Buffer Overflow Attacks are used by attackers to disrupt website availability, gain access to unauthorized data, and/or execute malicious code. Attackers make use of common coding mistakes/ flaws known as buffer overflow vulnerabilities. In this article, we will explore Buffer Overflow Attacks and their prevention in detail.
An Introduction to Buffer Overflow
A buffer is a sequential section/ area of memory storage where data is temporarily stored while in transition/movement from one location to another. They usually live temporarily in the RAM and are used to improve the performance and speed of data access. For instance, they are often used by online streaming services to avoid interruptions in the service. The player streams from the buffer where x% of the video is downloaded and stored at a time.
Buffers are designed to store only a specified amount of data at a time. Unless it has built-in instructions to automatically discard data when it is too full, it will bleed into and overwrite in the adjacent memory locations. This anomaly is a buffer overflow/ buffer overrun.
You may also want to read about, OWASP Security Misconfiguration
Definition
Through Buffer Overflow Attacks, attackers exploit the buffer overflow vulnerabilities in the software/ application to overwrite the memory of the application and fulfill their malicious objectives.
Types
- Stack-based buffer overflows: Targets the stack memory
- Heap-based attacks: Targets the open memory pools called heaps
- Unicode overflow: Uses Unicode as input to flood memory
- Integer overflow attacks: Uses arithmetic operations that result in integers larger than the integer capacity to orchestrate attacks.
Consequences
- Application crashes and other types of attacks can make the application unavailable.
- Arbitrary code execution triggering undesirable application behavior and actions.
- Unauthorized access to the application or data
- Subversion of security systems in place
Buffer Overflow Vulnerabilities: How Do They Work?
How do Attackers Orchestrate Buffer Overflow Attacks?
Attackers attempt to identify the memory layout of the program to find memory areas that hold executable code. By leveraging the buffer overflow vulnerabilities present in the application/ software, they deliberately flood the buffer and overwrite adjacent areas of memory, especially those containing executable code. Through their carefully crafted inputs, they replace the executable code with malicious code to modify how the application works and fulfill its objectives.
Causes
At the code level, flawed developer assumptions and the use of memory manipulation functions that do not perform bounds-checks leave the application highly susceptible to these attacks. When the coding is so complex that the developer cannot effectively predict how the code will behave, they build a higher risk of buffer overflow attacks into the application.
C and C++ programming languages are more vulnerable to Buffer Overflow Attacks as they lack in-built bounds-checks and protection against this attack type. Applications that libraries and custom code are at a higher risk of buffer overflow.
Ways to Prevent Buffer Overflow Attacks
Secure Coding and Development Practices
One of the best Buffer Overflow Attack prevention measures is the adoption of secure coding and development practices.
- Choose languages with in-built protection mechanisms such as C#, Java, JavaScript, PERL, and so on.
- If using C/ C++ languages, standard library functions that do not have bounds-checks should be avoided.
- Use special security procedures in the code to minimize the likelihood of buffer overflow vulnerabilities.
- Review all custom codes and codes that accept user inputs via HTTP requests used in the application.
- Ensure that all inputs are size, and bounds checked.
- Proactively identify and fix coding errors.
Check out OWASP Top 10 Web Application Security Vulnerabilities to Watch Out for in 2020
Runtime Protection
Modern Operating Systems offer several runtime protections that help in Buffer Overflow Attack prevention.
- Structured Exception Handler Overwrite Protection (SEHOP): The Structured Exception Handler (SEH), a built-in system, helps in handling software and hardware exceptions. SEHOP enables businesses to prevent attackers from overwriting and attacking the SEH.
- Address Space Randomization (ASLR): ASLR randomly moves around the address spaces of data locations. Without knowledge of where the executable code exists, it is nearly impossible to execute Buffer Overflow Attacks.
- Data Execution Prevention: By marking certain memory regions as executable and non-executable, attackers are prevented from executing malicious code in non-executable areas.
Conclusion
According to OWASP, Buffer Overflow Attacks have very high severity and high to very high exploitability. While secure coding practices and runtime protections are important ways to prevent Buffer Overflow Attacks, they are not sufficient measures. Proactive identification and patching of known and emerging Buffer Overflow Vulnerabilities in the code, server, application, and third-party components are necessary.
For more cybersecurity features and news, follow Indusface on Twitter and Facebook.
Originally published at https://www.indusface.com.
