A Signature-free Buffer Overflow Attack Blocker
[attachment=13231]
[attachment=13233]
[attachment=13235]
[attachment=13236]

Abstract:-

This project propose SigFree, a realtime, signature-free, out-ofthe-box, application layer blocker for preventing buffer overflow attacks, one of the most serious cyber security threats. SigFree can filter out code-injection buffer overflow attack messages targeting at various Internet services such as web service. Motivated by the observation that buffer overflow attacks typically contain executables whereas legitimate client requests never contain executables in most Internet services, SigFree blocks attacks by detecting the presence of code. SigFree first blindly dissembles and extracts instruction sequences from a request. It then applies a novel technique called code abstraction, which uses data flow anomaly to prune useless instructions in an instruction sequence. Finally it compares the number of useful instructions to a threshold to determine if this instruction sequence contains code. SigFree is signature free, thus it can block new and unknown buffer overflow attacks; SigFree is also immunized from most attack-side code obfuscation methods. Since SigFree is transparent to the servers being protected, it is good for economical Internet wide deployment with very low deployment and maintenance cost. We implemented and tested SigFree; our experimental study showed that SigFree could block all types of codeinjection attack packets (above 250) tested in our experiments. Moreover, SigFree causes negligible throughput degradation to normal client requests



Existence System:-


Detection of Data Flow Anomalies There are static or dynamic methods to detect data flow anomalies in the software reliability and testing field. Static methods are not suitable in our case due to its slow speed; dynamic methods are not suitable either due to the need for real execution of a program with some inputs.



Proposed System:-

Their scheme is rule-based, whereas SigFree is a generic approach which does not require any pre-known patterns. Then, it uses the found patterns and a data flow analysis technique called program slicing to analyze the packet’s payload to see if the packet really contains code Four rules (or cases) are discussed in their project: Case 1 not only assumes the occurrence of the call/jmp instructions, but also expects the push instruction appears before the branch; Case 2 relies on the interrupt instruction; Case 3 relies on instruction ret; Case 4 exploits hidden branch instructions. Besides, they used a special rule to detect polymorphic exploit code which contains a loop. Although they mentioned that the above rules are initial sets and may require updating with time, it is always possible for attackers to bypass those pre-known rules. Moreover, more rules mean more overhead and longer latency in filtering packets. In contrast, SigFree exploits a different data flow analysis technique, which is much harder for exploit code to evade.


We proposed SigFree, a realtime, signature free, out of- the-box blocker that can filter code-injection buffer overflow attack messages, one of the most serious cyber security threats, to various Internet services. SigFree does not require any signatures, thus it can block new, unknown attacks




We have implemented a SigFree prototype as a proxy to protect web servers. Our empirical study shows that there exists clean-cut “boundaries” between codeembedded payloads and data payloads when our codedata separation criteria are applied. We have identified the “boundaries” (or thresholds) and been able to detect/ block all 50 attack packets generated by Metasploitframework , all 200 polymorphic shellcode packets generated by two well-known polymorphic shellcode engine ADMmutate and CLET , and worm Slammer, CodeRed and a CodeRed variation, when they are well mixed with various types of data packets. Also, our experiment results show that the throughput degradation caused by SigFree is negligible.


Architecture:-





Main Modules:-

1.Prevention/Detection of Buffer Overflows

Throughout the history of cyber security, buffer overflow is one of the most serious vulnerabilities in computer systems. Buffer overflow vulnerability is a root cause for most of the cyber attacks such as server
breaking-in, worms, zombies, and botnets. Buffer overflow attacks are the most popular choice in these attacks, as they provide substantial control over a victim.

Class 1A: Finding bugs in source code. Buffer overflows are fundamentally due to programming bugs. Accordingly, various bug-finding tools have been developed. The bug-finding techniques used in
these tools, which in general belong to static analysis, include but not limited to model checking and bugs-asdeviant- behavior.

Compiler extensions. “If the source code is available, a developer can add buffer overflow detection automatically to a program by using a modified compiler.”

Class 1C: OS modifications. Modifying some aspects of the operating system may prevent buffer overflows such as Pax , LibSafe and e-NeXsh .

Class 1C techniques need to modify the OS. In contrast, SigFree does not need any modification of the OS.

Class 1D: Hardware modifications. A main idea of hardware modification is to store all return addresses on the processor [41]. In this way, no input can change any return address.

Class 1E: Defense-side obfuscation. Address Space Layout Randomization (ASLR) is a main component of PaX . Bhatkar and Sekar proposed a comprehensive address space randomization scheme. Addressspace randomization, in its general form , can detect exploitation of all memory errors.

Class 1F: Capturing code running symptoms of buffer overflow attacks. Fundamentally, buffer overflows area code running symptom. If such unique symptoms can be precisely captured, all buffer overflows can be detected.



2.Worm Detection and Signature Generation

The implementation of their approach is resilient to a number of code transformation techniques. Although their techniques also handle binary code, they perform offline analysis. In contrast, SigFree is an online attack blocker. As such, their techniques and SigFree are complementary to each other with different purposes. Moreover, unlike
SigFree, their techniques may not be suitable to block the code contained in every attack packet, because some buffer overflow code is so simple that very little control flow information can be exploited

3. SigFree Attack Model

An attacker exploits a buffer overflow vulnerability of a web server by sending a crafted request, which contains a malicious payload. Figure 3 shows the format of a HTTP request. There are several HTTP request methods among which GET and POST are most often used by attackers. Although HTTP 1.1 does not allow GET to have a request body, some web servers such as Microsoft IIS still dutifully read the request-body according to the request-header’s instructions (the CodeRed worm exploited this very problem). The position of a malicious payload is determined by the exploited vulnerability. A malicious payload may be embedded in the Request-URI field as a query parameter. However, as the maximum length of Request-URI is limited, the size of a malicious payload, hence the behavior of such a buffer overflow attack, is constrained. It is more common that a buffer overflow attack payload is embedded in Request-Body of a POST method request. Technically, a malicious payload may also be embedded
in Request-Header, although this kind of attacks have not been observed yet. In this work, we assume an attacker can use any request method and embed the malicious code in any field.


4. URI decoder.
The specification for URLs limits the allowed characters in a Request-URI to only a subset of the ASCII character set. This means that the query parameters of a request-URI beyond this subset should
be encoded . Because a malicious payload may be embedded in the request-URI as a request parameter, the first step of SigFree is to decode the request-URI.

5. ASCII Filter.

Malicious executable code are normally binary strings. In order to guarantee the throughput and response time of the protected web system, if the query parameters of the request-URI and request-body of a request
are both printable ASCII ranging from 20-7E in hex, SigFree allows the request to pass we will discuss a special type of executable codes called
alphanumeric shellcodes that actually use printable ASCII) .

6. Instruction sequences distiller (ISD).

This module distills all possible instruction sequences from the query parameters of Request-URI and Request-Body (if the request
has one). Instruction sequences analyzer (ISA). Using all the instruction sequences distilled from the instruction sequences distiller as the inputs, thismodule analyzes these instruction sequences to determine whether one of them is (a fragment of) a program.



Conclusion
We proposed SigFree, a realtime, signature free, outof- the-box blocker that can filter code-injection buffer overflow attack messages, one of the most serious cyber security threats, to various Internet services. SigFree does not require any signatures, thus it can block new,
unknown attacks. SigFree is immunized from most attack-side code obfuscation methods, good for economical Internet wide deployment with little maintenance cost and negligible throughput degradation, and can also handle encrypted SSL messages.


Hardware Requirements:

• System : Pentium IV 2.4 GHz.
• Hard Disk : 40 GB.
• Floppy Drive : 1.44 Mb.
• Monitor : 15 VGA Colour.
• Mouse : Logitech.
• Ram : 512 Mb.


Software Requirements:-

Language: Java / Dot Net

OS: Windows XP


What is SigFree?
SigFree (signature free) is a technique, thus it can block the new and unknown buffer overflow attack. SigFree could block all types of code injection
attack packets. So SigFree is transparent to the servers being protected.
What is Buffer Overflow Attack?
Buffer overflow is one of the most serious vulnerabilities in computer systems. It is a root cause for most of the cyber attacks such as server breaking-in, worms and so on. A buffer overflow occurs during program execution when a fixed-size buffer has had too much data copied into it. This causes the data to overwrite into adjacent memory locations.



How to block the Buffer Overflow Attack?
Using SigFree technique, we can block the buffer overflow attack. The following techniques are used in this project.
1. URI decoder: This means that the query parameters of a request-URI beyond this subset should be encoded.



2. ASCII Filter: Malicious executable codes are normally binary strings. In order to guarantee the throughput and response time of the protected web system, if the query parameters of the request-URI and request-body of a request are both printable ASCII codes.


3. Instruction sequences distiller: This module distills all possible instruction sequences from the query parameters of Request-URI and Request-Body.


4. Instruction sequences analyzer: Using all the instruction sequences distilled from the instruction sequences distiller as the inputs, this module analyzes these instruction sequences to determine whether one of them is a program.





We used web services in this project to make HTTP request.

What is web service?
The term Web services describes a standardized way of integrating Web-based applications. Web Services can convert your application into a Web-application, which can publish its function or message to the rest of the world.
In this project we created three web services for different request.
Why we are using web service?
In this project, we perform sigfree process by sending HTTP request to server (i.e. URL). For analyzing that URL, we have to extract the response of that URL and check whether the URL contains pure data or executable codes. By using web service, we can easily retrieve the response of specified URL.




source code available on the page http://seminarprojects.kreviewitem.php?id=141