Software Analysis -- The Art of Code Attack and Defense

Author: (US) Hogland, (US) Mikogoro | Translators
Publisher:
Publish Date: 2005-04-01
Features: This book delves into the issue of software cracking in the real world, explaining how and why software is cracked, introducing relevant attack patterns, and how they are discovered. It also demonstrates how to identify vulnerabilities in new software and how to exploit these vulnerabilities to compromise systems. Chapter 1 introduces software as the root cause of security issues in computer systems. It introduces the "Triple E" problem—complexity, scalability, and connectivity—and describes why software security issues are constantly growing. It also outlines some characteristics of software and their implications in software attacks. Chapter 2 differentiates between bugs and architectural flaws, discusses security issues in open systems, and explains why risk management is a wise approach. It presents two real-world attack cases: one relatively simple and the other technically complex. The core of this chapter is the discussion of attack patterns, showing how they adapt to different network security characteristics and are also introduced in other parts of the book. Chapter 3 focuses on reverse engineering. Attackers disassemble, decompile, and deconstruct programs to understand how they work and how to prevent them from working in such a way. This chapter also introduces common gray-box analysis techniques, including the idea of using security patches as attack maps. It introduces the Interactive Disassembler (IDA), a tool hackers use to understand program behavior. We also provide a detailed explanation of how practical hacker tools are developed and used. Chapters 4–7 discuss real-world use cases of attack patterns. Chapters 4 and 5 introduce the two-ended client-server model. Chapter 4 starts with the remnants from the book Hacking Exposed [McCluYe et al., 1999], introducing attack techniques specific to server-side software, such as trusted input, privilege escalation, code injection, path traversal, cracking trusted, and other server-specific attack methods. Chapter 5 discusses how to attack client-side software using mixed signals, cross-site scripting, and mobile code. It also covers the issue of reverse attacks. Both chapters discuss attack patterns and real-world attack cases. Chapter 6 addresses the issue of malicious code input, which goes beyond the split analysis, code tracing, and reverse engineering of program code we have discussed. Solving this problem requires strong coding skills. As mentioned before, the book provides a comprehensive introduction to both real-world attack cases and attack patterns. Just as a naughty boy needs a good whipping, the fatal buffer overflow is the topic of Chapter 7. This chapter focuses on buffer overflow attack techniques already discussed in other technical materials. It discusses buffer overflows in embedded systems, databases, the Java environment, and content-based buffer overflows. The chapter explains how to identify various types of buffer overflows, including stack overflows, arithmetic errors, format string vulnerabilities, heap overflows, C++ virtual function tables, and multi-stage jumps. It provides detailed explanations of attack code structures on specific operating platforms, such as x86, MIPS, SPARC, and PA-RISC. It also introduces advanced attack code structure techniques for breaking vulnerable security systems, such as activearmor and jumping techniques. The chapter also presents numerous attack patterns. Chapter 8 introduces the technical—rootkit—in software attacks. Using this technique, attackers can gain full control of the entire system. The main part of this chapter is an introduction to a real-world rootkit based on Windows XP. It mainly includes hooking call techniques, executable redirection techniques, process and file hiding techniques, network support techniques, and binary code patching techniques. This chapter also provides a detailed discussion of some hardware techniques, including using EEPROM to hide rootkits. Of course, there are many other rootkit techniques beyond those introduced in this chapter. Target Audience This book is suitable for network administrators, security consultants, information professionals, developers, and programmers who wish to write secure code.