Data Structure
Networking
RDBMS
Operating System
Java
MS Excel
iOS
HTML
CSS
Android
Python
C Programming
C++
C#
MongoDB
MySQL
Javascript
PHP
Physics
Chemistry
Biology
Mathematics
English
Economics
Psychology
Social Studies
Fashion Studies
Legal Studies
- Selected Reading
- UPSC IAS Exams Notes
- Developer's Best Practices
- Questions and Answers
- Effective Resume Writing
- HR Interview Questions
- Computer Glossary
- Who is Who
Buffer Overflow Attack: Definition, Types, How to Avoid
What is Buffer Overflow?
When a lot of data is written to a buffer than it can hold, a buffer overflow occurs. The extra data is written to the adjacent memory, overwriting the contents of that location and resulting in unpredictable program results. Buffer overflows occur when the data is written without sufficient validation (no boundaries). It's seen as a flaw or defect in the software.
By introducing code specifically engineered to cause buffer overflow with the initial portion of a data set, attackers can exploit a buffer overflow problem then write the rest of the data to the memory address adjacent to the overflowing buffer.
The overflow data could contain executable code that allows the attackers to run more significant, more complex programs or gain system access.
Buffer overflows are one of the mostdeadly vulnerabilities an attacker may exploit, partly because they are challenging to detect and fix, especially in software containing millions of lines of code. Even the fixes for these bugs are complex and prone to errors. As a result, eliminating this type of issue is nearly impossible.
Even though many programmers are aware of the risk of buffer overflow in their programs, there are still many buffer overflow-related hazards in both new and old software, regardless of how many patches have already been implemented.
What Exactly is a Buffer?
A buffer, also known as a data buffer, is a physical memory storage region that is used to hold data temporarily. At the same time, it is being transported from one location to another. These buffers are usually held in RAM. Computers often use buffers to improve performance; most current hard drives employ buffering to retrieve data more quickly, and many online services do. Buffers, for example, are widely used to prevent interruptions in internet video streaming. When a video is streamed, the video player first downloads and stores around 20% of the video in a buffer before streaming from that buffer. Minor decreases in connection speed or brief service interruptions will not affect the video stream's performance.
Buffers are used to store specific amounts of information. Unless the program utilizing the buffer has built-in instructions to discard data when too much is sent, the data in memory adjacent to the buffer will be overwritten.
Attackers can take advantage of buffer overflows to corrupt software. Buffer overflow attacks, despite being well-understood, remain a serious security issue that plagues cyber-security teams. Because of a buffer overflow vulnerability in SSL software, a threat known as 'heartbleed' exposed hundreds of millions of people to assault in 2014.
Types of Buffer Overflow Attacks
Buffer overflow attacks come in a variety of forms. The operating system (OS) and programming language used to exploit buffer overflow vulnerabilities differ. The goal is always to subvert or control program execution via manipulating a computer's memory.
Buffer overflows are classified based on the buffer's location in the process memory. Stack-based or heap-based overflows are the most common. Both are stored in the random access memory of a device.
The following are examples of buffer overflow attacks.
Stack-based Buffer Overflow
It is often known as stack buffer overrun, a type of buffer overflow attack. In a last-in, first-out structure, the stack stores data. It's a continuous memory space used to arrange data connected with function calls, such as function parameters, function local variables, and management information like frame and instruction pointers.
The stack usually is empty until the targeted software asks for user input, such as a login or password. The program then writes a return memory address to the stack before placing the user's input on top of it. The user's input is transmitted to the return address set by the program when the stack is processed.
A stack, on the other hand, has a fixed size. The code developer must set aside a certain amount of space for the stack. The stack will overflow if the user's input is longer than the amount of space designated within the stack and the software does not verify that the input will fit. This isn't a significant issue in and of itself, but when combined with malicious input, it becomes a major security flaw.
Heap-based Buffer Overflow Attack
The heap is a memory structure for storing and managing dynamic data. When the quantity of memory requested is too vast to fit on the stack or the memory is meant to be used across function calls, programmers frequently use the heap to allocate memory whose size is not known at the time of compilation. Heap-based assaults inundate a program's or process's memory area. Heap-based vulnerabilities, such as the Google Chrome zero-day issue revealed earlier this year, are more complex to exploit than stack attacks.
Integer Overflow Attack
Within the integer length limit, when certain limits are exceeded, the result may be an error or an inaccurate result. An integer overflow attack occurs when an integer is utilized in an arithmetic operation, and the output is a value larger than the integer's maximum size. For example, to hold the number 192, 8 bits of RAM are required. The response 256 will not fit in the allocated memory if the process adds 64 to this number, as it requires 9 bits.
Format Strings Attack
By exploiting string formatting library operations like printf and sprintf to access and edit other memory locations, attackers can affect how an application runs.
Overflow Attacks on Unicode
These exploits make use of the fact that storing a string in Unicode format takes more memory than storing a string in ASCII characters. They can be used against programs that only accept ASCII characters as input.
Buffer Overflows − How to Avoid Them
Buffer overflows can be avoided by including security features into development code, adopting programming languages with built-in protection, and thoroughly testing code to discover and correct mistakes.
Avoiding standard library functions that haven't been bounds-checked such as gets, scanf, and strcpy, is one of the most popular ways to prevent buffer overflows. Another typical way for preventing buffer overruns is to implement bounds-checking at runtime. This ensures that the data pushed to a buffer is inside the proper bounds automatically.
Modern operating systems now include runtime protection, which adds an extra layer of defense against buffer overflows. This contains standard safeguards such as −
Address space layout randomization (ASLR) − Buffer overflow attacks frequently require knowledge of where executable code is placed. This is where address space layout randomization (ASLR) comes in. ASLR shifts around data areas at random to randomize address spaces, making overflow attacks nearly impossible.
Data execution prevention − This method flags memory sections as executable or non-executable, preventing an attack from running code in non-executable regions.
Overwrite protection for structured exception handling (SEHOP) − Attackers may try to overwrite the structured exception handling (SEH), a built-in mechanism for managing hardware and software exceptions. They do this by overwriting the exception registration record stored on the program's stack using a stack-based overflow attack. SEHOP prevents malicious programs from attacking the SEH and exploiting its overwrite exploitation mechanism.
Security measures around development code and operating systems are insufficient to protect an organization's systems. When a buffer overflow flaw is detected, it's critical to fix the software as soon as possible and make it available to all users.
2K+ Views
