In this lesson,
we're going to discuss a buffer overflow.
Now, a buffer overflow occurs when a process in a program
stores data outside the memory range
allocated by the developer.
Now, this begs the question: What exactly is a buffer?
Well, a buffer is simply a temporary storage area
that a program is going to use to store its data.
Let's pretend that you have a glass sitting on a table.
It can hold a certain amount of water, right?
If it's designed to hold 16 ounces of liquid, for example,
and you try to pour 20 ounces in,
well, that cup is going to overflow with water
and the table is going to get wet.
Now, in this example, the glass is our buffer.
And when we overflow it with our data, in our case water,
the extra is going to spill out onto the table
and make a huge mess.
Buffer overflows inside of the technology space
can also create a really big mess for us.
In fact, 85% of the data breaches
were caused by buffer overflow attacks
being used as the initial attack vector.
So it's really important that we take a look
at how a buffer overflow attack actually works.
Now, let's pretend that you wanted to store my phone number
into your contact list.
Here in the United States,
our phone numbers consist of 10 digits.
The first three digits are for our area code,
which represents the city that we live in.
And the last seven digits
represents the person's unique phone number.
But before we had cell phones,
you would simply pick up the phone
and dial seven digits on your phone
because the telephone company assumed
you wanted to place a local call
within your own city or area code first.
So let's pretend that the person
who designed the contact list application on your phone
decide they wanted to save some memory space,
and so they wanted to use the smallest buffer possible.
Therefore, they're going to decide to use an eight-digit buffer
because they're going to assume
that you don't need to store an area code
because all you're going to do
is make local calls all day long.
So let's go ahead and store a made-up phone number
of 555-1234 into our eight-digit buffer.
We're going to call this Buffer A.
Now, when I do this,
you could see that it takes up the first seven boxes
labeled zero through six,
because computers always start counting with zero,
like you learned back in your CompTIA A+ studies.
Now, what happens if we try to enter a number
that's a little bit longer, though?
Well, Buffer A isn't the only memory buffer
that your contact list application can use.
Right after A comes B, and after B comes C, and so on.
So let's consider how we could store a longer phone number.
For example, let's say you're out on vacation at the beach
and you meet somebody,
but they don't live in your city.
Well, in this case, you need to store the area code
and the phone number, like 410-555-1234.
Now, this includes the area code for Annapolis, Maryland,
and we now have 10 digits that we have to store,
but each of our buffers is only eight digits long
because our programmer didn't quite think
through all the different types of phone numbers
that one person might need to store in their contact list.
So our contact list application
tries to store this 10-digit number
inside of an eight-digit buffer,
but the last two digits are going to overflow out of Buffer A
and go into Buffer B.
That is exactly what happens with a buffer overflow.
Now, you may think, "That's not such a big deal, Jason.
Why is that a bad thing?"
Well, to explain that,
we have to get a little bit technical,
so bear with me here for a moment.
Each program is going to reserve a chunk of system memory
when you first start it up and it tries to run.
This allows it to have a place to store data
that needs to use during its processing.
And we call this area a stack.
Now, a stack is reserved area of memory
where the program is going to save the return address
when a function call instruction is going to be received.
Here's an example of a stack
that's organized as first in, last out.
Basically, this means that the first thing
that's being placed in the stack
is going to be the last thing to be removed,
and the data is going to be filled
from the bottom of the memory,
all the way up to the top of the memory.
And actually, when you look at this,
the bottom is actually on the top of our screen,
and the top of the memory
is actually at the bottom of our screen.
Now, I apologize for this
because you think that it looks upside down,
but in actuality,
this is the standard convention that we use
in the IT and technology space.
So I wanted to introduce it to you here
so you won't get confused later on in your studies.
Now, if an attacker tries to place too much information
into that stack,
or they change the values of that return pointer,
they can actually carry out an attack.
And this is what they're attempting to do
with the buffer overflow.
They're attempting to overwrite
the return address of the pointer
so that it will point to a different place in the stack
where they've already placed their malicious code.
That way, when a non-malicious code is being run,
like Microsoft Word, and it hits that return pointer,
it can then return to the attacker's malicious code,
such as the /bin/sh code shown here,
and this will give them a shell or command prompt
on the victim's system
where they can now perform a remote code execution
using that shell.
When an attacker's able to do this,
this is known as "Smashing the Stack".
Now, this occurs when an attacker fills up the buffer
with a NOP, or a non-operation instruction.
So that way, the return address
may hit one of these NOPs,
and then continue all the way down
until it finds the attacker's code and begins to run it.
When this series of NOPs is hit by a non-malicious program,
because the attacker's already filled up the buffer
with all these NOPs
and return address to their malicious code,
this is known as a NOP slide.
Now, the NOP instruction essentially is an instruction
that tells the computer to do nothing
and simply go to the next instruction,
and it'll continue to do this and slide all the way down
until it hits a new instruction or return pointer.
And in this case, it's the final return pointer
that causes the program
to branch over to that memory address
where the attacker placed their malicious code.
Now, one of the mitigations
against the buffer overflow attack
is the use of something known
as the address space layout randomization, or ASLR.
Now, ASLR is a programming technique
that helps prevent an attacker's ability
to guess where the return pointer
for a non-malicious program has been set to call back to
by randomizing the memory addresses
used by our well-known programs,
such as parts of our operating system
or things like Microsoft Office.
Now, ASLR was actually introduced all the way back
with Windows Vista
as a way to prevent these buffer overflow attacks.
But there are methods used by attackers these days
to bypass the address space layout randomization,
or ASLR technique.
This includes things like side channel attacks.
Now, like I said, this is a very technical concept
and it's not one you need to understand in depth
for this particular certification exam.
If you move on to some penetration testing
certifications later on, like the CompTIA PenTest+ exam,
then you're going to come back
and look at buffer overflows in much more technical depth.
But for this exam, you just need to remember
that a buffer overflow
is going to be used to put more data into memory
than it's designed to hold
so that the attacker
can try to get their malicious code to be run.
This is done in an attempt to overflow the buffer
for that non-malicious program
so that the attacker
can get their malicious program into memory
and allow it to be run instead.
So keep this in mind for the exam.