Fun And Profit using a modern Linux system.

"...the GNU C Compiler (gcc) has evolved since 1998, and as a result, many people are left wondering why they can't get the examples to work for them, or if they do get the code to work, why they had to make the changes that they did. Having these same problems myself, and being unable to find an updated version of Aleph One's document on the web, I set out to identify the source of these variations on my own. ..."
Smashing The Modern Stack For Fun And Profit

Phrack Magazine #64

May 2007
by The Circle of Lost Hackers

0x01 Introduction                                 The Circle of Lost Hackers
0x02 Phrack Prophile of the new editors           The Circle of Lost Hackers
0x03 Phrack World News                            The Circle of Lost Hackers
0x04 A brief history of the Underground scene     The Circle of Lost Hackers
0x05 Hijacking RDS TMC traffic information signal                      lcars
                                                                  danbia
0x06 Attacking the Core: Kernel Exploitation Notes                      twiz
                                                                sgrakkyu
0x07 The revolution will be on YouTube                                gladio
0x08 Automated vulnerability auditing in machine code           Tyler Durden
0x09 The use of set_head to defeat the wilderness                       g463
0x0a Cryptanalysis of DPA-128                                           sysk
0x0b Mac OS X Wars - A XNU Hope                                         nemo
0x0c Hacking deeper in the system                                   scythale
0x0d The art of exploitation: Autopsy of cvsxpl                  Ac1dB1tch3z
0x0e Know your enemy: Facing the cops                                  Lance
0x0f Blind TCP/IP hijacking is still alive                               Lkm
0x10 Hacking your brain: The projection of consciousness             keptune
0x11 International scenes                                            Various

Phrack #64

Download .tgz

Defend Your Code with Top Ten Security Tips Every Developer Must Know

MSDN Magazine, September 2002
Michael Howard and Keith Brown




Content

• 1. Trust User Input at Your Own Peril
• 2. Protect Against Buffer Overruns
• 3. Prevent Cross-site Scripting
• 4. Don't Require sa Permissions
• 5. Watch that Crypto Code!
• 6. Reduce Your Attack Profile
• 7. Employ the Principle of Least Privilege
• 8. Pay Attention to Failure Modes
• 9. Impersonation is Fragile
• 10. Write Apps that Non-admins Can Actually Use

English English Deutsch Español Français Italiano 日本語 한국어 Português Pусский 简体中文繁體中文

CERT Secure Coding Projects

http://www.cert.org/secure-coding/

CERT Secure Coding Standards
A collaborative site that provides rules and recommendations for secure coding practices in the C and C++ programming languages

Managed string library
The managed string library provides a more secure alternative to standard null-terminated byte strings in C. Managed string functions dynamically allocate memory as required, eliminating the possibility of buffer overflows, string truncation, and other common programming errors.

Secure integer library
This library includes functions for safe integer conversions and arithmetic operations.

Publications Podcast RSS

Automatic Discovery of API-Level Exploits

Not very interesting besides the title and abstract. It could be included it in the "everything ever written about format strings vulnerabilities" section.



PDF
By Vinod Ganapathy, Sanjit A. Seshia, Somesh Jha, Thomas W. Reps, Randal E. Bryant

Abstract
We argue that finding vulnerabilities in software components is different from finding exploits against them. Exploits that compromise security often use several low-level details of the component, such as layouts of stack frames. Existing software analysis tools, while effective at identifying vulnerabilities, fail to model low-level details, and are hence unsuitable for exploit-finding. We study the issues involved in exploit-finding by considering application programming interface (API) level exploits. A software component is vulnerable to an API-level exploit if its security can be compromised by invoking a sequence of API operations allowed by the component. We present a framework to model low-level details of APIs, and develop an automatic technique based on bounded, infinite-state model checking to discover API-level exploits. We present two instantiations of this framework. We show that format-string exploits can be modeled as API-level exploits, and demonstrate our technique by finding exploits against vulnerabilities in widely-used software. We also use the framework to model a cryptographic-key management API (the IBM CCA) and demonstrate a tool that identifies a previously known exploit.

Blended Attacks: Exploits, Vulnerabilities and Buffer-Overflow Techniques in Computer Viruses

Blended Attacks: Exploits, Vulnerabilities and Buffer-Overflow Techniques in Computer Viruses
by Peter Szor and Eric Chien / Virus Bulletin Conference September 2002
PDF

Peter Szor is the author of the excellent The Art of Computer Virus Research and Defense.

The Script Mapping Project

The purpose of the WASC Script Mapping Project is to come up with an exhaustive list of vectors to execute script within a web page without the use of [script] tags. This data can be useful when testing poorly implemented Cross-site Scripting blacklist filters, for those wishing to build an html white list system, as well as other uses.

The Script Mapping Project

Hacking Windows CE

HITBSecConf2005
talk by San

Analyzing Code for Security Defects

HITBSecConf2005
talk by Nish Bhalla

Java 2 Micro Edition (J2ME) Security Vulnerabilities

badcoded is web 2.0?

HITBSecConf2004
talk by Adam Gowdiak

Once upon a time badcoded was about ASCII text files.

How To Break Web Software - A look at security vulnerabilities in web software

Wasn't this blog about bit and bytes about 00 and FF?

readers of this blog want less buffers and bytes some want more strings and chars.

User supplied format string vulnerability

This vulnerability type is less frequent than buffer overflows but more entertaining to exploit. There are probably more articles written about how to exploit them than real format string vulnerabilities in programs. The best one is the scut/team-teso paper.

• Exploiting Format Strings Vulnerabilities - scut@team-teso Sep 2001 V1.2 PDF