Exploiting Trust through Configuration
Trust exploits are not always the fault of programming errors, they can also be environmental in nature. For example, by placing perl.exe in the cgi bin directory of a Web server, an unsuspecting Web master will have explicitly trusted anonymous users to evaluate
• |
Table of Contents |
Perl expressions on the Web server. Of course doing so is a very bad idea because it allows |
|
• |
Index |
anonymous users unfettered access to the system. But, the trust is implied by the location of
Exploitingthe Perl executableSoftware Howinsteadto BreakofCodeby consideration of what the software might do.
ByGreg Hoglund,Gary McGraw
Publisher: Addison Wesley
Pub Date: February 17, 2004
AttackISBN:Pattern:0-201-78695-8Direct Access to Executable Files
Pages: 512
A privileged program is directly accessible. The program performs operations on behalf of the attacker that allow privilege escalation or shell access. For Web servers, this is often a fatal issue. If a server runs external executables provided by a user (or even simply named by a user), the user can cause the system to
behave in unanticipated ways. This may be accomplished by passing in commandHow does software break? How do attackers make software break on purpose? Why are
line options or by spinning an interactive session. A problem like this is almost
firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys?
always as bad as giving complete shell access to an attacker.
What tools can be used to break software? This book provides the answers.
The most common targets for this kind of attack are Web servers. The attack is so Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and
easy that some attackers have been known to use Internet search engines to find techniques used by bad guys to break software. If you want to protect your software from
potential targets. The Altavista search engine is a great resource for attackers attack, you must first learn how real attacks are really carried out.
looking for such targets. Google works too.
This must-have book may shock you—and it will certainly educate you.Getting beyond the
script kiddie treatment found in many hacking books, you will learn about
Executable programs typically take command-line parameters. Most Web servers pass
command-line options directly to a executable as a "feature." An attacker can specify a target
Why software exploit will continue to be a serious problem
executable, such as a command shell or a utility program. Options passed in a Web URL are
forwarded to the target executable and are then interpreted as commands. For example, the When network security mechanisms do not work
following arguments can be passed to cmd.exe to cause the DOS dir command to be run:
Attack patterns
Reverse engineering
Classic attacks against server software
Surprising attacks against client software
Techniques for crafting malicious input
cmd.exe /c dir
The technical details of buffer overflows
Rootkits
Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break
Injection against a Web server usually takes the form of a path, and sometimes includes software.
additional parameters:
Attack patterns
Reverse engineering
Surprising attacks against client software
Techniques for crafting malicious input
The technical details of buffer overflows
Rootkits
Why software exploit will continue to be a serious problem
Attack patterns
Reverse engineering
Classic attacks against server software
Surprising attacks against client software
Techniques for crafting malicious input
The technical details of buffer overflows
Rootkits
Why software exploit will continue to be a serious problem
When network security mechanisms do not work
Attack patterns
Reverse engineering
Techniques for crafting malicious input
Executable code is categorized based on its URL of origin and the private keys used to sign the code. The security policy maps a set of access permissions to code characterized by particular origin/signature information. Protection domains can be created on demand and are tied to code with particular CodeBase and SignedBy properties. Needless to say, this is complicated. In practice, Java 2 policy has turned out to be way too complicated and is thus only rarely used. But for our purposes, policy files clearly make good targets for attack. Policy files that request too much permission (more than is actually necessary) are all too common.
•Table of Contents
•Index
Exploiting Software How to Break Code
ByGreg Hoglund,Gary McGraw
Publisher: Addison Wesley
Pub Date: February 17, 2004
ISBN: 0-201-78695-8
Pages: 512
How does software break? How do attackers make software break on purpose? Why are firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What tools can be used to break software? This book provides the answers.
Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and techniques used by bad guys to break software. If you want to protect your software from attack, you must first learn how real attacks are really carried out.
This must-have book may shock you—and it will certainly educate you.Getting beyond the script kiddie treatment found in many hacking books, you will learn about
Why software exploit will continue to be a serious problem
When network security mechanisms do not work
Attack patterns
Reverse engineering
Classic attacks against server software
Surprising attacks against client software
Techniques for crafting malicious input
The technical details of buffer overflows
Rootkits
Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break
software.