CertiGuide to Security+  9  Chapter 1:  General Security Concepts (Domain 1.0; 30%)       9  1.4  Attacks            9  1.4.12  Software Exploitation

1.4.12  Software Exploitation 1 Naïve Web Applications

A particular type of software exploitation that frequently makes the news these days is that of a buffer overflow. Generically speaking a buffer overflow occurs when an input string is used to copy more data into a memory buffer than the program was programmed to handle. Software coders are famous for checking to see if something works and being blind to what happens “if” – in this case, the IF is, a user provided more data for one of these memory copy functions, than the programmer expected. The footnote has a great overview⁹⁰. The most recent PITA virus in the buffer overflow category is Code Red⁹¹.

The most famous buffer overflow occurred on November 2, 1988. The “Morris worm” caused incredible damage by exploiting a buffer overflow condition in the UNIX program fingerd (a “daemon”, aka server service) for the popular UNIX “finger” utility.

Once a cracker has found a program with a buffer overflow problem, they can either:

• Send large amounts of random data to the program, causing that program to crash. If the program is a server that doesn’t automatically restart, that may cause a Denial of Service condition.
  
  
• Send specially crafted data, designed to overwrite portions of the program in memory, and alter its functionality (as did the Morris worm). If the program is running with Administrator or UNIX root privileges, this enables the attacker to cause arbitrary commands to be executed with these higher privileges. For instance, they might copy or delete files, run code to cause a worm to propagate, change the system configuration settings, etc.

Sometimes buffer overflow exploits are automated in a “rootkit” or exploit script used by a script kiddie. Other times, they’re exploited by hand, by a more skilled, programming savvy tech.

The brief quotes only highlight the global nature and severity of the impact of not updating patches what we’re available for almost six months. An article in BusinessWeek suggests that this is just the beginning of “SuperWorms” Your authors are not you’re companies’ management team. We cannot force you to make keeping updates current on your systems. And if that isn’t the top priority of you’re management team, show them this text. If the message doesn’t get across, start looking for a new job. . As the footnote points out, failure to patch could leave you on the short end of a Negligence lawsuit⁹⁵. If you don’t see the value in updates, you’re not ready for security, as a certification or as part of you’re work.

1.4.12  Software Exploitation 1 Naïve Web Applications