Ways to get caught: Buffer Overflows

Buffer Overflows are a class of techniques used by bad guys to do everything they want. I attempt to give a simplified description of how it works.

In native languages like C and C++, buffers a.k.a arrays can be filled with more data than they are made to hold. (This is not strictly true. Modern OSes and compilers have ways to check this even for native code).

If the array is declared as a local array with a fixed size, just like any other local variable, a space equal to the size of the array is pushed into the stack. This is nothing new. All local variables are allocated on the stack segment. The compiler generated machine code automatically pushes all local variables onto the stack segment.

Did I say segment? Yes. For the uninitiated, let me explain: Every executable in most OSes are organized into segments during runtime. There is the data segment, code segment, stack segment and heap segment. Stack and heap segments may share the same memory space and they grow into each other. Keep in mind that stack and heap segments are not the data structures we studied in CS1102, we are talking about sections of memory allocated for an executable during runtime by the OS.

OK so back to local variables being pushed onto the machine stack. There is one other thing that get pushed onto the stack besides local variables: Return Addresses! The stack stores resturn addresses for the processor to return to after a function call. The funny thing is that even main() has a return address.

So here is what the bad guys do; Since most input to any program, be it a web server or a nuclear detonation device, is stored in arrays (remember char** argv?) the bad guys will give the program specially designed input values which overflow a local buffer and overwrite the return address of the current function to point to the address of the beginning of the array. (There are some technnicalities involved like NOP sleds because we do not know the exact address of the beginning of the array. I do not cover these). So the processor returns to the begnning of the array to execute whatever is written there. And guess what? The array contains the machine code bad guys want to execute on your system.

Lets say the bad guys targeted a web server that was running with administrator privileges. Then they would be able to execute code only an administrator would be allowed to execute. Thus buffer overflows could potentially give unlimited power for the attacker over the system.

Believe me, there are ways to upload entire VNC Server DLLs into certain Windows machines because of a buffer overflow in one of the network services a Windows machine opens for the whole world to connect to. And the attacker would be able to hijack your mouse and screen just like in the movies.

Fortunately, with the introduction of the NX bit most buffer overflows are impossible because the NX bit can be enabled to make a stack segment non-executable.

Ways to get caught: SQL Injections

If you have taken CS2102, or wrote an application that uses a relational database to authenticate users, you might have come across code like this:

SELECT * FROM USERS WHERE USERNAME='[username]' AND PASSWORD='[password]'

..where [username] is usually a variable that holds the username the user inputed into you application and [password] is usually the variable that holds the password the user inputed into your application. There may be string concatenation operators that make this possible in your favorite web application development language.

Assuming that the user uses the inputs directly in the SQL query without manipulation there are ways to break into such a system. And SQL Injection is the way. Here is how you do it.

Let us substitute the following input into the above query:

• [username] is ' OR 'x'='x
• [password] is ' OR 'x'='x
  

SELECT * FROM USERS WHERE USERNAME='' OR 'x'='x' AND PASSWORD='' OR 'x'='x'

As you can see this query will return some user from the database and the remaining application logic will authenticate you as that user.

This is a well known technique therefore it is very unusual to find web applications that have this vulnerability. However my polytechnic hired me after I showed them this vulnerability in one of their intranet web applications. So keep your eyes open, and report all such holes to NUS and be rewarded for your effort.

IQ Tests Suck

Here is a question I found on the Mensa website under "Mensa Workout":

Sally likes 225 but not 224; she likes 900 but not 800; she likes 144 but not 145. Does she like 1600 or 1700?

The pattern the question designers want me to find is that Sally likes perfect squares, and so she likes 1600. But there seems to be other valid solutions:

1. Sally likes numbers in which the sum of the digits plus the number of digits equals 12. Therefore, she likes 225, 900, 144, and, of course, 1700.
2. (This one is for the fans of Occam's Razor) Sally likes numbers whose sum of the digits is odd. Therefore she likes 1600, not 1700.
3. Sally likes 1700 because she likes the roots of x⁴ - 2969 x³ + 2521800x² - 648810000 x + 49572000000, which is 144, 225, 900 & 1700.
4. Sally likes 1600 because she likes the roots of x⁴ - 2869 x³ + 2394900x² - 612360000 x + 46656000000
5. Sally does "not" like 1600 or 1700, because neither number has digits which sum to 9. She "does", however, like 1800.

All these solutions are logical but only 3 out of these 6 rational solutions gives me a score.

This makes me wonder: Is Intelligence a social phenomena? Please note the fact the these questions are designed by people who are recognized by the society as intelligent, i.e people who have achieved something "great" in their lives. That implies that the society defines somebody as "intelligent" just because he thinks like the other "great" people.

What if Beethoven was born before the piano? Spielberg before the invention of the camera? Steve Jobs before the computers? So there are people alive today whose technology has not yet been invented yet, the perfect means to their genius has never materialized. And if society starts to brand, recognize and promote only the people who are like the achievers of yesterday, I think we will soon enter a second Dark Age.

Hello World

Hello, I am Edwin and I will be the guest blogger for this week.

I am an undergraduate student of Computational Biology. I study it because I believe it will speed up the progress of Life Sciences and eliminate the need for slow experimental techniques and ethics that limit it. As of now most of that dream is still science fiction, but I hope somebody will make progress.

You can read more about my academic and professional past here.

The Great Idea

Hi everyone,
As customary with all first posts, I will do a little intro about myself and what I do.
When Alexia and Juliana invited me to contribute to this blog, I gladly obliged, having benefited a lot from SOC, in terms of being granted incubation office space, as well as being provided with publicity opportunities. But more than just 'repaying' SOC, I wanted to contribute to the blog to share my experiences, and I hope that the blog will become some kind of 'idea' exchange, with students and bloggers contributing their thoughts and ideas on entrepreneurship.

I keep talking about "sharing experiences", basically because I'm still learning and building my business (hopefully one day it will be successful and I will be featured in the papers (: ), so I don't think I'm qualified enough to give advice. What I have done, very briefly summarized is (this will also serve as an intro about myself):

• Graduated from SOC in July 2004, majoring in Information Systems
  
• Together with my Honors Year Professor and another Prof, started DecisionWare Simulations and Games
• Made lots of investor pitches, and none came to fruition
  
• Organized a nation-wide business game competition in 2005 involving 500+ students
• Was invited to go to Mexico (one of long-time users of our game is Universidad Panamericana) to give a talk in 2005
  
• Worked with a number of government organizations on game projects including National Library Board, Asian Civilizations Museum and Ministry of Education

Intro aside, to the theme of my post, "The Great Idea". I thought it would be a good first post, since most of the time, business ventures are started on a single idea, that a budding entrepreneur and his friends discuss over tea-time or supper, which then gets drafted out as a business plan on napkins or scrap paper, then later formalized as a Word document. A simple business registration on ACRA is the next step, followed by approaching investors for funding. If that doesn't work, use the FFF method - Family, Friends or Fools to raise funds. And finally setting off with your plan to conquer the world.

I remember thinking like that while I was studying. Back then, I was already inspired by all the stories coming from Silicon Valley (1997 to 2000) about computer geeks becoming millionaires overnight. I attended talks and conferences to get ideas, and I remember this one about Technological waves (can't remember the exact name), and the speakers were talking about businesses becoming very successful because they were on the forefront of the technological trend. The one thing I remembered was at the end of the talk, a member of the audience asked, "Are you able to tell us what is the next trend?". One speaker replied, "If I knew that, I would be a very rich man!". I guess that guy asking the question wanted to get ideas for his "Great Business Idea". Well, we all know now that the dot-com bubble burst, and many companies that were built on "unique propositions" simply collapsed.

4 years on, I have come to believe that the "Great Idea" is over-rated. It is still true that you have to offer something extra, but there are many examples of successful entrepreneurs that were not the first to offer something new. From the papers recently we have Charles Wong (Charles & Keith) , Ivan Lee (Thai Express and other restaurants), and there is Google, which was not the first Internet Search Engine to be started.

The point is that it takes more than a good idea for a business to be successful. That is why I get a little irritated when people dismiss a business idea by saying "Oh, but I saw that on the Web already" or "I know another business like that". In this globalized world, nothing is truly original. So even if there is already another company doing something similar, does not mean your idea won't fly, or that your company won't eventually out perform the original company. On the flip side, you have to summon all your knowledge, expertise, connections and bring together a good team, and subsequently put in a lot of hard work into making the idea into a success.

- Kevin