Datamaxxx filed a notice 2024/11/25
Past summer: Heritage Foundation, AT&T
Past year: UK MOD, Truist, Lulu, voting, Change Healthcare?
February 2024: Change Healthcare (UnitedHealth) randsomware
Records Processing interrupted.
Related: 2017: Equifax Breach
These companies collect PII
Like SSN, Credit Cards, Payment History
big oof
EoD: It is correctness
Correctness: does the program behave how we want it to
Security prevents "undesired" behavior
Security is more than a bug
Security assumes a active and malicious adversary
Testing Cannot solve this fully
Testing proves presence of bugs, not their absence (Dijkstra)
Goals:
Of Attacker?
Goals:
Of us?
Raise Bar for Attacker
Why are attacks common?
Ultimately Money and Availability
Software is large: millions LoC
Bugs are everywhere
Normal user never sees (or cares about) most bugs
Expensive to fix (prioritize major fixes)
Attackers look for bugs and try to exploit them
Our Goal
Minimize undesired behavior
Think like attackers to prevent future attacks
Address bugs AND design flaws
Deeply understand the systems we use and build
Buffer Overflow
Family of vulnerabilities which stem from bounds checking failure
Consider the stack
# vuln.c
void other(){
char password[5];
char username[5];
...
}
...
Buffer Overflow
Consider the stack
# vuln.c
void other(){
char password[5];
char username[5];
...
}
...
top of stack |_|_|_|_|_|_|_|_|_|_| bottom of stack
^ ^ ^ ^ ^ + + + + +
/* ^ = username
+ = password
*/
Buffer Overflow
Consider the stack
# vuln.c
void other(){
char password[5];
char username[5];
strcpy(password,"pass");
gets(username)
...
}
...
top of stack |X|X|X|X|X|P|A|S|S|\0| bottom of stack
^ ^ ^ ^ ^ + + + + +
/* ^ = username
+ = password
*/
Buffer Overflow
Consider the stack
# vuln.c
void other(int arg1){
char password[5];
char username[5];
...
}
...
top of stack |_|_|_|_|_|_|_|_|_|_|_|_|_|
^ ^ ^ ^ ^ + + + + + | | *
/* ^ = username
+ = password
| = secret (ebp,eip)
* args
*/
Buffer Overflow
Basis for Heartbleed many moons ago
Basis for Morris Worm
Enforcing Type safety can prevent
Command Injection cannot be be prevented with type safety
Command Injection:Inject Code as part of user input
Consider the following (python)
ui = input("enter a file to cat: ")
command = "cat " + ui
os.system(command)
Fix