Assignment

1. True and False with Justification (2 for True/False and 3 for Justification for each question)

a. Shellcode developed for i386/Linux cannot be used to exploit a Buffer-Over-Flow-vulnerable program running on SPARC/Solaris. (SPARC and i386 correspond to different instruction sets)

b. The StackGuard solution ("canary word" solution) includes the operation to push a number into the stack for detection.

c. The control-flow-integrity solution includes the operation to push a number into the stack for detection.

d. The instruction-set randomization solution includes the operation to push a number into the stack for detection.

e. A kernelized reference monitor analyzes the interactions between a user-space process with the kernel (e.g., analyzing system calls). A browser loads a plugin into its memory in the user space of the memory and this plugin modifies some critical data inside the user-space-based memory for this browser.This modification is visible to the reference monitor.

2. In order to launch successful buffer-over-flow attacks, one problem is we need to guess *exactly* where the address of our code will start. If we are off by one byte more or less we will just get a segmentation violation or an invalid instruction. Please propose one solution to increase the chance of success. (hint: the answer can be found in the "Smashing The Stack For Fun and Profit" paper.)

3. The shellcode and BoF attack layout discussed in the "Smashing" article can be summarized in the following figure (e.g., Figure 2). However, the size of the shellcode is bounded by the size of the buffer to be exploited. In certain cases, the size of the shellcode might be too large to be put into the buffer to be exploited. Please propose one solution to solve this challenge (you should plot the stack layout of your solution.) (hint: the answer can be found in Section V. - Page 7 and 8 in the "Buttercup" paper.)

4. Consider the following C code fragment. We have a server program that uses this fragment once to process user input (both "input" and "i" are provided by unprivileged users). We compile the server program in a 32-bit operating system, in which the type of int, memory address, and registers, such as EIP, EBP, as well as ESP, are represented by 32 bits.

a. Is it possible to design an attack to exploit this "foo" function so that the CPU will execute an instruction at an arbitrary address in the user space? Please plot the stack layout and your attack.

b. Will the StackGuard approach be able to detect this attack? Please justify.

c. Will the control flow integrity approach be able to detect this attack? Please justify.

void foo(int i, int *input){
int *arr[10];
arr[i] = input;
}

Article: Buttercup: On Network-based Detection of Polymorphic Buffer Overflow Vulnerabilities by Archana Pasupulati, Jason Coit, Karl Levitt, S. Felix Wu, S.H. Li, R.C. Kuo and Kuo-Pao Fan.