Preventing BoF attacks The following measures are taken to prevent BoF attacks: type safe languages such as Java and ML Implementing run-time checking Using address obfuscation Randomizing location of functions in libc Performing static source code analysis Marking stack as non-execute, random stack location Programming countermeasures The following are programming countermeasures: Programs should be designed with security in mind. Stack execution should be disabled. The code should be tested and debugged in order to find errors. The use of dangerous functions, such as gets, strcpy, etc. should be prevented. Using "safer" compilers such as StackGuard should be considered. Return addresses should be prevented from overwritten. Arguments should be validated and the amount of code that runs with the root privilege should be reduced. All sensitive information should be prevented from overwritten. Static or dynamic source code analyzers should be used at the source code level in order to check the code for the overflow problems. The compiler should be changed at the compiler level. The compiler level bounds checking or protects addresses from overwriting. The rules should be changed at the operating system level for which memory pages are permitted to hold executable data. Safe libraries should be used. Tools that can detect buffer overflow vulnerabilities should be used. 17.4 Understand buffer overflow countermeasures tools and buffer overflow pen testing Exam Focus: Understand buffer overflow countermeasures tools and buffer overflow pen testing. Objective includes: Identify buffer overflow countermeasures tools. Understand buffer overflow pen testing. Countermeasures against buffer overflow The countermeasures against buffer overflow are as follows: Perform manual auditing of the code.
Preventing BoF attacks The following measures are taken to prevent BoF attacks: type safe languages such as Java and ML Implementing run-time checking Using address obfuscation Randomizing location of functions in libc Performing static source code analysis Marking stack as non-execute, random stack location Programming countermeasures The following are programming countermeasures: Programs should be designed with security in mind. Stack execution should be disabled. The code should be tested and debugged in order to find errors. The use of dangerous functions, such as gets, strcpy, etc. should be prevented. Using "safer" compilers such as StackGuard should be considered. Return addresses should be prevented from overwritten. Arguments should be validated and the amount of code that runs with the root privilege should be reduced. All sensitive information should be prevented from overwritten. Static or dynamic source code analyzers should be used at the source code level in order to check the code for the overflow problems. The compiler should be changed at the compiler level. The compiler level bounds checking or protects addresses from overwriting. The rules should be changed at the operating system level for which memory pages are permitted to hold executable data. Safe libraries should be used. Tools that can detect buffer overflow vulnerabilities should be used. 17.4 Understand buffer overflow countermeasures tools and buffer overflow pen testing Exam Focus: Understand buffer overflow countermeasures tools and buffer overflow pen testing. Objective includes: Identify buffer overflow countermeasures tools. Understand buffer overflow pen testing. Countermeasures against buffer overflow The countermeasures against buffer overflow are as follows: Perform manual auditing of the code.
Bufferflow.docx