On the attack and precaution of buffer overflow

Intermediary transaction http://www.aliyun.com/zixun/aggregation/6858.html ">seo diagnose Taobao guest cloud host technology Hall

What is a buffer overflow

A buffer overflow is when a computer program fills a buffer with data that exceeds the capacity of the buffer itself. The overflow data will overwrite the legitimate data, in general, overwriting the data is meaningless, the most is to let the program execution error, but if the input data is the attacker's effort to build the Intrusion program code, The attacker could then gain control of the program.

Ii. Introduction to the attack mode of buffer overflow

1. Process Control and implantation code;

This attack is more common, when the attack is positioned in a variable that can be overrun, and then passes a string to the program, which changes the Actiation records while the buffer overflow is raised and the malicious code is implanted. Embedding code and overflow is not necessarily done at the same time, you can place code in the buffer, and then migrate the program's pointer by spilling another buffer.

2. Arrange the malicious code in the address space;

If the target code already exists in the program being attacked, simply pass some parameters to the code and then jump to the target code to execute the program execution. Application Example: Some programs have the ability to reset the administrator password, in this way, you can reset the administrator password. Of course this is a small possibility, so there is another way to "implant", when you enter a string into the program to be attacked, the program puts the string in the buffer, which contains data that is the sequence of instructions for the target program. Then the parameter is submitted again so that the program executes the sequence of instructions in the buffer.

3. Control code converted to attack code

By spilling a buffer, you can rewrite the space of the relevant program and pass the authentication of the system directly. The buffer overflow program space for the attack can be any space. However, because different addresses are positioned differently, there are several ways to convert, such as function pointers, records, and long jump buffers.

Iii. Prevention of buffer overflow

In fact, many of the great God in the security community has been worried about this matter, I also simply listed a few, let the master laughed at

1. Write code correctly

This comparison basis, in fact, when writing code, not the program will deliberately make mistakes, but a little bit of error will have serious consequences, so code writing and code audit is extremely important.

2. Array bounds checking

In fact, buffer overflow attacks are pale as long as the array is not overrun. Therefore, in the 1th, the focus should be placed on the log group of Read and write operations check, so that can be achieved, the operation of the program array within the normal, safe range.

3. Program Pointer integrity

In an attack application, the pointer to a program is often used, so to do his change detection when the degree pointer is referenced, so that if the pointer is exploited, the pointer will not be exploited because the system has detected a change in the cursor. Of course, this does not fundamentally solve the problem.