blob: 4ffed53b3d39f109c9947dc08acb7874d644fb41 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
|
```c
void print_msg(const char *msg)
{
printf("There is a problem here;\n");
printf(msg);
}
```
- potentiel crash `null`
- potentielle insertion de commandes printf $\rightarrow$ modifs sur la stack
Fix :
```c
void print_msg(const char *msg)
{
printf("There is a problem here\n");
printf("%s", msg);
}
```
## The LISP syndrome
- Every call tends to evolve to do more than it's own good
- Beware of abstraction layers violations
## Hidden Shells (injections de commandes shell)
- e.g. `system(3)` et `popen(3)`
$\rightarrow$ Learn Unix
- use lower level features to have more control over user input
- check syscall return values
- or use `posix_spawn(3)`
### Creepy scripts
A script called "s" :
```shell
#!/bin/sh
file=$1
rm $file
```
```bash
$ ./s "my_file"
```
```sh
#!/bin/sh
rm "$@"
```
```shell
$ ./s ../myfile
$ ./s -rf /
```
- quoting is not enough
- use `cmd -- args` to stop option parsing
- if you write your own commands don't allow reorder!
- use `set -e`
## Misconceptions
_It's too complicated, it won't be exploited_ : false
- The IISS url overflow (bash commands injection)
- **The venetian blind**
## Examples
- Log4shell : faille sur Log4j, chargement et exécution de code à distance
- Hardbuild : 2014, bug openssl
$\rightarrow$ construire l'app de TODO comme un système bancaire
## Open VS Closed source
- Closed source is **not** more secure
- Lots of people know how to reverse-engineer
- The "sweep under the carpet" effect :
- protection de l'image des sociétés en niant les vulnérabilités
- Accès au code source
- Example: Crafting exploits from Windows Update (http://bitblaze.cs.berkeley.edu/papers/apeg.pdf)
- Simple code should look simple:
- make stuff explicit
- depend on your compiler
- use `strlcpy`
- make the API handle sizes
## Sturgeon's law
**90 % of all software is**:
- crap
- unimportant to optimize
- bogus
- copied and pasted
- imperfect
## The Drepper fallacy
- "But I don't write wrong code" : the reason for the slow adoption of `strlcpy`
- You can't fix everything
- ... therefore don't fix anything
- "Low Hanging Fruit"
## The Unix security model - When do you check that you can access a file ?
- at open and at exec :
- identify who you are: **uid/gid**
- don't forget supplementary groups
- only check the first entry that applies
- **if** uid == file owner, check user bits
- **else** if one group matches file group, check group bits
- **else** match other bits
- see windows and ActiveDirectory
- see PAM and its unreadable config files
- if you are **root**:
- We ignore rights
- open the file
- `fstat` to see if it worked $\implies$ pas obligé
- rights of the process + every fd I own
- **Priv Drop**:
- start as root
- do privileged operations yielding fds
- ... then change identity
- I still have the fds
- example: network server on a privileged port
- HOWTO:
- `setgroups` `setuid` `setgid`
- check that it worked
- `setuid`:
- effective id: demandé par l'application
- saved id: ancien id
- real id: owner of original process
- access controlled by effective id
- notion of **role**:
- an identity (real or imaginary) that can **do things** and **access data**
- stuff you can do
- data you can read
- data you can write
## Designing software
- the more complex the code, the less rights it should have
- sanitize input thoroughly
- ... then you don't need more syntax checks internally
- ... put checks at the semantic level where it makes sense
- trust boundaries
## Designing software VS Unix
- Separate roles should run as separate users
- ... so make it simple to create users
- $\implies$never reuse users for something else
- the technical term for modern software with roles is *privilege separation*
# Exemples
- NATS fail : https://jameshaydon.github.io/nats-fail/
- [[Faille XZ]]
|
