Memory Corruption
General considerations
Abandon C and C++!
- The Urgent Need for Memory Safety in Software Products by CISA (September 2023). "In what other industry would the market tolerate such well-understood and severe dangers for users of products for decades?"
- The Case for Memory Safe Roadmaps (Why Both C-Suite Executives and Technical Experts Need to Take Memory Safe Coding Seriously) by CISA, NSA, FBI, Cybersecurity agencies of several countries (December 2023). An excellent technical summary.
- Future Software Should Be Memory Safe Office of the National Cyberdirector - The White House (February 2024). Just to emphasize the relevance of this issue.
- Secure by Design: Google’s Perspective on Memory Safety (March 2024) Very interesting. It describes memory safety issues in a rigorous and systematic way. Furthermore, since "we will likely be operating a very substantial C++ codebase for quite some time", it also describes the Google strategy for coping with this very difficult problem in the next years.
Statistics
- Introduction to Memory Unsafety for VPs of Engineering Links to statistics for different platforms and for 0-days.
- Trends, challenge, and shifts in software vulnerability mitigation Microsoft presentation at BlueHat 2019. Very interesting data and statistics over a decade.
- Memory Safety in Chromium More than 70% of "serious security bugs" are memory safety problems.
- USENIX Enigma 2021 - Quantifying Memory Unsafety and Reactions to It Interesting statistics on the prevalence of memory safety vulns across all vulns in different platforms (including 0days),
- Memory Safe Languages in Android 13 Android 13 is the first Android release where a majority of new code added to the release is in a memory safe language. While correlation doesn’t necessarily mean causation, it’s interesting to note that the percent of vulnerabilities caused by memory safety issues seems to correlate rather closely with the development language that’s used for new code. To date (1/12/2022), there have been zero memory safety vulnerabilities discovered in Android’s Rust code.
- Secure by Design: Google’s Perspective on Memory Safety (March 2024, mentioned above).
Technical
Memory management and function calling
- Slides and textbook chapter from Computer Security at Berkeley (CS161)
More in depth
- Slides and textbook chapter from Computer Security at Berkeley (CS161). Discusses format string and integer conversion vulnerabilities.
- Slides on memory corruption from Software Security at Radboud University (prof. Erik Poll). Discusses format string and integer conversion vulnerabilities (as well as many subtle C bugs).
- A short video explaining how to write an exploit for a toy application: a C program (compiled and run without any mitigation) where a password is read with
gets()
. By overflowing thepassword
variable, execution flow bypass the password check (stack smashing, code reuse; no shellcode is injected). It provides an idea of how to determine the correct address values to overwrite on the return address on the stack. Running this toy example requires disabling stack canary. - Handout Slides on Security from Cambridge University (2020-2021). Much material on various topics, including memory safety vulnerabilities examples and mitigations.
- An Introduction to Exploit Reliability A big consideration when you're writing exploits professionally is exploit reliability: a measure of an exploit's failure rate. If your exploit is 100% reliable, you know it's always going to succeed. If it's 90% reliable, then your exploit will fail in one in ten cases, and so on. Take a look at the CISA KEV database or the CISA/FBI most exploited CVEs list -- most of the issues listed are not memory corruption vulnerabilities. Instead, we commonly see logic issues like command injection, path traversal, and deserialization bugs, all of which typically have extremely high exploit reliability.
Some fundamental papers
- Smashing the stack for fun and for profit "the" reference, written in 1996.
- Smashing the Stack in the 21st Century A look from 64-bit architectures (not considering mitigations)
- SoK: Eternal war in memory: a 2014 paper that "systematizes the current knowledge about various protection techniques by setting up a general model for memory corruption attacks". Still very interesting (quite complex).
- ASLR Smack & Laugh Reference: a 2008 paper that discusses many exploitation strategies for circumventing ASLR. Still very interesting (quite complex).
Mitigations
- Slides and textbook chapter from Computer Security at Berkeley (CS161). Discusses mitigations and corresponding circumventions (slightly) more in depth than in our lectures (heavily based on these slides, though).
- Slides on memory corruption from Software Security at Radboud University (prof. Erik Poll). The final part of the slides mentions many more defenses than those in our lectures. Not in depth, but a broad coverage to have an idea.
- Use compiler flags for stack protection in GCC and Clang. This article discusses the major stack protection mechanisms in the GNU Compiler Collection (GCC) and Clang, typical attack scenarios, and the compiler's attempts to prevent attacks.
Software security
- The Cyber Security Body Of Knowledge has several high-level documents on many topics in Cybersecurity. Those on "Software Security" and on "Secure Software Lifecycle" may be interesting.
- The Software Security course at Radboud University (prof. Erik Poll) has lot of very interesting material.
Appendix - Reverse engineering
This topic is out of scope. These links may be useful for grasping an idea of how to analyze the internals and memory layout of an existing program or device.
- A curated list of reverse engineering resources
- How to Use Ghidra to Reverse Engineer Malware There are numerous tools freely available to cybersecurity professionals to assist in analyzing malware. Ghidra was first released a couple of years ago and has proved to be relatively popular due to it being a free tool that can be used to disassemble malware.
- IDA disassembler Many tutorials out there.
- I Hacked into my Son's Baby Monitor, for Safety Nice video, part of a longer playlist devoted to reverse engineering.
- Frida Dynamic code instrumentation toolkit. It lets you inject snippets of JavaScript or your own library into native apps on Windows, macOS, GNU/Linux, iOS, watchOS, tvOS, Android, FreeBSD, and QNX. Frida also provides you with some simple tools built on top of the Frida API. These can be used as-is, tweaked to your needs, or serve as examples of how to use the API.