1 00:00:00,000 --> 00:00:00,900 In this lesson, 2 00:00:00,900 --> 00:00:03,330 we're going to discuss a buffer overflow. 3 00:00:03,330 --> 00:00:06,120 Now, a buffer overflow occurs when a process in a program 4 00:00:06,120 --> 00:00:07,980 stores data outside the memory range 5 00:00:07,980 --> 00:00:09,810 allocated by the developer. 6 00:00:09,810 --> 00:00:12,930 Now, this begs the question: What exactly is a buffer? 7 00:00:12,930 --> 00:00:15,420 Well, a buffer is simply a temporary storage area 8 00:00:15,420 --> 00:00:17,640 that a program is going to use to store its data. 9 00:00:17,640 --> 00:00:19,800 Let's pretend that you have a glass sitting on a table. 10 00:00:19,800 --> 00:00:21,810 It can hold a certain amount of water, right? 11 00:00:21,810 --> 00:00:24,390 If it's designed to hold 16 ounces of liquid, for example, 12 00:00:24,390 --> 00:00:26,070 and you try to pour 20 ounces in, 13 00:00:26,070 --> 00:00:28,440 well, that cup is going to overflow with water 14 00:00:28,440 --> 00:00:30,120 and the table is going to get wet. 15 00:00:30,120 --> 00:00:32,670 Now, in this example, the glass is our buffer. 16 00:00:32,670 --> 00:00:35,490 And when we overflow it with our data, in our case water, 17 00:00:35,490 --> 00:00:37,410 the extra is going to spill out onto the table 18 00:00:37,410 --> 00:00:39,120 and make a huge mess. 19 00:00:39,120 --> 00:00:41,670 Buffer overflows inside of the technology space 20 00:00:41,670 --> 00:00:43,920 can also create a really big mess for us. 21 00:00:43,920 --> 00:00:45,758 In fact, 85% of the data breaches 22 00:00:45,758 --> 00:00:48,210 were caused by buffer overflow attacks 23 00:00:48,210 --> 00:00:50,520 being used as the initial attack vector. 24 00:00:50,520 --> 00:00:52,260 So it's really important that we take a look 25 00:00:52,260 --> 00:00:55,290 at how a buffer overflow attack actually works. 26 00:00:55,290 --> 00:00:57,330 Now, let's pretend that you wanted to store my phone number 27 00:00:57,330 --> 00:00:58,890 into your contact list. 28 00:00:58,890 --> 00:01:00,000 Here in the United States, 29 00:01:00,000 --> 00:01:02,370 our phone numbers consist of 10 digits. 30 00:01:02,370 --> 00:01:04,590 The first three digits are for our area code, 31 00:01:04,590 --> 00:01:06,480 which represents the city that we live in. 32 00:01:06,480 --> 00:01:07,710 And the last seven digits 33 00:01:07,710 --> 00:01:10,050 represents the person's unique phone number. 34 00:01:10,050 --> 00:01:11,760 But before we had cell phones, 35 00:01:11,760 --> 00:01:12,900 you would simply pick up the phone 36 00:01:12,900 --> 00:01:14,670 and dial seven digits on your phone 37 00:01:14,670 --> 00:01:16,500 because the telephone company assumed 38 00:01:16,500 --> 00:01:18,270 you wanted to place a local call 39 00:01:18,270 --> 00:01:20,790 within your own city or area code first. 40 00:01:20,790 --> 00:01:22,500 So let's pretend that the person 41 00:01:22,500 --> 00:01:25,080 who designed the contact list application on your phone 42 00:01:25,080 --> 00:01:27,060 decide they wanted to save some memory space, 43 00:01:27,060 --> 00:01:29,730 and so they wanted to use the smallest buffer possible. 44 00:01:29,730 --> 00:01:32,580 Therefore, they're going to decide to use an eight-digit buffer 45 00:01:32,580 --> 00:01:33,420 because they're going to assume 46 00:01:33,420 --> 00:01:35,220 that you don't need to store an area code 47 00:01:35,220 --> 00:01:36,180 because all you're going to do 48 00:01:36,180 --> 00:01:38,430 is make local calls all day long. 49 00:01:38,430 --> 00:01:41,160 So let's go ahead and store a made-up phone number 50 00:01:41,160 --> 00:01:45,720 of 555-1234 into our eight-digit buffer. 51 00:01:45,720 --> 00:01:47,580 We're going to call this Buffer A. 52 00:01:47,580 --> 00:01:48,600 Now, when I do this, 53 00:01:48,600 --> 00:01:50,880 you could see that it takes up the first seven boxes 54 00:01:50,880 --> 00:01:52,410 labeled zero through six, 55 00:01:52,410 --> 00:01:54,600 because computers always start counting with zero, 56 00:01:54,600 --> 00:01:57,690 like you learned back in your CompTIA A+ studies. 57 00:01:57,690 --> 00:01:59,580 Now, what happens if we try to enter a number 58 00:01:59,580 --> 00:02:01,110 that's a little bit longer, though? 59 00:02:01,110 --> 00:02:03,450 Well, Buffer A isn't the only memory buffer 60 00:02:03,450 --> 00:02:05,790 that your contact list application can use. 61 00:02:05,790 --> 00:02:09,479 Right after A comes B, and after B comes C, and so on. 62 00:02:09,479 --> 00:02:12,750 So let's consider how we could store a longer phone number. 63 00:02:12,750 --> 00:02:15,300 For example, let's say you're out on vacation at the beach 64 00:02:15,300 --> 00:02:16,320 and you meet somebody, 65 00:02:16,320 --> 00:02:17,760 but they don't live in your city. 66 00:02:17,760 --> 00:02:19,920 Well, in this case, you need to store the area code 67 00:02:19,920 --> 00:02:24,920 and the phone number, like 410-555-1234. 68 00:02:25,170 --> 00:02:27,870 Now, this includes the area code for Annapolis, Maryland, 69 00:02:27,870 --> 00:02:30,210 and we now have 10 digits that we have to store, 70 00:02:30,210 --> 00:02:33,360 but each of our buffers is only eight digits long 71 00:02:33,360 --> 00:02:35,070 because our programmer didn't quite think 72 00:02:35,070 --> 00:02:36,870 through all the different types of phone numbers 73 00:02:36,870 --> 00:02:39,810 that one person might need to store in their contact list. 74 00:02:39,810 --> 00:02:41,910 So our contact list application 75 00:02:41,910 --> 00:02:43,710 tries to store this 10-digit number 76 00:02:43,710 --> 00:02:45,570 inside of an eight-digit buffer, 77 00:02:45,570 --> 00:02:49,080 but the last two digits are going to overflow out of Buffer A 78 00:02:49,080 --> 00:02:50,820 and go into Buffer B. 79 00:02:50,820 --> 00:02:53,760 That is exactly what happens with a buffer overflow. 80 00:02:53,760 --> 00:02:56,100 Now, you may think, "That's not such a big deal, Jason. 81 00:02:56,100 --> 00:02:57,780 Why is that a bad thing?" 82 00:02:57,780 --> 00:02:58,920 Well, to explain that, 83 00:02:58,920 --> 00:03:00,840 we have to get a little bit technical, 84 00:03:00,840 --> 00:03:02,670 so bear with me here for a moment. 85 00:03:02,670 --> 00:03:05,280 Each program is going to reserve a chunk of system memory 86 00:03:05,280 --> 00:03:07,740 when you first start it up and it tries to run. 87 00:03:07,740 --> 00:03:09,450 This allows it to have a place to store data 88 00:03:09,450 --> 00:03:11,430 that needs to use during its processing. 89 00:03:11,430 --> 00:03:13,620 And we call this area a stack. 90 00:03:13,620 --> 00:03:15,750 Now, a stack is reserved area of memory 91 00:03:15,750 --> 00:03:17,640 where the program is going to save the return address 92 00:03:17,640 --> 00:03:20,370 when a function call instruction is going to be received. 93 00:03:20,370 --> 00:03:21,570 Here's an example of a stack 94 00:03:21,570 --> 00:03:24,360 that's organized as first in, last out. 95 00:03:24,360 --> 00:03:26,160 Basically, this means that the first thing 96 00:03:26,160 --> 00:03:27,360 that's being placed in the stack 97 00:03:27,360 --> 00:03:29,310 is going to be the last thing to be removed, 98 00:03:29,310 --> 00:03:30,390 and the data is going to be filled 99 00:03:30,390 --> 00:03:31,830 from the bottom of the memory, 100 00:03:31,830 --> 00:03:33,750 all the way up to the top of the memory. 101 00:03:33,750 --> 00:03:35,430 And actually, when you look at this, 102 00:03:35,430 --> 00:03:37,680 the bottom is actually on the top of our screen, 103 00:03:37,680 --> 00:03:38,520 and the top of the memory 104 00:03:38,520 --> 00:03:40,620 is actually at the bottom of our screen. 105 00:03:40,620 --> 00:03:41,730 Now, I apologize for this 106 00:03:41,730 --> 00:03:43,620 because you think that it looks upside down, 107 00:03:43,620 --> 00:03:44,550 but in actuality, 108 00:03:44,550 --> 00:03:46,380 this is the standard convention that we use 109 00:03:46,380 --> 00:03:48,360 in the IT and technology space. 110 00:03:48,360 --> 00:03:49,980 So I wanted to introduce it to you here 111 00:03:49,980 --> 00:03:52,650 so you won't get confused later on in your studies. 112 00:03:52,650 --> 00:03:54,990 Now, if an attacker tries to place too much information 113 00:03:54,990 --> 00:03:55,950 into that stack, 114 00:03:55,950 --> 00:03:58,470 or they change the values of that return pointer, 115 00:03:58,470 --> 00:04:00,390 they can actually carry out an attack. 116 00:04:00,390 --> 00:04:01,770 And this is what they're attempting to do 117 00:04:01,770 --> 00:04:03,090 with the buffer overflow. 118 00:04:03,090 --> 00:04:04,260 They're attempting to overwrite 119 00:04:04,260 --> 00:04:06,000 the return address of the pointer 120 00:04:06,000 --> 00:04:08,250 so that it will point to a different place in the stack 121 00:04:08,250 --> 00:04:10,680 where they've already placed their malicious code. 122 00:04:10,680 --> 00:04:13,470 That way, when a non-malicious code is being run, 123 00:04:13,470 --> 00:04:16,500 like Microsoft Word, and it hits that return pointer, 124 00:04:16,500 --> 00:04:18,899 it can then return to the attacker's malicious code, 125 00:04:18,899 --> 00:04:21,660 such as the /bin/sh code shown here, 126 00:04:21,660 --> 00:04:23,730 and this will give them a shell or command prompt 127 00:04:23,730 --> 00:04:24,990 on the victim's system 128 00:04:24,990 --> 00:04:27,270 where they can now perform a remote code execution 129 00:04:27,270 --> 00:04:28,770 using that shell. 130 00:04:28,770 --> 00:04:30,510 When an attacker's able to do this, 131 00:04:30,510 --> 00:04:33,000 this is known as "Smashing the Stack". 132 00:04:33,000 --> 00:04:35,250 Now, this occurs when an attacker fills up the buffer 133 00:04:35,250 --> 00:04:37,920 with a NOP, or a non-operation instruction. 134 00:04:37,920 --> 00:04:39,510 So that way, the return address 135 00:04:39,510 --> 00:04:41,850 may hit one of these NOPs, 136 00:04:41,850 --> 00:04:43,290 and then continue all the way down 137 00:04:43,290 --> 00:04:46,260 until it finds the attacker's code and begins to run it. 138 00:04:46,260 --> 00:04:49,200 When this series of NOPs is hit by a non-malicious program, 139 00:04:49,200 --> 00:04:50,850 because the attacker's already filled up the buffer 140 00:04:50,850 --> 00:04:52,020 with all these NOPs 141 00:04:52,020 --> 00:04:54,030 and return address to their malicious code, 142 00:04:54,030 --> 00:04:56,580 this is known as a NOP slide. 143 00:04:56,580 --> 00:04:59,100 Now, the NOP instruction essentially is an instruction 144 00:04:59,100 --> 00:05:00,900 that tells the computer to do nothing 145 00:05:00,900 --> 00:05:02,910 and simply go to the next instruction, 146 00:05:02,910 --> 00:05:05,760 and it'll continue to do this and slide all the way down 147 00:05:05,760 --> 00:05:08,490 until it hits a new instruction or return pointer. 148 00:05:08,490 --> 00:05:10,710 And in this case, it's the final return pointer 149 00:05:10,710 --> 00:05:11,700 that causes the program 150 00:05:11,700 --> 00:05:13,800 to branch over to that memory address 151 00:05:13,800 --> 00:05:16,170 where the attacker placed their malicious code. 152 00:05:16,170 --> 00:05:17,220 Now, one of the mitigations 153 00:05:17,220 --> 00:05:18,990 against the buffer overflow attack 154 00:05:18,990 --> 00:05:20,220 is the use of something known 155 00:05:20,220 --> 00:05:24,420 as the address space layout randomization, or ASLR. 156 00:05:24,420 --> 00:05:26,580 Now, ASLR is a programming technique 157 00:05:26,580 --> 00:05:28,230 that helps prevent an attacker's ability 158 00:05:28,230 --> 00:05:29,610 to guess where the return pointer 159 00:05:29,610 --> 00:05:32,700 for a non-malicious program has been set to call back to 160 00:05:32,700 --> 00:05:34,470 by randomizing the memory addresses 161 00:05:34,470 --> 00:05:36,150 used by our well-known programs, 162 00:05:36,150 --> 00:05:37,800 such as parts of our operating system 163 00:05:37,800 --> 00:05:40,170 or things like Microsoft Office. 164 00:05:40,170 --> 00:05:42,450 Now, ASLR was actually introduced all the way back 165 00:05:42,450 --> 00:05:43,590 with Windows Vista 166 00:05:43,590 --> 00:05:45,900 as a way to prevent these buffer overflow attacks. 167 00:05:45,900 --> 00:05:48,480 But there are methods used by attackers these days 168 00:05:48,480 --> 00:05:51,120 to bypass the address space layout randomization, 169 00:05:51,120 --> 00:05:52,890 or ASLR technique. 170 00:05:52,890 --> 00:05:55,380 This includes things like side channel attacks. 171 00:05:55,380 --> 00:05:57,870 Now, like I said, this is a very technical concept 172 00:05:57,870 --> 00:05:59,640 and it's not one you need to understand in depth 173 00:05:59,640 --> 00:06:02,100 for this particular certification exam. 174 00:06:02,100 --> 00:06:03,840 If you move on to some penetration testing 175 00:06:03,840 --> 00:06:07,260 certifications later on, like the CompTIA PenTest+ exam, 176 00:06:07,260 --> 00:06:08,280 then you're going to come back 177 00:06:08,280 --> 00:06:11,340 and look at buffer overflows in much more technical depth. 178 00:06:11,340 --> 00:06:13,410 But for this exam, you just need to remember 179 00:06:13,410 --> 00:06:14,520 that a buffer overflow 180 00:06:14,520 --> 00:06:16,650 is going to be used to put more data into memory 181 00:06:16,650 --> 00:06:17,970 than it's designed to hold 182 00:06:17,970 --> 00:06:18,803 so that the attacker 183 00:06:18,803 --> 00:06:21,150 can try to get their malicious code to be run. 184 00:06:21,150 --> 00:06:23,430 This is done in an attempt to overflow the buffer 185 00:06:23,430 --> 00:06:25,020 for that non-malicious program 186 00:06:25,020 --> 00:06:25,853 so that the attacker 187 00:06:25,853 --> 00:06:27,420 can get their malicious program into memory 188 00:06:27,420 --> 00:06:29,040 and allow it to be run instead. 189 00:06:29,040 --> 00:06:30,903 So keep this in mind for the exam.