Enforcement of Architectural Safety Guards to Deter Malicious Code Attacks through Buffer Overflow Vulnerabilities

Either in terms of software error or being an attack itself, buffer overflow attacks have been one of the most important security problems accountable for a common vulnerability of software security and cyber risks. Buffer overflow vulnerabilities influence the zone of remote network penetration vulnerabilities, where an anonymous user tries to gain partial or complete control of the host. Buffer overflow attacks liable for some of the biggest data breaches in recent years. One of the notable data breach examples include Morris worm or internet worm of November 2, 1988. Morris worm is an ancient computer worm distributed via the internet, was noted for infecting around 6000 major Unix machines. This paper mainly focuses on buffer overflow attack vulnerabilities and the preventive measures to safeguard once system from being attacked. Keywords – Buffer overflow attack, susceptibility, impediment

Buffer overflow (BO) attacks are one of the most dangerous threats in the area of network security. Methods for detection of BO attacks basically use two approaches: signature matching against packets’ payload versus analysis of packets’ headers with the behavioral analysis of the connection’s flow. The second approach is intended for detection of BO attacks regardless of packets’ content which can be ciphered. In this paper, we propose a technique based on Network Behavioral Anomaly Detection (NBAD) aimed at connectionless network traffic. A similar approach has already been used in related works, but focused on connection-oriented traffic. All principles of connection-oriented NBAD cannot be applied in connectionless anomaly detection. There is designed a set of features describing the behavior of connectionless BO attacks and the tool implemented for their offline extraction from network traffic dumps. Next, we describe experiments performed in the virtual network environment utilizing SIP and TFTP network services exploitation and further data mining experiments employing supervised machine learning (ML) and Naive Bayes classifier. The exploitation of services is performed using network traffic modifications with intention to simulate real network conditions. The experimental results show the proposed approach is capable of distinguishing BO attacks from regular network traffic with high precision and class recall.

Buffer overflow is one of the worst program vulnerabilities. Many preventive approaches are applied to mitigate buffer overflow (BOF) vulnerabilities. However, BOF vulnerabilities are still being discovered in programs on a daily basis which might be exploited to crash programs and execute unwanted code at runtime. Monitoring is a popular approach for detecting BOF attacks during program execution and can prevent the consequences of BOF vulnerability exploitations. However, there is no classification of the proposed approaches to understand their common characteristics, objectives, and limitations. In this paper, we classify the current BOF vulnerability monitoring approaches based on the following five characteristics: monitoring objective, program state utilization, implementation mechanism, environmental change, and attack response. The classification will enable researchers to differentiate among existing monitoring approaches. Moreover, it will provide a guideline to choose monitoring approaches suitable for their needs.

Buffer overflow vulnerabilities in the memory stack continue to pose serious threats to network and computer security. By exploiting these vulnerabilities, a malicious party can strategically overwrite the return address of a procedure call, obtain control of a system, and subsequently launch more virulent attacks. Software countermeasures for such intrusions entail modifications to applications, compilers, and operating systems. Despite the availability of these defenses, many systems remain vulnerable to buffer overflow attacks. We present a hardware-based solution that prevents buffer overflow attacks involving procedure return address corruption. We add a secure return address stack to the processor that provides built-in, dynamic protection against return address tampering without requiring any effort by users or application programmers. Also, the performance impact is negligible for most applications. Changes are not required of application source code, so both legacy and future software can enjoy the security benefits of this solution.

ABSTRACTBuffer overflow attacks are caused due to exploitation of stack or heap in computer memory. One of the targets behind buffer overflow attacks is the return address of a function. Another potential actor in buffer overflow attacks is Global Offset Table (GOT); exploiting it can also lead to disastrous results, such as a call to printf(), which can be transformed to a system() call. This paper focuses on mitigation of stack-based buffer overflow attacks and securing GOT. The proposed approach is a compiler-level protection aimed at preventing such exploits using shadow stacks, a linked list behaving as a stack, that stores the return addresses and frame pointers. The return address and frame pointer are pushed into these stacks during the prologue of every function, and in the epilogue it is compared with the one residing inside actual stack. If they match, the program continues; otherwise, it is terminated and this event is recorded into the system log. To make these shadow stacks invisible from the attacker, the address of the top of shadow stack is stored inside Thread Local Storage (TLS) for the process to refer it later. In order to forestall GOT manipulation, the proposed approach uses a global array which contains the backup of GOT; when a call to GOT entry is made, the value inside that entry and the respective value inside the backup table are compared. If they match, the program continues; otherwise, it terminates the process instantaneously. The proposed approach, Secure Patrol, is efficient, secure against stack-based buffer overflow and resistant to GOT manipulation.

Piromsopa and Enbody (2006) proposed Secure Bit, an architectural approach to protect against buffer-overflow attacks on control data (return-addresses and function pointers). This paper explores the possibility of extending Secure Bit to protect non-control data (variables, pointers and arrays). A hardware bit, provided by Secure Bit, helps preserving the integrity of an associated address. We propose putting a Canary Word adjacent to variables and using Secure Bit to protect the integrity of this word. In this extension, we introduce a new hardware instruction that is used to validate the Secure Bit of an adjacent word. An important differentiating aspect of Secure Bit is that once a Canary Word (data) has been marked as insecure there is no instruction to remark it as secure. Thus, it is theoretically not possible to bypass the mechanism by overflowing the Canary Word with a valid value. Our preliminary study has shown a promising solution to buffer overflow on arbitrary data. Robustness and performance are demonstrated by emulating the hardware, booting Linux on the emulator, running application software on that Linux, and performing known attacks.

Buffer overflow is one of the most common types of software vulnerabilities. Various static analysis and dynamic testing techniques have been proposed to detect buffer overflow vulnerabilities. With automatic tool support, static buffer overflow detection technique has been widely used in academia and industry. However, it tends to report too many false positives fundamentally due to the lack of software execution information. Currently, static warnings can only be validated by manual inspection, which significantly limits the practicality of the static analysis. In this paper, we present BovInspector, a tool framework for automatic static buffer overflow warnings inspection and validated bugs repair. Given the program source code and static buffer overflow vulnerability warnings, BovInspector first performs warning reachability analysis. Then, BovInspector executes the source code symbolically under the guidance of reachable warnings. Each reachable warning is validated and classified by checking whether all the path conditions and the buffer overflow constraints can be satisfied simultaneously. For each validated true warning, BovInspector fix it with three predefined strategies. BovInspector is complementary to prior static buffer overflow discovery schemes. Experimental results on real open source programs show that BovInspector can automatically inspect on average of 74.9% of total warnings, and false warnings account for about 25% to 100% (on average of 59.9%) of the total inspected warnings. In addition, the automatically generated patches fix all target vulnerabilities. Further information regarding the implementation and experimental results of BovInspector is available at http://bovinspectortool.github.io/project/. And a short video for demonstrating the capabilities of BovInspector is now available at https://youtu.be/IMdcksROJDg.

With the rapid development of network technology and the emergence of a variety of applications,network security issues became the top priority of the network applications. This article first explains the concept of buffer overflow,and then from the programming language itself flawed,not robust perspective on the emergence,to the emergence of buffer overflow attacks and principle are analyzed in detail,described hackers using buffer overflow attacks the general process,and according to the type of buffer overflow attacks,software development and program runs from two aspects of proposed buffer overflow attack prevention strategy.

The system buffer overflow (SBO) is a universal problem in information security. In the traditional defence mechanisms, the SBO prevents shell code execution and neglect unsuccessful attack that makes system procedures terminate abnormally. In this loophole, attackers can modify the data structure of the control programme procedure such as the return address or the function pointer and then the system programme procedure will be turned to the code-injection attacks (CIA) or the return-into-libc attacks. In this paper, we propose the memory protector (MP) which is a novel solution to prevent the SBO attack. The MP uses Linux operating system to implement the defence mechanism that will prevent the stack-based buffer overflow attack from the malicious CIA, defect and prevent the zero-day-attack, and keeping memory integrity. In this experiment, we choose Linux operating system (Linux 2.4.21) to implement the defence mechanism that will prevent the stack-based buffer overflow attack from the malicious CIA, defect and prevent the zero-day-attack, and keeping memory integrity.

Buffer overflow is a known attack that exploits the software vulnerabilities by injecting an arbitrary code to gain a full or partial control on the targeted machine. Usually, the attackers target the C/C++ software applications that consist of insecure functions to overfill the buffer and crash that software. Thus, they cause a memory corruption, and run their arbitrary code. Several approaches have been developed to detect the buffer overflow. Those approaches rely mainly on static and dynamic analysis of the source code and generally require expertise in formal analysis and modeling of the source code and in some cases familiarity of binary code analysis. This paper proposes a smart parser that able to detect the C/C++ insecure functions that could be exploited by the buffer overflow attack. The smart parser is expected to be integrated with the early phase of the coding process as to help the software developers to coding their application securely. The smart parser has been implemented using Python and evaluated on five different applications that are written in C/C++ language. Additionally, the smart parser generates a report that shows the numbers and types of insecure functions that are found in each application.

While memory-safe and type-safe languages have been available for many years, the vast majority of software is still implemented in type-unsafe languages such as C/C++. Despite massive concerted efforts by software vendors such as Microsoft to eliminate buffer overflow vulnerabilities through automated and manual code review, they continue to be found and exploited. We present a novel approach that accepts the existence of overflow vulnerabilities and uses parallelism available through current and future multi-core architectures to detect vulnerabilities by monitoring the parallel execution of several slightly varying instances of the same application. During regular execution each instance performs equivalent computations. When an attacker attempts to inject an attack vector through a buffer overflow vulnerability, however, each instance reacts differently due to the variances we introduced into each instance. We describe our prototype implementation of such a parallelism-based buffer overflow detection system and demonstrate that it is capable of stopping buffer overflow vulnerabilities using actual exploit codes for the popular Apache Web server. The experimental results show that the runtime overhead of our parallel execution framework is less than 10% on average.

Buffer overflow attack is the main attack method that most if not all existing malicious worms use to propagate themselves from machine to machine. Although a great deal of research has been invested in defense mechanisms against buffer overflow attack, most of them require modifications to the network applications and/or the platforms that host them. Being an extension work of CTCP, this paper presents a network-based low performance overhead buffer overflow attack detection system called Nebula 1 NEtwork-based BUffer overfLow Attack detection, which can detect both known and zero-day buffer overflow attacks based solely on the packets observed without requiring any modifications to the end hosts. Moreover, instead of deriving a specific signature for each individual buffer overflow attack instance, Nebula uses a generalized signature that can capture all known variants of buffer overflow attacks while reducing the number of false positives to a negligible level. In addition, Nebula is built on a centralized TCP/IP architecture that effectively defeats all existing NIDS evasion techniques. Finally, Nebula incorporates a payload type identification mechanism that reduces further the false positive rate and scales the proposed buffer overflow attack detection scheme to gigabit network links.

Buffer overflows remain the leading cause of software vulnerabilities in the world of information security. The proposed segment-based non-executable stack approach aims to prevent the injection and execution of arbitrary code in an existing process's stack space under Windows NT/2000 and Intel 32-bit CPUs. The application's user-mode stack is relocated to the higher address and the effective limit of the code segment excludes the relocated stack from the code segment. The segmentation logic of IA-32 processors monitors the accesses to the memory ranges and a page fault is generated if instruction fetches are initiated in the stack memory pages. It is highly effective in preventing both known and yet unknown stack smashing attacks.

Nowadays, most wireless communication modules are built based on ARM-based chips. Buffer overflow attack (BOA) is one of the mainstream runtime intrusion on the ARM architecture. However, so far there are few reports on evaluation of the intrusion prevention capability of ARM-based operating systems from BOAs. To provide with such evaluation, in this paper, first, the Runtime Intrusion Prevention Evaluator was implemented on ARM-based operating systems, which we called RIPE-ARM, where 850 kinds of effective BOAs are integrated. Next, using the QEMU virtual machine, we set up an ARM-based system, Raspberry Pi, for the evaluation. Then, the RIPE-ARM was used to test and evaluate the intrusion prevention capability of Raspberry Pi. The kinds of BOAs that each defense or defense combination can successfully prevent were identified, respectively. We found that among all these defense methods, there is one combinational method turns out to be optimal that is able to make 840 of the total 850 kinds of attacks fail. Also, the results show that there are ten BOA kinds that no defense can mitigate. Those kinds are presented in details.

Buffer overflow attacks cause serious security problems. Array & pointer bound checking is one of the most effective approaches for defending against buffer overflow attacks when source code is available. However; original array & pointer bound checking causes too much overhead since it is designed to catch memory errors and it puts too many checks. In this paper, we propose an efficient array & pointer bound checking strategy to defend against buffer overflow attacks. In our strategy, only the bounds of write operations are checked. We discuss the optimization strategy via hardware/software and conduct experiments. The experimental results show that our strategy can greatly reduce the overhead of array & pointer bound checking. Our conclusion is that based on our strategy, array & pointer bound checking can be a practical solution for defending systems against buffer overflow attacks with tolerable overhead.