Exploiting Buggy Software

A second method of attack is to exploit buggy software. One particularly common type of bug that often leads to security vulnerabilities is the ibuffer overflow. This condition occurs when a programmer doesn't set aside enough space to hold input data. Ordinarily, the result is odd program behavior or crashes; but a cracker who studies a buffer overflow bug may be able to exploit it to place new instructions in the program code itself. The result can be a system break-in.

Bugs are particularly sensitive in server software, which is accessible to the world at large; or when software is run as root, either directly or by being owned by root and having its set-user-ID (SUID) bit set. The worst case is the combination of the two. When this happens, a miscreant from the other side of the world can break into your computer, without using an ordinary account. The cracker may be able to set up a new account, replace existing software, and so on. (Chapter 21 describes how to detect when this happens.)

Even software run locally by ordinary users can be exploited in this way. Unfortunately, not all users are trustworthy, particularly at large sites. Even when all your users are trustworthy, a social engineering attack might be combined with software bugs to give the social engineer sensitive information or to otherwise do the cracker's bidding.

Two defenses against buggy software are described later in this chapter: Running as few servers as possible (covered in "Removing Unnecessary Servers") and installing the latest versions of software (covered in "Keeping Software Up-to-Date"). Both techniques reduce the chance that your system will be running vulnerable software.

0 0

Post a comment