Defense policies against buffer overflow attacks

After learning how buffer overflow occurs, it is very important to prevent hackers from exploiting the buffer overflow attack and controlling your local applications.

Avoid using library files in the Compiler

Programming Languages usually contain library files. If a library file has certain vulnerabilities, any application including the library file will have these vulnerabilities. Therefore, Hackers often try to use known vulnerabilities in common library files to attack local applications.

Library files are also unreliable. Although the latest compilers have begun to add a large number of reliable library files, for a long time, library files have hardly considered the issue of secure coding in order to provide a fast and simple way to complete tasks. C ++ programming language is the most typical representative of this form. The standard library that is dependent on programs written in C ++ can easily generate errors during runtime, this also provides the opportunity for hackers who want to use buffer overflow to attack their ideas.

Verify all user input

To verify all user input on the local application, first make sure that the length of the input string is a valid length. For example, assume that your program is designed to accept 50 text characters and add them to the database. If you enter 75 characters, they enter more than the database can accommodate, so no one can predict the next running state of the program. Therefore, user input should be designed as follows: when a user inputs a text string, the length of the string is first compared with the maximum allowed length, it can be intercepted when the maximum allowed length of a string is exceeded.

Filters out potential malicious input

Filtering is another good defense measure. First look at the ASP code in the following example:

This is the code that filters out HTML code, apostrophes, and quotation marks from user input.

StrNewString = Request. Form ("Review ")

StrNewString = Replace (strNewString, "&", "& amp ;")

StrNewString = Replace (strNewString, "<", "& lt ;")

StrNewString = Replace (strNewString, ">", "& gt ;")

StrNewString = Replace (strNewString ,"","'")

StrNewString = Replace (strNewString, chr (34 ),"''")

The above code is used in the e-commerce website I am currently developing. This aims to filter out HTML code and symbols that may cause database problems. In HTML code, use the "<" and ">" symbols to name an HTML Tag. To prevent users from embedding HTML code in their input, the program filters out the "<" and ">" symbols.

In ASP code, quotation marks, quotation marks, and hyphens are reserved. These reserved symbols cannot be included in user input, otherwise they will cause application crash. For example, if you enter only one marker in a text line and then log on to the database, this command will fail, ASP needs to enclose the text and submit it to the database using the pair marker. ASP does not know how to process the marker in user input. To prevent this, the above Code can find the marker in the input string and replace it.

Test the application

To protect programs from buffer overflow attacks, it has been a long time to verify and filter user input. However, before deploying an application, you still need to thoroughly test it. There should be dedicated people to carefully review the applications and try to crash them. Let them try to enter long strings or reserved characters. If your application has done enough work in writing, it should be able to cope with various situations. If the program crashes, you 'd better find out the problem immediately instead of waiting until it has been applied.