Program security

Table of Contents
• Secure Programming
• Fixing faults
• Non malicious program errors
• Buffer overflow error
• Buffer overflow error- security implication
• Incomplete Mediation
• Time-of-Check to Time-of-Use Errors
• Viruses and other malicious code
• Types of viruses
• Malicious code
• Targeted malicious code
• Trapdoors
• Salami attack
• Rootkits
• Control against program threats.

Secure Programming
• Security implies some degree of trust that the program enforces expected
 Confidentiality
 Integrity
 Availability.
• Security and safety are two important aspects of the quality of software.
 Security is the ability of a system to protect itself against accidental or
intentional attacks.
 Safety is the ability of a system operating without risk, performing normal
functions as well as handling exceptional conditions.
• An assessment of security can also be influenced by someone's general
perspective on software quality.

Fixing Faults
• Fixing faults is one of the approach to check security of a program.
 A module in which 100 faults were discovered and fixed is better than another
in which only 20 faults were discovered and fixed.
• Early approach of checking program security is “Penetrate and Patch” in
which analysts searched for and repaired faults.
 Red Team or Tiger team tries to crack software, if software withstands the
attack then security is good. This is rarely true.
• Developers try to fix the problems as soon as discovered by Tiger team that
has following disadvantages
 This pressure leads to less attention towards fault.

Fixing Faults (contd)
 Non obvious side effects
 The fault could not be fixed properly because system functionality or
performance would suffer as a consequence.
 Fixing one problem leads to another fault.
• The inadequacies of penetrate-and-patch led researchers to seek a better
way to be confident that code meets its security requirements.
 One way to do that is to compare the requirements with the behavior i.e. we
can examine programs to see whether they behave as their designers intended
or users expected.
 Unexpected behavior a program security flaw; it is inappropriate program
behavior caused by a program vulnerability.

Non-Malicious Program Errors
• Being human, programmers and other developers make many mistakes,
most of which are unintentional and non-malicious.
• Many such errors cause program malfunctions but do not lead to more
serious security vulnerabilities.
• A few classes of errors have been more serious errors for programmers and
security professionals.
 Buffer Overflow Error
 Incomplete mediation
 Time-of-Check to Time-of-Use Errors

Buffer Overflow Error
• A buffer (or array or string) is a space in which data can be held. A buffer
resides in memory. Because memory is finite, a buffer's capacity is finite.
For this reason, in many programming languages the programmer must
declare the buffer's maximum size so that the compiler can set aside that
amount of space. For Example
 char sample[10];
sample[10] = 'A';
 The subscript is out of bounds (that is, it does not fall between 0 and 9), so
we have a problem
• In some programming languages, buffer sizes need not be predefined
 C does not perform array bound checking.
 Similar problems caused by pointers for which there is no way to define a
proper limit

Buffer Overflow Error (contd)
• Damage done by Buffer overflow
 Affects User’s data (overwrites user data)
 Affects user’s code (changes user’s instruction)
 Affects system data (Overwrites OS data)
 Affects system code (changes OS’s instruction)
• Implications of buffer overflow
 Attacker can insert malicious data values/instruction codes into overflow
space.
 C programming language specifications do not specify how data is to be
laid out in memory.
 Some implementations of C may leave space between arrays and variables
on the stack, for instance, to minimize aliasing effects.

Buffer Overflow-Security Implication
• Web server attack is similar to buffer overflow attack: passes very long
string to web server.
• Buffer overflows are still common
 Used by attackers to crash systems and to take over the system by taking
control over.
• Large number of vulnerabilities due to buffer overflows still persists in
many software's and systems.

Incomplete mediation
• Consider the example
 http://www.somesite.com/subpage/userinput&parm1=(808)555-
1212&parm2=2004Jan01
 What happen if we pass value like 1800Jan01 or 1800Feb30 or 2048Min32
a) Data type error.
b) Continue to execute but end up with a wrong result.
• What if we do all the validations properly on the client browser.
 Here are some security implications of incomplete mediation
 Unchecked data values represent a serious data vulnerability.
a) Example: A firm named “Things” started a e-commerce site to sell their products.
b) Once a person places his order , the return URL is as follows
c) http://www.things.com/order/final&custID=101&part=555A
&qy=20&price=10&ship=boat&shipcost=5&total=205

Incomplete mediation (contd)
• A malicious attacker may decide to exploit this peculiarity by supplying
instead the following URL, where the price has been reduced from $205 to
$25:
 http://www.things.com/order/final&custID=101&part=555A
&qy=20&price=1&ship=boat&shipcost=5&total=25
 The attacker could have ordered Objects from Things in any quantity at any
price.
• From a security perspective, the most serious concern about this flaw was
the length of time that it could have run undetected

Time-of-Check to Time-of-Use Errors
• Access control is a fundamental part of computer security; we want to
make sure that only those who should access an object are allowed that
access.
• Every requested access must be governed by mediated access policy
enforcement agent.
• Incomplete mediation problem occurs when access is not checked
universally.
• The time-of-check to time-of-use (TOCTTOU) flaw concerns mediation
that is performed with a "bait and switch" in the middle.
• It is also known as a serialization or synchronization flaw.

TOCTTOU (contd)
• Example: DBMS/OS
 Pgm 1 reads value of X=10
Pgm 1 adds X=X+5
Pgm 2 reads X=10, adds 3 to X, writes X=13
Pgm 1 writes X=15
 X ends up with value X=15 while it should be X=18
• Prevention
 Be aware of time lags.
 Use digital signatures and certificates to lock data values after checking them.
• Security Implication
 Checking one action and performing another is an example of ineffective
access control.

Viruses and other malicious code
• Computer data are not usually seen directly by users, malicious people can
make programs serve as vehicles to access and change data and other
programs.
• Malicious code is written just like any other program on the system, but is
written to exploit vulnerabilities of the system.
• Malicious code can change data or other programs.
• Malicious code can do anything any other program can, such as writing a
message on a computer screen, stopping a running program, generating a
sound, or erasing a stored file.
• Malicious code can do nothing at all right now; it can be planted to lie
dormant, undetected, until some event triggers the code to act.

Viruses and other malicious code (contd)
• The trigger can be a time or date
• An interval (for example, after 30 minutes),
• An event (for example, when a particular program is executed)
• A condition (for example, when communication occurs on a modem)
• A count (for example, the fifth time something happens)
• Some combination of these, or a random situation.

Types of Viruses
• Viruses have been categorized according to the ways in which they infect a
system, the part of the system they affect or their behaviors.
 File Infector Viruses
a) File infector viruses are those that infect other files or programs on your system.
b) Once the original 'host' program is run, the virus can stay resident or 'live' inside
your systems memory (RAM) and infect programs as they are opened, or they can
lay dormant inside another program. Each time that program is run, the virus will
infect another program or file.
c) A second, more complex file infector is one that doesn't alter the program itself,
but alters the route a computer takes to open a file.
d) If a program or file that is infected with a file infector virus is passed from one
computer to another, over a network or via floppy disk for example, the virus will
begin infecting the 'clean' computer as soon as the file or program is opened.

Types of Viruses (contd)
 Boot Sector Viruses
a) Whereas file infector viruses infect programs on a computer's hard drive, boot
sector viruses can infect hard drives and removable disks, such as floppy disks.
b) The boot sector is an area at the beginning of a hard drive or other disk where
information about the drive or disk structure is stored.
c) Symptoms of a boot sector virus may be a computer that is unbootable or gives
error messages upon booting. Frustratingly, boot sector viruses may be present
with no noticeable problems.
 Macro Viruses
a) Macro viruses are by far the most common type of malicious code found today.
This is due to the popularity of software such as Microsoft Office and others such
as Corel Draw, which use the macro programming languages extensively in the
products.
b) Macro viruses use an application's own macro programming language to distribute
themselves.
c) Macro viruses do not infect programs; they infect documents.

 Worms
a) A worm is a piece of code that can make fully functional copies of itself and travel
through a computer network and/or across the Internet through a number of
means.
b) A worm does not attach themselves to other programs like traditional viruses, but
creates copies of itself, which in turn create even more copies.
c) The computer 'worm' is so-called because of the way in which 'rogue' computer
code was originally detected.
d) Worms are prolific due to the fact that most are created using simple scripting
languages that can be created with a text editor and become fully functional
'programs' under the right conditions.
 Trojan horses
a) Accordingly Trojans are malicious programs that sneak into a victim computer
disguised as harmless software.
b) Trojans may also be 'wrapped' inside another program so that when the original
innocent program is installed, the Trojan program is installed as well.
c) The most commonly described Trojan has a payload that will allow a user on
another computer somewhere else in the world to gain full control and access to
the files on your computer.

 Hoax Viruses
a) There are hundreds of hoax viruses that spread like chain letters through e-mail.
b) They cause little or no long-term damage, these hoaxes can be as disruptive as real
malicious code.
c) The standard response of most people when receiving a virus warning is to pass it
on to all people in their organization and most likely everyone else in their
contacts lists.
d) This sets up a chain reaction that not only wastes Internet bandwidth, but also
wastes the valuable time of recipients.
 Memory-Resident Viruses
a) Some parts of the operating system and most user programs execute, terminate,
and disappear, with their space in memory being available for anything executed
later.
b) For very frequently used parts of the operating system and for a few specialized
user programs, it would take too long to reload the program each time it was
needed. Such code remains in memory and is called "resident" code.
c) Examples of resident code are the routine that interprets keys pressed on the
keyboard, the code that handles error conditions that arise during a program's
execution, or a program that acts like an alarm clock, sounding a signal at a time
the user determines.

Malicious code
• Malicious code or a rogue program is the general name for unanticipated
or undesired effects in programs or program parts, caused by an agent
intent on damage.
• This definition eliminates unintentional errors, although they can also have
a serious negative effect.
• A virus is a program that can pass on malicious code to other non
malicious programs by modifying them.
• The term "virus" was coined because the affected program acts like a
biological virus: It infects other healthy subjects by attaching itself to the
program and either destroying it or coexisting with it.
• A good program can be modified to include a copy of the virus program, so
the infected good program itself begins to act as a virus, infecting other
programs.

Malicious code (contd)
• A virus can be of two types
 Transient: Its life that depends on the life of its host; the virus runs when its
attached program executes and terminates when its attached program ends.
 Resident: A resident virus locates itself in memory; then it can remain active
or be activated as a stand-alone program, even after its attached program ends.
• Types of malicious code
 Trojan horse: It is malicious code that, in addition to its primary effect, has a
second, non obvious malicious effect.
a) It gets installed with legitimate infected program.
b) Effects of trojan horse are deleting or editing files, transmitting files to intruders,
installing malicious code that can gain network access.
c) Privilege elevation attack.

Malicious code (contd)
 Logic bomb: It is a class of malicious code that "detonates" or goes off when a
specified condition occurs.
a) A time bomb is a logic bomb whose trigger is a time or date.
b) Trapdoor or Backdoor: Its a feature in a program by which someone can access the
program other than by the obvious, direct call, perhaps with special privileges.
 Worm : It is a program that spreads copies of itself through a network.
a) The primary difference between a worm and a virus is that a worm operates
through networks, and a virus can spread through any medium (but usually uses
copied program or data files).
 Rabbit : Virus or worm that self-replicates without bound, with the intention of
exhausting some computing resource.
a) A rabbit might create copies of itself and store them on disk, in an effort to
completely fill the disk, for example.

Targeted Malicious code
• Malicious code is written for a particular system, for a particular
application, and for a particular purpose. Similar to viruses but with the
addition of new techniques
 Trapdoor : An undocumented entry point to a module.
a) Inserted for code development
b) “Hooks” to add additional future enhancements
• Can be legitimate or non-legitimate
• Software Testing
 Unit Testing
 Integration Testing
 Stubs and Drivers – routines that inject information during testing
 Control Stubs – used to invoke debugging code
 Accidently left in place
 Poor Error Checking

Trapdoors
• Poorly defined Data
• Incomplete Mediation
• Undefined Opcodes – instructions that have not been defined for the
processor
• Trapdoors can be useful
• Software audits may request trapdoors to be inserted
• Trap doors should always be documented.

Trapdoors
• Causes of Trapdoors
 Forgot to remove
 Intentionally for Testing
 Intentionally left for maintenance
 Intentionally left for covert means of access
 Trapdoors are not bad. They are not faults until the trapdoor is not shut.
 A system is not secure if a trapdoor is present but unknown by others

Salami Attack
• Named after the way scrap meat is used to form salami
• Salami Attack – merges seemingly inconsequential bits of data to yield
something important
• For example, programs often disregard small amounts of money in their
computations, as when there are fractional pennies as interest or tax is
calculated.
• Classic Salami Attacks
 Missing ½ cent
 Missing percentage
 Taking a bit from a bunch
 Charging higher fees
• Why do they happen?
 Sometimes programmers just except small errors
 Code many times it to large to look for salami type errors

Rootkits
• Rootkit – is a piece of malicious code that goes to great lengths not to be
discovered
 If discovered tries to reestablish itself
 Tries to run itself as “root” on the system (UNIX administrator)
 Resides between user and OS
 Intercepts commands in order to keep itself hidden
 Rootkit Revealer – program written to reveal rootkits
 XCP rootkit – used to help prevent copying of music

Rootkits (Contd)
• One of the primary objectives of a rootkit is to avoid detection in order to
remain installed and accessible on the victim system, so rootkit developers
aim to keep their malware undetectable
 One common symptom of a rootkit infection is that antimalware protection
stops working.
a) An antimalware application that just stops running indicates that there is an active
rootkit infection.
b) Another symptom of a rootkit infection can be observed when Windows settings
change independently, without any apparent action by the user.
c) Other unusual behavior, such as background images changing or disappearing in
the lock screen or pinned items changing on the taskbar, could also indicate a
rootkit infection.
d) Unusually slow performance or high CPU usage and browser redirects may also
indicate the presence of a rootkit infection.

Rootkits (Contd)
• Types of rootkits
 Kernel mode rootkit
a) Designed to change the functionality of an OS.
b) This type of rootkit typically adds its own code -- and, sometimes, its own data
structures -- to parts of the OS core, known as the kernel.
c) Many kernel mode rootkits exploit the fact that OSes allow device drivers or
loadable modules to execute with the same level of system privileges as the OS
kernel, so the rootkits are packaged as device drivers or modules to avoid detection
by antivirus software.
 User mode rootkit
a) Sometimes called an application rootkit, executes in the same way as an ordinary
user program.
b) User mode rootkits may be initialized like other ordinary programs during system
startup, or they may be injected into the system by a dropper.
 Bootkit
a) Infects the master boot record of a hard drive or other storage device connected to
the target system.
b) Bootkits are able to subvert the boot process and maintain control over the system
after booting and, as a result, have been used successfully to attack systems that
use full disk encryption.

Rootkits (Contd)
 Firmware rootkits
a) Firmware rootkits take advantage of software embedded in system firmware and
install themselves in firmware images used by network cards, BIOSes, routers or
other peripherals or devices.
• Rootkit detection and removal
 Rootkits are designed to be difficult to detect and remove; rootkit developers
attempt to hide their malware from users and administrators, as well as from
many types of security products.
 Once a rootkit compromises a system, the potential for malicious activity is
very high.
a) There are many rootkit detection tools suitable for power users or for IT
professionals provided by antimalware vendors, which usually offer rootkit
scanners or other rootkit detection tools to their customers.
b) One approach to rootkit removal is to reinstall the OS, which, in many cases, will
eliminate the infection.

Controls Against Program Threats
• Development of Controls
 Specify the system : capturing the requirements and building a model of how
the system should work from the users' point of view.
 Design the system: proposing a solution to the problem described by the
requirements and building a model of the solution.
 Implement the system: using the design as a blueprint for building a working
solution.
 Test the system: to ensure that it meets the requirements and implements the
solution as called for in the design.

Controls Against Program Threats
(contd)
 Review the system at various stages: to make sure that the end products are
consistent with the specification and design models
 Document the system: users can be trained and supported
 Manage the system: to estimate what resources will be needed for
development and to track when the system will be done
 Maintain the systems: tracking problems found, changes needed, and
changes made, and evaluating their effects on overall quality and
functionality

Program security

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Program security

Ähnlich wie Program security (20)

Mehr von G Prachi

Mehr von G Prachi (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Program security

Hinweis der Redaktion