Responsibility is Everyone's Job

The software developers constantly talk about responsible disclosure.

Responsible disclosure is basically defined as informing the software developer of a vulnerability so that the vulnerability can be researched and fixed. This is compared to full disclosure where the vulnerability is announced to everyone without giving the software developer a chance to fix the vulnerability. Contrast this with the economic pressure for a software developer to reveal a vulnerability, which is none.

The spectrum consists of Full Disclosure (tell everyone), Responsible Disclosure (tell the developer), and Non-Disclosure (tell no one). Without going into details suffice it to say the responsible disclosure is currently mainstream.

The question is how the developers handle fixing the vulnerability. The general thought is that a responsible company would put resources into fixing these as soon as possible, but these comercial developers are, for the most part are in business to make a profit. I am not including open source developers in this post.

Now for two examples of how Microsoft has handeled responsible disclosures.

The ANI exploit, which I wrote about in Vista Smista& ANI Exploit. The vulnerability was disclosed in December of 2006 and not fixed until exploits where released in March. An quote from my previous blog is below and more details are in my other post mentioned above:

In short this was disclosed to Microsoft in December of 2006. Apparently the first report of this vulnerability was used as an exploit was March 28th. Due to the wide spread use of the exploit several third parties released interim patches... Microsoft
reacted, as it tends to do when third party patches are released, and the news
media starts to publish... Microsoft released the official patch out-of-cycle on
Tuesday the 3rd of April (instead of today the 10th of April).

Just recently, the end of May 2007, a vulnerability in Microsoft Web Server IIS 5.X where authentication can be bypassed, was announced. However this vulnerability was discovered December 15th 2005 (no this is not a typo) and was subsiquently responsibly disclosed to Microsoft. Apparently Microsoft finally decide to publically disclose the vulnerability, but without a fix. Unless you consider paying for an upgrade to Windows Server 2003 and IIS 6.0 a patch.

Keeping in mind thath these are just two examples where:

1. Microsoft failed to fix a known vulnerability for several months until an exploit was released.
2. Kept a vulnerability secret for over a year and then releases the information and requires a paid upgrade to the latest code for a fix.

I think Microsoft should re-evaluate their responsibilities as a good citizen or netizen.

When Google isn't Google: Google-analytics Compromised

It has been reported the the popular Google Analytics has been compromised. The details are in the ISC Diary Entry titled Google Counter ... isn't.

What this means to the average user is that any web site that uses Google Analytics, and there are more than a few that use this free service, will attempt to infect your computer.

Wat is the average user to do? Disable javascript and break most web sites? Which is almost like putting bars on your windows and refusing to leave the house.

Well it isn't a secret what I do I use Firefox and the noscript extension as my main defense against this. I normally leave anything not required for accessing a site, including Google Analytics, disabled. I was initially surprised by the number of javascripts attempting to run from sites I had not directly connected to. I would describe this as checking who a visitor is bringing with them when they want to visit my house.

sites that where used to See "Drive by What?" for my latest blog entry on the subject, or check here for all my references to noscript.

Windows Please Phone Home!

I have talked about patching a few times.

I have also discussed how I have found Microsoft Windows systems that where configured for automatic downloading of security patches, but where not patched in Cup of Hot Cocoa: Patch Warfare II.

Now it appears that Microsoft has taken notice and has released patches to fix the problems with the automatic updates, and manually using Microsoft and Windows Update sites for that matter which is great, but except for an announcement on their blog (Welcome to the Microsoft Security Response Center Blog!) it has received very little fanfare. See Two Advisories on Non-Security Updates for details.

Now the scary part is that it is being distributed be the very mechanism that it is designed to fix. If a PC is not getting updates due to the problems these updates fix, then the system will not get the fix! Now to compound the problem these fixes are distributed separately and each one requires a reboot.

In other words the broken update mechanism must download and install the first update. Can you say if your internet connection is down please visit our web site to report a problem... or how about please cal the phone company if your phone is not working...

Then it has to do the same thing for the second update!

Now if Microsoft wanted to be a good internet citizen they would announce this all over the place and encourage users to visit the update sites to download these manually or if that fails to directly download them per the knowledge base articles: Microsoft Security Advisory (927891) and Microsoft Security Advisory (937696).

Drive by What?

It used to be that that you could avoid certain types of sites and avoid most malware. Add a good antivirus software are you where pretty safe. Not any more just about any site can be used for drive-by-downloads.

Now even major sites can participate in spread infections just by displaying advertising. The dark side submits an ad that downloads malware by just viewing the ad on a site.

This has become so common that Brian Krebs, of Security Fix fame, wrote an article about it called Cyber Crooks Hijack Activities of Large Web-Hosting Firm. Where it discusses a web hosting provider that has literally hundreds of infected host sites, and the site owners don't even know that their sites are infected.

Even Google discusses it in their new security blog with their initial post Introducing Google's online security efforts.

Alas we are not completely helpless. I have mentioned Noscript before and I will continue to recommend it to enhance your control over what runs on your computer.

I will also mention an anti-malware tool from eEye that I recently discovered called Blink that is currently free for personal use in North America.

eEye Digital Security is offering Blink Personal Internet security with Antivirus for free as a 1-year subscription in North America.

If you are outside of North America, as of the time I write this, the price is $24.95 for one computer and $29.95 for three (3) computers. I have found this to be quite effective without causing performance issues.

Videos

Who knows you better than your peers?

It seems that there was a contest for university students to create videos to increase awareness of computer security among university students.

The contest was conducted by the EDUCAUSE/Internet2 Computer and Network Security Task Force, the National Cyber Security Alliance, and ResearchChannel.

Even though the intended audience is college and university students the videods are entertaining and educational for other audiences. I suggest you check the out the videos here.

Enemy of the State RFID Style?

The Plot

Back in November of 1998 the movie Enemy of the State was released starring Will Smith as the harassed citizen that was tracked with every asset the government had including satellites. While I do not claim to have access to any details of what the theses satellites can do I can make a few statements safely.

1. No one casually moves satellites between orbits. Simply put they have a limited amount of fuel and once it is used there are no satellite fuel stations that you can stop by for a refill.
2. There would have to be a compelling reason to track on person with satellites. As I understand it they are constantly in use and the scheduled activities are not casually changed especially on a moments notice.
   

Now to look at current technology and trends could currently deployed and developing technology and how it could be abused. While I want to "set the stage" a little bit I will be directly discussing RFID and its ability to be used/abused.

Video Surveillance

Lets start with the most obvious.The UK with its attempt to monitor everything via camera. While I'm not a UK citizen I have been "watching" this from the sidelines. First as far as I can tell there are no laws covering the who can view/use the videos captured, how long they are retained, or how they are disposed of. While this may not seem to be a big deal with evolving technology, and apparent lack of controls.

Imagine, if you will, someone digitally changes a video to put you, or a now well known political, in compromising situation. With out proper defined controls this could ruin a political career. If I am correct that there are no laws controlling the videos captured this should be addressed.

Tagging History & Evolution

Radio Frequency Identification (RFID) is all the rage. It is being used everywhere and for many purposes. The first "killer application" was for inventory. Simply tag all the inventory and using simple equipment get a fast accurate inventory with minimal costs. Virtually 100% accurate virtually 100% of the time.

Anyone that works with inventory knows that there are always inconsistencies like who forgot to remove the RFID tag from the do nit inventory (DNI) items.

Once this became ubiquitous it was a "no-brainer" to use it for anti theft. Once an item is sold it is marked as "clear to pass" the anti-theft devices at the doors, of that store. then you go into the next store and their anti-theft goes off. The tag wasn't cleared in the next store's system. Apparently unknown tags alert in case items have not been inventoried yet. This creates many false positives, AKA "The Boy that Cried Wolf." In summary a shoplifter could make one "token" purchase at the mall then not worry about any anti-theft devices after that.

Tag You're it

Now if it works so wee for tracking things what about people? The US and UK government think it is great. You can embed encrypted information including a digital picture of the person in the passport and you have decreased the problems with fake passports. At what costs to the average citizen?

The University of Washington demonstrated using the Nike+iPod Sport Kit's RFID can be used to track people and that doesn't have any personal data on it. All RFID tags have unique information and no two match unless they are cloned the is, but more on that later.

If a simple RFID tag can be used to track you how simple would it be to track someone with an RFID passport?

Wait isn't there a limited range to read the ones in a passport?

Yes and no. While the RFID tags have limited power there are two other ways to increase the rang the tag can be read from.

• Using a bigger antenna
  
• Using a directional antenna
  

What about the encryption?

...but the information is encrypted. Yes and nothing prevents the encrypted data from being cloned. The first documented attempt took the hacker 2 weeks and and it only takes about $200 in equipment.

So what you say. Well if a standard RFID can be used to track you then the cloned RFID information can be used to track you, and know that it is you. Eventually the dark side will learn to break the encryption and be able to create their own fake passports.

RFID and CCTV

Tie RFID tracking in with surveillance cameras and you can be tracked and monitored easily...

AOL Password Warning: Time to Change Your Password?

I try to avoid posting what everyone else is posting, but this case is special. Due to the number of AOL users I'm going to post this brief message and link to the original post.

Brian Krebs posted AOL's Password Puzzler on his Security Fix Blog yesterday May 5th. In short even though AOL allows passwords up to 16 characters it *only* uses the first 8 characters. I'll be the first to admit that there are other systems that have an 8 character limit, but these are well known and documented. *Not hidden away*!

As Brian points out in his post people have a habit of using their names as their password, but may add some extra characters on the end such as:

• tomsmith1
• tomsmith#1
• tomsmithGr81

Simply typing in tomsmith will work without a complaint.

Even with a more complex password it is considerably less time consuming to break an 8 character password than a 16 character one. As far as I know all, non dictionary, brute force implementations of password crackers sequentially add characters to their attempts. In other words trying to break an password that is 2-16 characters will first try all 2 character combinations then move on to 3 characters...

AOL is a big company and a fix for this will take time. Even if AOL could change it tomorrow how many people would be locked out of their account? Consider anyone with a password longer than 8 characters trying to login would fail since only 8 characters are stored... I suspect the fix will be a new implementation of the password back-end and a new front-end to migrate users to the new infrastructure, but only time will tell.

UPDATE: In case anyone is looking for information on good password generation/selection or password tools I did a couple of previous posts on these: Anatomy of a Password and Password Tools. All of my posts on passwords, including this one. are here.

Olympic Sized Ego

Picture this:

Security Bozos are happy to welcome you to the 2012 Olympics. Please excuse us while we limit the size of your drinks, run you through bomb detection equipment, search your belongings and in general disrupt your ability t0 enjoy the games. Please note that there will be a number of winners that will receive full body cavity searches.

Or this:

The 2012 Olympics are brought to you by [put major soft drink here] and [put major athletic shoe maker here]. Please remember for faster entry and bypassing the normal security checks pre-order either a case of [put major soft drink here] and [put major athletic shoe maker here] on line for pickup at the Olympics. Please present your receipt to the security guards for expedited entry into the games.

What is all this babble about? It has been decided that Security for the the 2012 Olympics will be provided by a Major sponsor of the 2012 Olympics. The incredible arrogance.

• What real security company would buy their way into the job and provide acceptable security?
• What previous sponsor has any clue on how to provide security for an event of this size?

The Dark Side

Now that I talked about the Internet culture in general in Out of the Mists of Antiquity... I will discuss the inevitable dark side,

In the beginning there trust and sharing, but alas this was not paradise, just another place for humans to interact.

One of the earliest, and well know, examples of the dark side is the flame war. This is the term given when two or more parties disagree on a topic and the "discussion" becomes heated. Per Goodwin's Law a lengthy flame ware will end up with at least one Nazi. A few factors seem to be a major cause of these wars:

1. Anonymity - when no one knows who you really are some people will say things that would not in a face-to-face situation.
2. Lack of body language can cause misunderstandings. Somewhere I read an article on a study that boiled down to about 80% of the time we assume we know the "tone" of written communication, but in reality we are only right about 10% of the time.
3. Until recently with digital recording devices something spoken virtually disappeared once it was spoken, but once something is typed it is, or can be, saved word for word. Hence the old adage of don't e-mail or send a message that you wouldn't want printed in the newspaper.

Now on to what everyone thinks of as the real dark side hackers. In the early days a hacker was someone of great skill and ability a hacker could create a short powerful script or program in a short time and get something useful done with it. One of the most famous, and politically active, of these is Richard M. Stallman. Many would consider him eccentric, but consider his article originally written in 1997 titled The Right to Read where there is no such thing as a library and scholars require government reading grants to be able to afford the fees for research... talk about derailing scientific discovery.

The natural curiosity of these hackers lead to exploring systems they where not granted access to. Thus the cracker was born.

NOTE: To the purest calling a cracker a hacker is like calling a sniper a marksman.

Some of the people breaking into systems began leaving began signs that they had been there by destroying or damaging files and the most visible of these being web site defacement. The hey I'm cool look what I did phase. Web site defacement while still done is not where the dark side is concentrating the motivation has changed from fame to financial gain.

One of the easiest, most entertaining, ways to understand this is through the "Stealing the Network" Series by Syngress. This series contains fictional short stories written by well known security experts that are technically accurate unlike the depictions shown in movies.

Stealing the network: How to Own the Box shows the "cottage industry" stage of the early crimes for profit.

The subsequent titles move in to the more sinister organized crime stage that we are currently experiencing, while still staying technically accurate. The books, in order, are: Stealing the Network: How to Own a Continent, Stealing the Network: How to Own an Identity and Stealing the Network: How to Own a Shadow.

I personally recommend the entire Stealing the Network series.

Out of the Mists of Antiquity...

The only way to really understand something is to go back to the beginning, and the dark side of the Internet is no different. Without light there can be no dark so that is where I'll start.

In the beginning there was ARPANET (Advanced Research Projects Agency Network) which begat the Internet.

First understand that in sharp contrast to the standard mainframe centric standard of the day (1960s) one of the main requirements was that it should be able to sustain 80% failure and the remaining portion or portions had to continue to function. The original project was designed by university students, and in order to document standards, but not offend the professors, the new standards became know as RFCs or Request For Comment.

From these humble origins sprang Richard Stallman, Open Source, VoIP, peer-to-peer (P2P) networks, and the Internet we know and love.

Much of the culture remains a mystery to the majority of the world, even those that participate in it.

There are a few books that help understand the culture.

One of these is The Wisdom of Crowds by James Surowiecki. This book gives evidence that averaging the responses of a group of average people can be more accurate that a single or small group of experts. While this concept is counter intuitive, an least to me it was, Mr Surwiecki provides evidence to back theory.

Another is The Starfish and the Spider: The Unstoppable Power of Leaderless Organizations by Ori Brafman and Rod Beckstrom. Here the authors show how decentralized organizations can overwhelm centralized entities. As an example take Napster and it's descendants...

And this last one may be surprising, but I submit Blink: The Power of Thinking Without Thinking by Malcolm Gladwell as well. Anyone that has ever know something without knowing why has experienced this. I submit with the anonymity of the Internet more people are following their "instincts" with out fear of ridicule.

Next I'll use the light provided here to explore the dark side

Licensed to SPAM by Uncle Sam

Shame on me after complaining about MS and their marketing hype, on the other had you can start sending SPAM to one of the lesser know TLA governmental agencies.

Now getting serious the Securities and Exchange Comission (SEC) wants pump and dump SPAM forwarded to them.

The Internet Storm Center (ISC) has a diary entry here that contains additional information and information about other non-US governmental agencies that are asking for the offending pump-and-dump SPAM be sent to them.

The One, The Only, The Vulnerable Vista

Lets start this out by saying that Vista was designed to be more secure, and it appears to be headed in the right direction there. Just don't get me started on DRM.

Once again Vista, the impenetrable, that is according to the marketing hype has been proven vulnerable. There was the ANI vulnerability that MS rushed a patch out for last week, and now during the regular update there is a second vulnerability designated as critical by MS for Vista.

Once the all the hype is removed it is just another operating system by Microsoft that has it's flaws. Once is has had time to mature I'll consider adding it to one of my systems. For now I'll only "play" with it as a virtual machine.

Vista Smista & ANI Exploit

OK, I've gotten it out of my system. I'm not a fan of Vista I have two main issues in regards to Vista:

1. The fact that Digital Rights Management (DRM) has some control over my system, and can degrade or disable viewing "premium content" when someone else feels that there is a potential for me to steal premium content. I'd call that guilty unless proven innocent.
2. Then there is the marketing, I shouldn't call it scam, hype that Vista in invulnerable.

Issue 1 has been beaten to death by many people including myself.

For issue 2 I'll mention Microsoft Security Advisory (935423). This was commonly referred to as the Microsoft ANI vulnerability, and Vista was one of the version that was vulnerable.

ANI Details

In short this was disclosed to Microsoft in December of 2006. Apparently the first report of this vulnerability was used as an exploit was March 28th. Due to the wide spread use of the exploit several third parties released interim patches, including my favorite Zeroday Emergency Response Team (ZERT). Microsoft reacted, as it tends to do when third party patches are released, and the news media starts to publish... Microsoft released the official patch out-of-cycle on Tuesday the 3rd of April (instead of today the 10th of April)

Malware the New Common Cold

Everyone has had a cold and everyone will continue to get colds. Science, and your doctor, have tried to eradicate the common cold, but to no avail.

Why are we still saddled with the common cold. Lets go to the root cause, which is, excuse me, are viruses, and by viruses I mean uncountable millions. Common cold viruses are so numerous that no one has attempted to even count them, common cold viruses can literally appear and die off or mutate into a different strain without anyone knowing.

In the old days viruses where unique digital organisms that would appear and never change. After a while viruses would "mutate into sever distinct strains, as their original creator or another entity made changes.

Nowadays malware writers cross-pollinate between different malware code attempting to create the uber malware. Then there was the so called storm worm which spread through a barrage or constantly changing e-mails with different intriguing subject lines and different executables.

The bottom line is that malware is here to stay with us for the foreseeable future, and just like real life there are some times where we must take extra care to avoid infections.

Its a Cold Day on the Internet

No this is not an April fools joke.

Once again the dark side has come out with a nasty, and this one is so bad that the Internet Storm Center (ISC) has raised the threat level to Yellow which ISC describes as:

We are currently tracking a significant new threat. The impact is either unknown or expected to be minor to the infrastructure. However, local impact could be significant. Users are advised to take immediate specific action to contain the impact. Example: 'MSBlaster' worm outbreak.

More information about the various levels are here.

In a nutshell MS has released an advisory 935423 also know as CVE-2007-0038, and before that as CVE-2007-1765. The issue is that animated cursors, yes those cute things, and be used to install malware and compromise your computer. Don't think that just because you don't see a change to your cursor that it has not happened (they can use the same visual effects as standard, and infect your computer).

What I find maddening is that this vulnerability was first reported to MS back in December 20, 2006, MS skipped last months updates and there is no patch from Microsoft yet. I will note that there was no evidence of the vulnerability being exploited until recently, but way to go MS.

Now there is a patch available from Zeroday Emergency Response Team (ZERT) which is detailed here. Personally I'm using it and have used their patches in the past when MS has been slow to get an official fix out for a really nasty, shall I call it a malware epidemic.

ZERT is not know for casually creating unofficial patches, but was formed by a group of well known security experts to provide a quick response for nasty widespread zeroday exploits.

UPDATE: I just ran across the following information posted on April 1st, but it appears to be real. MS is apparently planning on releasing a patch for this a week early on April 3rd announced o their security blog, and on their Microsoft Security Bulletin Advance Notification. This appears to be the truth and not a April Fools joke. I will not that this states planned, and this is not the first time that a third party patch has embarrassed MS into releasing a security patch out-of-cycle.

No this is not an April fools joke.

Another Cup of Cocoa: Responsibility

MySpace, YouTube, Web 2.0 there is so much happening and available out there. It is all exciting and there are so many possibilities opening up.

The freedom of the Internet and web works both ways. The same technology lets you explore web sites on the other side of the world allows anyone in the world to attack your system and steal from you.

In the real world people choose where to go and can avoid areas where the "criminal element" tend to hang out, or if in a less reputable neighborhood one can always be aware of the surroundings. On the Internet it isn't quite as intuitive, but there are steps that should be taken.

First everyone must take responsibility for them selves. Just like when we lock our doors and put safety belts on in the car.

As stated before hardware firewalls, software firewalls, and anti malware software should be installed and kept updated.

Mcafee Site Adviser works on both Internet Explorer and Firefox and can provide a warning when you wander into a "bad" site, and better yet will post warning on Google search listings to warn you prior to an actual visit.

Javascript has contributed greatly to the look and feel of the web today, but while many sites use it on many it is not necessary. Javascript is so powerful that it is used for malicous purposes as well including drive-by-downloading. With Internet explorer script control is an all or nothing option turn it on for a site or turn it off for the site. Firefox with the NoScript add-on allows more granular control and allows controls within the web page.

Stay tuned for the next Cup Of Cocoa post about "sand boxing" to help contain malware. Until next time remember:

In view of all the deadly computer viruses that have been spreading lately, Weekend Update would like to remind you: when you link up to another computer, you're linking up to every computer that that computer has ever linked up to.
— Dennis Miller

A Travel Cup of Hot Cocoa: Defense in depth

Everyone likes to keep their hot Cocoa hot. So travel mugs are insulated, and have a lid to help keep it hot. Yes it keeps it in the mug as well, but you can argue that keeping more in the mug helps keep the heat in ;-)

Which brings me to the topic at hand defense-in-depth for the PC.

If it was made by man, it can be hacked and cracked by man.
- Anonymous

Absolutely nothing is foolproof! On the other hand several good defenses layered will slow down or dissuade an attacker.

Hardware Firewall

A hardware firewall configured to only allow outgoing traffic and responses to the outgoing traffic. Fortunately this is the default. Any wireless should be configured for security, which is not the default. You don't want your neighbor unintentionally, or intentionally, causing you harm. Then there are the war drivers looking for free access or anonymity while committing crimes, that point back to you.

Software Firewall

Yes this should be running even if it is not a laptop that travels outside your network. One area of concern with Windows firewalls. For ease of use and compatibility there is much greater trust on the local network that could be used against your machine while you enjoy your Cup of Cocoa at the local WiFi hotspot.

Anti-Malware

Both anti-spyware and anti-virus should be running and kept up to date.

Windows work Both Ways

The average web browser shows off the babels of the internet, but at the same time, by default and for your viewing pleasure, lets remote sites into your computer.

Internet Explorer is infamous for being the weak link used by many exploits. Firefox has a better default security stance, but is not perfect. Firefox also has a quicker response for security fixes.

Mcafee Site Adviser (http://www.siteadvisor.com) will flag sites that can cause grief if visited. It has an icon that shows the current site rating, and access to the details available. Additionally google searches will show the site adviser graphic next to each search result.

There is still has a free version and is available for no cost. There are plug-ins for both IE (http://www.siteadvisor.com/download/ie.html) and Firefox (http://www.siteadvisor.com/download/ff.html)

NoScript (http://noscript.net/) is a Firefox add-on that provide granular control to scripts. IN a nutshell any web page that is visited may pull content, and scripts from other web sites and servers. Without NoScript there are only two options are allow all scripts on the page, or do not allow any scripts. NoScript allows or disallows scripts based on URL. It is quite flexible and even allows temporary rights to run scripts, in addition to white listing and black listing.

NoScript (http://noscript.net/) is highly recommended.

Credit vs. Debit

Is a credit card better than a debit card, or vise-versa.

In the US the credit card wins hands down, by federal law the credit card is responsible for fraudulent charges to your account. No such protection for debit cards exist, even if they are used as a "credit card."

A short, and unfortunately true, story to illustrate the issues with a debit card.

A man goes through a fast-food drive through and pays with his debit card. The cashier hands back his debit card, which is put back into his wallet for safe keeping.

The next day the man receives a call from his bank. His account is over drawn by several hundred dollars. After a brief discussion it becomes apparent that there where multiple purchases made with his debit card after the man nused his card at the fast food drive through window.

The bank explains that the card was stolen, the man disagrees, but finally takes his card out of his wallet. Right bank debit card, but not his name or number. It is a card reported stolen. The cashier at the fast food place switched the cards...

An expensive way to learn that debit cards are not protected by law.

Best Practices:

• Only use your debit card at your banks ATM.
• Use your credit card for purchases.
• Your spouse or significant other should use a credit card with a different account/card number* on it.

* Most banks will issue a different card number for each card issued for an account. This allows tracking who spent what, and replacing one lost or stolen card while still being able to use the other card(s).

The Band-aid Approach

There was a comment posted asking why I was against the approach of shuffling buffers around in my post entitled Exploit Longevity (http://sec-soapbox.blogspot.com/2007/03/exploit-longevity.html).

Before I can answer I need to make sure that we have a common understanding of buffers and buffer overflows.

What is a Buffer?

A buffer is a portion of memory where a program stores information that changes. Every time a web site address is typed into a web browser the address is stored in a buffer.

What is a Buffer Overflow?

Buffers do not have an unlimited size, and that fact can be exploited. By providing too much information to the program and overflowing the buffer. When a buffer is overflowed one of two things happen the program crashes or runs what the perpetrator wants it to.

When the program crashes that is a Denial of Service (DoS) attack.

When the program executes what the attacker intended that is an exploit. For a little more meat, e.g. technical explanation. The attacker will usually uses a series of NoOp* instructions to create a "NoOp slide"before the exploit code. Once the program tries to execute the code that was after the buffer it will "slide down" the NoOps to the exploit.

Is Moving the Buffer a Cure?

Consider finding out that someone with the right tool, a "slim jim," can open your car door and steal the car. The manufacture sends has all the cars modified to move the "weak link" over 5 inches, but not protect it. Since everyone knows the fix it simply takes car thieves a short time to adjust and continue stealing cars.

Of course its different with software patches... Not.

For the exploiter the patch is simply the instruction manual for finding the new location of the buffer.

In essence this type of patch is a band-aid not a cure.

* A single byte machine code that performs no operations. Originally used to remove code from machine code with out having to rewrite major portions of the program.

What is a buffer overflow

What prevents a buffer overflow

Why moving a buffer isn't a fix

With securely written programs buffer overflows can't happen.

Exploit Longevity

Ever notice how some exploits just seem to stay around forever?

There is actually a simple, but in my opinion ugly, explanation for this. As usual an example can be worth a thousand words, and I’m going to use rpc18.c as an example:

//////////////////////////////////////////////////////
//
// Windows RPC DCOM Remote Exploit with 18 Targets
// by pHrail and smurfy + some offsets by teos
//
// Targets:
// 0 Win2k Polish nosp ver 5.00.2195
// 1 Win2k Polish +sp3 ver 5.00.2195
// 2 Win2k Spanish +sp4
// 3 Win2k English nosp 1
// 4 Win2k English nosp 2
// 5 Win2k English +sp1
// 6 Win2k English +sp2 1
// 7 Win2k English +sp2 2
// 8 Win2k English +sp3 1
// 9 Win2k English +sp3 2
// 10 Win2k English +sp4
// 11 Win2k China +sp3
// 12 Win2k China +sp4
// 13 Win2k German +sp3
// 14 Win2k Japanese +sp2
// 15 WinXP English nosp ver 5.1.2600
// 16 WinXP English +sp1 1
// 17 WinXP English +sp1 2
// 18 WinXP English +sp2
//
/////////////////////////////////////////////////////////

Notice targets 3-10 are all English versions of Windows 2000 and 16-18 are all Windows XP. Now each target has a different patch level so it must be exploiting the exact same issue, but wait there is more. The next section below shows the offset where the exploit is located.

The text on each line in quotes is the location where the exploit is located in the program. The troubling issue is that for each patch level the location has changed. In other words instead of fixing the problem with the patch the location of the vulnerability is moved, and obviously, as rpc18.c shows, this is not an effective method.

/* Myam add OFFSETS*/
char win2knosppl[] = "\x4d\x3f\xe3\x77"; /* polish win2k nosp ver 5.00.2195*/
char win2ksp3pl[] = "\x29\x2c\xe4\x77"; /* polish win2k sp3 - ver 5.00.2195 tested */
char win2ksp4sp[] = "\x13\x3b\xa5\x77"; /* spanish win2k sp4 */
char win2knospeng1[] = "\x74\x16\xe8\x77"; /* english win2k nosp 1 */
char win2knospeng2[] = "\x6d\x3f\xe3\x77"; /* english win2k nosp 2 */
char win2ksp1eng[] = "\xec\x29\xe8\x77"; /* english win2k sp1 */
char win2ksp2eng1[] = "\x2b\x49\xe2\x77"; /* english win2k sp2 1 */
char win2ksp2eng2[] = "\xb5\x24\xe8\x77"; /* english win2k sp2 2 */
char win2ksp3eng1[] = "\x7a\x36\xe8\x77"; /* english win2k sp3 1 */
char win2ksp3eng2[] = "\x5c\xfa\x2e\x77"; /* english win2k sp3 2 */
char win2ksp4eng[] = "\x9b\x2a\xf9\x77"; /* english win2k sp4 */
char win2ksp3chi[] = "\x44\x43\x42\x41"; /* china win2k sp3 */
char win2ksp4chi[] = "\x29\x4c\xdf\x77"; /* china win2k sp4 */
char win2ksp3ger[] = "\x7a\x88\x2e\x77"; /* german win2k sp3 */
char win2ksp2jap[] = "\x2b\x49\xdf\x77"; /* japanese win2k sp2 */
char winxpnospeng[] = "\xe3\xaf\xe9\x77"; /* english xp nosp ver 5.1.2600 */
char winxpsp1eng1[] = "\xba\x26\xe6\x77"; /* english xp sp1 1 */
char winxpsp1eng2[] = "\xdb\x37\xd7\x77"; /* english xp sp1 2 */
char winxpsp2eng[] = "\xbd\x73\x7d\x77"; /* english xp sp2 */