In a previous post, I discussed security in networking systems. We looked at the possible vulnerabilities that a device on the network is exposed to and discussed how these exploits are possible due to some of the basic features of C and C++, the languages of choice in building such systems.
Take stake overflows as an example. Harmful as they are in potentially crashing a system, an equally severe issue is that they lay the foundation for a security vulnerability. By exploiting a stack overflow, an intruder can execute instructions in the software that are possible only after an authentication.
The following is a simple C program that simulates the authentication logic of a device.
#define PASSWORD “secret”
main (int argc, char **argv)
{
if (1 == password(argv[1]))
{
printf(“Congratulations, right password\n”);
/*
* User authenticaed, do work here
*/
return;
}
printf(“Access Denied, wrong password!\n”);
/*
* User login unsuccessful!
* Exit
*/
}
The password() function is as follows:
int password (char *buf)
{
char var[16];
strcpy(var,buf);
if (password_compare(var, PASSWORD))
return 1;
return 0;
}
To exploit the potential overflow in the 16-character ‘var[]‘ buffer, on a 32-bit system, one can simply pass 20 characters followed by the address of any instruction in the program. This overflows the stack, bypasses the authentication check and gives the attacker access.
If a similar piece of code was part of the authentication logic for a command line interface (CLI), your network system is at a very high risk of being severely compromised.
Fortunately, as developers, without having to be security experts, we have ways to mitigate such risks. Automated code analysis can allow you to take the guesswork out of finding security problems in code while you focus on adding features and functionality. Defects such as resource leaks, uninitialized variables, and memory management problems can all serve as a basis for eventual vulnerabilities such as unauthorized access, arbitrary code execution and denial of service. Automated analysis using static analysis checkers that find the resource leaks, uninitialized variables, buffer overflows and much more, should be a part of the development process if we care about security within the telecommunications and networking systems we build.
