5 ms·
"Shellcode" in this sense is the small number of instructions that initiates the exploit, i.e. its contained in the data you overflow the buffer with. The inte
by TickleSteve 8y ago
"Shellcode" in this sense is the small number of instructions that initiates the exploit, i.e. its contained in the data you overflow the buffer with.
The intention is that you tricking the firmware into executing your shellcode to ramp up the exploit.
The shellcode is "executable data" and the typical prevention for this type of exploit is execution-prevention on data (and stack) regions (for processors that support it).
- signa11 8y agobut there is always return-to-libc style attacks which defeat executable stack protection...
- saagarjha 8y agoAnd hence we have ASLR to prevent against those attacks…
- DyslexicAtheist 8y agoonly for 64-bit, but disclaimers might apply in (32-bit) IoT land: > Our results suggest that, for current 32-bit architectures, address-space randomization is ineffective against the possibility of generic exploit code for a single flaw; and brute force attacks can be efficient, and hence effective [1] https://web.stanford.edu/~blp/papers/asrandom.pdf https://web.stanford.edu/~blp/papers/asrandom.pdf edit: also ROP
- saagarjha 8y ago32-bit IoT usually has a lot more problems that are easier to exploit than being able to brute force ASLR, but yes: if you are able to run attacks quickly, it’s pretty easy to get lucky and find the offset. There really isn’t much you can do on 32 bit to fix this, unfortunately, unless you start doing fancy things like reordering functions themselves to increase the number of bits of entropy (and even then, you’re not getting much…)
- wtallis 8y agoSince IoT is somewhat less tied to existing architectures, it's not completely out of the question that somebody could produce a microcontroller that keeps separate stacks for return addresses and function arguments/results. If the former stack is not directly modifiable, that removes most of the need for ASLR.
- dfox 8y agoMajor selling point of most modern microcontroller architectures is that they don't have separate hardware return address stack, and are thus "C compatible". Many early microcontrollers had exactly that as it also typically means simpler hardware implementation.
- wtallis 8y ago"C compatible" strikes me as a very overblown way of describing the consequences of choosing whether to have a separate return address stack. In practice, I don't see it actually amounting to anything more than a need to use privileged instructions to implement setjmp, which is perfectly reasonable for a high-security environment.
- simias 8y agoYou can also insert stack-protecting canaries with some compilers (-fstack-protector on GCC). A bit more limited and it incurs a small runtime cost but you only need compiler support.
- saagarjha 8y agoStack canaries make these attacks much more annoying, but it’s still possible to perform these if you can overwrite a function pointer or perform a controlled read or write (rather than a buffer overflow).
- est31 8y agoAnd ASLR is bypassable as well if you have other bugs that leak information about the stack layout. Overall it just gets more annoying and more tricky because you need to find more bugs and they need to fit together.
- Hendrikto 8y ago> Overall it just gets more annoying and more tricky That‘s the point, isn‘t it? No system will ever be 100% secure, so all we can try to achieve is to deter attackers.
- Filligree 8y agoIt's entirely possible, in theory, to write bug-free code. It just isn't possible in practice, for humans. Isn't that rather sad?
- null_content 8y agoAs a general statement, that is impossible in both practice and theory due to the halting problem. You CAN write proven bug free code, but only if you are willing to accept a long series of limitations.
- Filligree 8y agoI'm willing to accept "Might enter an infinite loop", but AFAIK the halting problem says nothing about security.
- saagarjha 8y ago> the halting problem says nothing about security It makes it impossible to say whether certain things can be proven to be secure.
- crankylinuxuser 8y ago
- signa11 8y agohmm, is the PLT and GOT also randomized ? if not, then that could possibly be another option for return-to-libc style attacks despite aslr.
- saagarjha 8y agoIf you have a PIE binary, then yes.
- deleted 8y ago[deleted]
- saagarjha 8y agoOf course, it’s so named because the code traditionally grants access to a shell.
- tyingq 8y agoDidn't know this was the lingo. Apparently there are related terms that go with it like "egg", "egg-hunt", "omelette", etc. https://en.m.wikipedia.org/wiki/Shellcode https://en.m.wikipedia.org/wiki/Shellcode