Most remote exploits (i.e. over a network) use buffer overflow..I said buffer overrun before but, the term is buffer overflow. Thats what I meant when I said elephant... Lets put it this for as long as Unix has been around buffer overruns have been around ....same goes for every other computer out there. You can mitigate it....However that takes processor power...no way round that one.
Basically when a program is executing in memory it sets up memory locations to store various things....including the actual program thats running. As well as sometimes a program will allow you to enter things.....like lets say telnet. So Telnet sets aside space in memory for what the user enters in as the username prompt. So as a malicious user instead of a username I enter 1mb of data and hit return. Now some of that data is actual C code (called a payload) but before the payload is a part called the NOP slede. Telnet goes to write in the "username" into the memory space and ends up overwriting part of itself in memory. The NOP sled is basically a big target. Basically an instruction that says ..no operation here proceed to next operation. So we've overwritten part of the executing program with a large area that say's proceed to next line in code. the idea is that at some point the executing program will try to return to itself in memory and hit the NOP sled. Once it hits the NOP sled it slides all the way down and executes the pay load. Which could be something like open a shell on some port and only allow telnet clients to connect to get a session if they have a teminal type of 733t.
Part of what SELinux does is a input verification ....Meaning as a program should I really take 1mb of user inputted data and also any special codes in that data should be striped out.
The other thing it does is boundary checking in memory. Meaning do I really want that program to overwrite itself in memory.
the draw back to this is of course a performance hit.
Basically when a program is executing in memory it sets up memory locations to store various things....including the actual program thats running. As well as sometimes a program will allow you to enter things.....like lets say telnet. So Telnet sets aside space in memory for what the user enters in as the username prompt. So as a malicious user instead of a username I enter 1mb of data and hit return. Now some of that data is actual C code (called a payload) but before the payload is a part called the NOP slede. Telnet goes to write in the "username" into the memory space and ends up overwriting part of itself in memory. The NOP sled is basically a big target. Basically an instruction that says ..no operation here proceed to next operation. So we've overwritten part of the executing program with a large area that say's proceed to next line in code. the idea is that at some point the executing program will try to return to itself in memory and hit the NOP sled. Once it hits the NOP sled it slides all the way down and executes the pay load. Which could be something like open a shell on some port and only allow telnet clients to connect to get a session if they have a teminal type of 733t.
Part of what SELinux does is a input verification ....Meaning as a program should I really take 1mb of user inputted data and also any special codes in that data should be striped out.
The other thing it does is boundary checking in memory. Meaning do I really want that program to overwrite itself in memory.
the draw back to this is of course a performance hit.
Comment