A homework session in chat

stevetronix

Sep 19, 2013 19:52

Hi all, would you happen to know if it is it possible for a user to take advantage of a certain serious loophole in the computer's protection mechanism, by which the user could run his/her own program in the monitor mode or kernel mode?

user41796

True fact, friend of mine was cert'd in a previous life

user41796

@stevetronix that's a bit vague, but privilege escalation exploits are pretty dang common

user41796

In part, it depends upon OS, if the user has an account on the system, and what else is installed

Jimmy Hoffa

@stevetronix You're dancing around something here (or perhaps new to software?) but what you refer to is excruciatingly common. The entirety of security is based around the fact that it's possible to elevate your privileges and execute arbitrary code if things aren't properly secured

user41796

Injection attacks and buffer overflows are pretty common routes to those types of attack vectors

user55340

Sep 19, 2013 19:57

@stevetronix One place I worked allowed home directories to be mounted on nfs without squashing uid 0. I had a linux box for dev that I had root on (IT didn't want to admin it) - I mounted my home directory, and set a copy of /bin/sh to be setuid 0. I had root everywhere my home directory was (which was further a problem of not mounting the home directories remapping root to nobody). Broken privileges are everywhere.

user41796

@MichaelT That's brilliant.

user55340

@GlenH7 The operations group glared at me occasionally, but then when they couldn't get sudo access for things they needed from IT, copies of that program found its way to other directories and I didn't get any more glares.

user55340

Realize that the production external facing areas didn't mount home directories.

user41796

I have a similar story, but can't share it as I'm pretty the exploitable environment is still in place.

stevetronix

hmm, how can a user make their program run in kernel mode? Would they have to hack the admin account? Can they also have their application make a system call with certain parameters to trigger an interrupt that the user wants in order to gain control of the system?

user41796

Sep 19, 2013 20:00

@MichaelT I wish I could claim that the production environment had been better sheltered than the test environment

user41796

@stevetronix yes to all of the above

user41796

Are you trying to hunt something down?

user41796

or figure out how to hack the system yourself?

stevetronix

no hacker here, just trying to answer a theory question

user55340

5

Q: Difference between processes running in kernel mode and running as root?

I am aware of the difference between a process running in user mode and one running in kernel mode (based on access restrictions, access to hardware etc.). But just out of curiosity, what is the difference between a process running in kernel mode and one running as root?

user41796

Sep 19, 2013 20:02

there are multiple answers in this case

Jimmy Hoffa

@stevetronix What's the theory? Have you written much software? Or for very long?

user55340

10

A: Difference between processes running in kernel mode and running as root?

kernel mode and root are two separate ideas that aren't really related to each other. The concept of running a process as root is a unix/linux term that means you're logged in as the administrator of the system. Any process you run, whether as root or a normal user, generally runs in both user ...

stevetronix

@J

Jimmy Hoffa

@stevetronix not to pry but I could answer in many different ways, most of which would probably not be very helpful to you based on what your understanding is on the topic at hand

stevetronix

@JimmyHoffa it's for a course

user55340

Sep 19, 2013 20:03

codinghorror.com/blog/2008/01/…

Jimmy Hoffa

Homework or some such? Happy to help, perhaps you could give us a fuller detail of the homework problem you're dealing with?

stevetronix

@MichaelT thanks for the links. I'll be checking them out

user41796

Metasploit Project

The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development. Its best-known sub-project is the open source Metasploit Framework, a tool for developing and executing exploit code against a remote target machine. Other important sub-projects include the Opcode Database, shellcode archive and related research. The Metasploit Project is well known for its anti-forensic and evasion tools, some of which are built into the Metasploit Framework. History Metasploit was created by ...

user41796

That's the deep dive off of the cliff though

stevetronix

@JimmyHoffa unfortunately the question itself is quite vague

Consider a computer running in the user mode. It switches to the monitor mode (also known as
kernel mode) whenever an interrupt or trap occurs, jumping to the address determined from the
interrupt vector. A malicious user took advantage of a certain serious loophole in the computer's
protection mechanism, by which the user could run his/her own program in the monitor mode! This
can have disastrous consequences.
a) What could have the user possibly done to achieve this?

Jimmy Hoffa

Sep 19, 2013 20:05

What piece of information you're exactly looking for isn't clear; your questions ask about an entire field of information rather than any given piece, we could point you to books but other than saying your answers are in those books we can't give you much else

user41796

@stevetronix - part of the problem is we could each rattle off a half-dozen answers or potential attack vectors based upon the peculiars of the environment

Jimmy Hoffa

@stevetronix Ah this is much more clear!

You're in some lower level coding course then

user41796

I'd vote for buffer overflow. Common attack vector, good for escalation

Jimmy Hoffa

something about operating systems

stevetronix

@JimmyHoffa right on

user55340

Sep 19, 2013 20:06

I vaguely recall some of this from my MIPS programming class.... LONG ago.

user41796

unchecked parameter variables are the key culprit.

Jimmy Hoffa

@GlenH7 I think it's hiding in the words; the user caused an interrupt vector that pointed to a space in memory where they placed a program

user55340

kernel mode could have access to all memory.

user41796

Another option would be to insert the program name at a point to where you know there will be a System.exec() call with that program name. It's an older way of launching privileged sessions

user41796

@JimmyHoffa soooo many easier vectors though... :-)

user41796

Sep 19, 2013 20:09

Interrupts generally force execution to a particular area of memory. If the hacker found a way to overwrite one of those areas, that would do the trick

user41796

depending upon how the stack was composed, you could still use a buffer overflow to make that work

user55340

b) - you're at the device driver level. What do you want to do? Scramble a disk? Launch another process with this user's permission? Tweak the process table?

user41796

insert a function to randomly twiddle every hundred-thousandth bit. Far more insidious.

Jimmy Hoffa

@GlenH7 yeah, I'm just basing it off the idea that in a course they give the information in the question they want you to base your approach off of

76

Q: Open letter to students with homework problems

It is September once again (today is the 7316th day of September), and once again students are asking their homework problems on Stack Overflow and Programmers.SE. We start seeing questions like: A car dealer has 10 salespersons. Each salesperson keeps track of the number of cars sold each m...

discussion featured questions

@GlenH7 you and I wouldn't do it that way, but the teacher may want them to think about doing it that way

user41796

@JimmyHoffa you're right - and I forgot the rules of academia there. The prof will provide a hint to the answers they want to see.

stevetronix

Sep 19, 2013 20:16

@JimmyHoffa @GlenH7 yes, that makes sense, the vector points to a place in memory where they placed a program, so the user is forcing execution to an area of memory. How would a user place a program in memory though?

user41796

buffer overflow

Jimmy Hoffa

@stevetronix Just run a program and the kernel gives you memory for your program

user55340

@stevetronix All the code is in memory - its just at different places in memory.

Jimmy Hoffa

you get the address of the start of an array that holds another program (you could read it in from file) and cause the interrupt to point there. Kernels can access all memory, including the memory in the middle of your usermode programs memory

user41796

the application stack has to live in memory somewhere. Find a trusted application running at the right, low address point. Find an overflow attack on that application and you'll get the trusted application to do your writing for you.

user55340

Sep 19, 2013 20:18

Address space layout randomization

Address space layout randomization (ASLR) is a computer security technique involved in protection from buffer overflow attacks. In order to prevent an attacker from reliably jumping to a particular exploited function in memory (for example), ASLR involves randomly arranging the positions of key data areas of a program, including the base of the executable and the positions of the stack, heap, and libraries, in a process's address space. History In 1997 Memco Software implemented a limited form of stack randomization as part of it SeOS Access Control product. The PaX project first coin...

user41796

props to the google fu!

stevetronix

just looked at the open letter to students link, sorry guys

Jimmy Hoffa

@stevetronix Don't be!

user41796

@stevetronix - no, you're fine

Jimmy Hoffa

You gave us a detailed question, you showed you were thinking about it

user41796

Sep 19, 2013 20:19

MUCH better to ask here in chat. It's a fun exercise for us

user41796

It wouldn't necessarily be appropriate for main though.

stevetronix

I really appreciate all the help from everyone

user55340

@stevetronix Chat is quite reasonable... and yea, not a good question for the main site, it would be 'too broad'

user41796

although at this point, you could pose a hypothetical attack vector once you layout more details

Jimmy Hoffa

@stevetronix I was actually pointing out to @GlenH7 that his approach is likely not what the teacher meant (just as that letter says, we think about various ways the teacher may not be intending for you to think about as he hasn't taught you about them)

user55340

Sep 19, 2013 20:21

And we're not giving you "skip to the end" but rather "other directions of investigation"

user55340

The way the Q&A side works, it needs an answer which may be skip to the end. We don't need to give answers in chat...

user41796

@JimmyHoffa I think I'd target a trusted / kernel mode driver such as keyboard or some other peripheral

user41796

mouse driver would be insidious to tap into

user41796

no expectation of poorly formatted input from there. "It's just a mouse!"

stevetronix

In terms of question b), my thinking was that once a user is in kernel mode they can pretty much do anything, so the disastrous consequences could be attacking data, attacking other programs, or crashing the system

user55340

Sep 19, 2013 20:23

prank from old days - redirect /dev/random into /tty/mouse on an x windows session someone is using.

user41796

@stevetronix correct. Once you've got kernel access then you've p0wn'd the system

user41796

@MichaelT that may actually be the exploit the prof is looking for then

Jimmy Hoffa

@GlenH7 As would I, but the question speaks about a user 'violating the computers protection mechanism' this sounds like a user mode program violating the kernels memory protections to change the interrupt vector for the next interrupt, "violating the computers protection mechanism' doesn't sound to me like exploiting a driver or kernel mode process

user41796

that's fair.

user41796

I'll assume we're not allowed to crack the case and alter the BIOS or MBR via hardware attack, right?

user41796

Sep 19, 2013 20:25

<sighs heavily> (taking away all the fun attack vectors)

Jimmy Hoffa

@stevetronix Yeah you have it, a user who can execute code in kernel mode may do absolutely anything. This also includes them faking users on the system which may have access to other systems, potentially giving them full-privileged access to an entire network of systems

user55340

some fun reading from the Jargon file on priv escalations in the OLD days catb.org/jargon/html/os-and-jedgar.html

user55340

And then there's the second part of catb.org/jargon/html/meaning-of-hack.html

user55340

> Through a simple programming strategy, it was possible for a user program to trick the system into running a portion of the program in ‘master mode’ (supervisor state), in which memory protection does not apply. The program could then poke a large value into its ‘privilege level’ byte (normally write-protected) and could then proceed to bypass all levels of security within the file-management system, patch the system monitor, and do numerous other interesting things.

user55340

One fine day, the system operator on the main CP-V software development system in El Segundo was surprised by a number of unusual phenomena. These included the following:

Tape drives would rewind and dismount their tapes in the middle of a job.

Disk drives would seek back and forth so rapidly that they would attempt to walk across the floor (see walking drives).

The card-punch output device would occasionally start up of itself and punch a ‘lace card’ (card with all positions punched). These would usually jam in the punch.

user55340

Sep 19, 2013 20:29

And a really fun one for those days...

user55340

> The Xerox card reader had two output stackers; it could be instructed to stack into A, stack into B, or stack into A (unless a card was unreadable, in which case the bad card was placed into stacker B). One of the patches installed by the ghosts added some code to the card-reader driver... after reading a card, it would flip over to the opposite stacker. As a result, card decks would divide themselves in half when they were read, leaving the operator to recollate them manually.

stevetronix

@JimmyHoffa true, the whole network aspect as well!

for c) could a possible solution to correct the loophole be to check the parameters being passed in system calls as well as some sort of memory protection

user41796

That's a good start, yes

Jimmy Hoffa

@stevetronix Yeah sure. Think about the first part of what you just said; what would you check the parameters being passed in system calls for, specifically?

user55340

MIPS (IIRC) had a different memory segment that was only writeable by kernel...

user55340

Sep 19, 2013 20:32

3

A: Why in MIPS Architecture program Space divided into 4 areas?

There are logical reasons for the existence of the memory segments: Caches in MIPS need to be initialized by boot code, (unlike x86 caches which are initialized by the hardware). The memory management unit (MMU) in embedded systems is optional, so it is useful to have explicit physical memory r...

stevetronix

@JimmyHoffa perhaps for what part of the Interrupt Vector Table the user is trying to trigger

user55340

user55340

> When bits 31:30 are 11, access is to kernel virtual memory. Only code that is part of the kernel can access this space. References to this space are translated through the TLB. The kernel uses the TLB to map kernel pages in memory as required, possibly in noncontiguous locations. Although pages in kernel space are mapped, they are always associated with real memory. Kernel memory is never paged to secondary storage.

Jimmy Hoffa

@stevetronix Good thoughts. Keep digging around those holes, you have a solid answer for C, but you can improve it with more details about what you might look for and how you might know the request is bunk vs. safe

stevetronix

@JimmyHoffa is there any way to check if the Interrupt Vector is pointing to an area in memory that has been allocated via user mode (by the user) and then impede it from being accessed

Jimmy Hoffa

Sep 19, 2013 20:39

@stevetronix There could be if the kernel made such memory identifiable. How might the kernel do that?

@stevetronix though another thought is: Ask your teacher. He could be looking for totally different information, stuff based on early class topics we don't know about. I'm self taught so about as far removed from knowing what details your course goes over as can be

Based on the questions you posed, the information and answers you're presenting seem totally rational and correct to me, but maybe your teacher was looking for answers like "I would form a security team of members to assess the risks and plan mitigation processes, documented in our disaster recovery ordinance"

stevetronix

ok, I'll try that. So far some of the suggestions are in line with course topics, so that's been helpful

Jimmy Hoffa

(@ThomasOwens disaster recovery "ordinance". Yeah, I thought you'd like that, you can use it.)

stevetronix

Thanks for your time guys!

The Whiteboard

Participants