리눅스 메모리 보호기법, 보안시스템의 이해

2013년 코드게이트 국제해킹방어대회 제1회 주니어 행사 때 발표했었던 '리눅스 메모리 보호기법' 에 대한 발표 자료 입니다.

버퍼 오버플로우 (Buffer Overflow) 라는 큰 틀로 내용이 이어지고 그에 대한 공격, 방어 기법에 대한 얘기가 있습니다.

Transcript

1. ֿܻझ
   ݫݽܻ
   ࠁഐӝߨ
   
   ,4*"
   ࠗ؀಴
   ӣక਌
   YPEOS!TNBSULTJBPSH
   IUUQGCDPNYPEOS
   
2. ೠҴ೟ࢤ*5ো೤,4*"
   
3. 4:45&.
   )"$,*/(
   .FNPSZ
   1SPUFDUJPO
   .FDIBOJTN
   PG
   -JOVY
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
4. #VGGFS
   0WFSGMPX
   
   •  ࢎਊ੗о
   ੑ۱ೠ
   ؘ੉ఠ੄
   ௼ӝо
   ցޖ
   җೞৈ
   ઁೠ ػ
   ߡಌ੄
   ਊ۝ਸ
   ֈ୛ߡ۷ਸٸ
   ࢤӝח
   ߡӒܳ
   ੉ਊ ೧
   ೧ఊೞח
   ӝࣿ
   •  ߡಌ
   
   ஹೊఠ੄
   ઱ӝর
   ੢஖৬
   ઱߸੢஖
   ࢎ੉ীࢲ
   ؘ ੉ఠܳ
   ઱Ҋ߉ਸٸ
   ੿ࠁܳ
   ੐द۽
   ӝর೧فח
   ੐द੷ ੢ҕр
   
5. #VGGFS
   0WFSGMPX
   
   •  ࢎਊ੗о
   ੑ۱ೠ
   ؘ੉ఠ੄
   ௼ӝо
   ցޖ
   җೞৈ
   ઁೠ ػ
   ߡಌ੄
   ਊ۝ਸ
   ֈ୛ߡ۷ਸٸ
   ࢤӝח
   ߡӒܳ
   ੉ਊ ೧
   ೧ఊೞח
   ӝࣿ
   •  ߡಌ
   
   ஹೊఠ੄
   ઱ӝর
   ੢஖৬
   ઱߸੢஖
   ࢎ੉ীࢲ
   ؘ ੉ఠܳ
   ઱Ҋ߉ਸٸ
   ੿ࠁܳ
   ੐द۽
   ӝর೧فח
   ੐द੷ ੢ҕр
   
6. #VGGFS
   0WFSGMPX
   
   낮은
7. #VGGFS
   0WFSGMPX
   
   낮은
8. #VGGFS
   0WFSGMPX
   
   BUFFER SFP RET #6''&3
   –
   4'1
   –
   3&5
   –
   "SHD"SHW
   –
   ജ҃߸ࣻ
   
   ౵ੌݺ
   
9. #VGGFS
   0WFSGMPX
   
   BUFFER SFP RET #6''&3
   –
   4'1
   –
   3&5
   –
   "SHD"SHW
   –
   ജ҃߸ࣻ
   
   ౵ੌݺ
   "
   "
   "
   "
   "
   "
   "
   "
   "
   "
   "
   "
   "
   "
   "
   "
   "
   "
   "
   
10. 4UBDL
    낮은
11. 4UBDL
    낮은
12. .FNPSZ
    ழօ ਬ੷ )*()
    -08
    
13. .FNPSZ
    ழօ ਬ੷ )*()
    -08
    STACK
14. #VGGFS
    0WFSGMPX
    
    
    
    #0'
    ޙઁಽ੉
    ਬഋ
    
    
    
15. #VGGFS
    0WFSGMPX
    
    JOU
    NBJO JOU
    BSHD
    DIBS
    BSHW<>
    \
    
16. #VGGFS
    0WFSGMPX
    
    JOU
    NBJO
    \
    
17. #VGGFS
    0WFSGMPX
    
    
18. #65
    
24. .FNPSZ
    1SPUFDUJPO
    
    %&1 %BUB
    &YFDVUJPO
    1SFWFOUJPO
    
25. .FNPSZ
    1SPUFDUJPO
    
    %&1 %BUB
    &YFDVUJPO
    1SFWFOUJPO
    BUFFER
26. .FNPSZ
    1SPUFDUJPO
    
    %&1 %BUB
    &YFDVUJPO
    1SFWFOUJPO
    BUFFER
27. .FNPSZ
    1SPUFDUJPO
    
    %&1 %BUB
    &YFDVUJPO
    1SFWFOUJPO
    BUFFER
28. .FNPSZ
    1SPUFDUJPO
    
    35- 3FUVSOUPMJCD
    BUFFER
29. .FNPSZ
    1SPUFDUJPO
    
    35- 3FUVSOUPMJCD
    BUFFER SFP RET "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    
30. .FNPSZ
    1SPUFDUJPO
    
    35- 3FUVSOUPMJCD
    BUFFER SFP RET "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    TZTUFN
    FYFDM
    CJOTI
    
31. .FNPSZ
    1SPUFDUJPO
    
    "4-3 "EESFTT
    4QBDF
    -BZPVU
    3BOEPNJ[BUJPO
    
    
32. .FNPSZ
    1SPUFDUJPO
    
    "4-3 "EESFTT
    4QBDF
    -BZPVU
    3BOEPNJ[BUJPO
    
    
33. .FNPSZ
    1SPUFDUJPO
    
    "4-3 "EESFTT
    4QBDF
    -BZPVU
    3BOEPNJ[BUJPO
    
    BUFFER
34. .FNPSZ
    1SPUFDUJPO
    
    "4-3 "EESFTT
    4QBDF
    -BZPVU
    3BOEPNJ[BUJPO
    
    BUFFER
35. .FNPSZ
    1SPUFDUJPO
    
    "4-3 "EESFTT
    4QBDF
    -BZPVU
    3BOEPNJ[BUJPO
    
    BUFFER
36. .FNPSZ
    1SPUFDUJPO
    
    "4-3 "EESFTT
    4QBDF
    -BZPVU
    3BOEPNJ[BUJPO
    
    BUFFER
37. .FNPSZ
    1SPUFDUJPO
    
    "4-3 "EESFTT
    4QBDF
    -BZPVU
    3BOEPNJ[BUJPO
    
    BUFFER
38. .FNPSZ
    1SPUFDUJPO
    
    "4-3 "EESFTT
    4QBDF
    -BZPVU
    3BOEPNJ[BUJPO
    
    BUFFER
39. .FNPSZ
    1SPUFDUJPO
    
    "4-3 "EESFTT
    4QBDF
    -BZPVU
    3BOEPNJ[BUJPO
    
    BUFFER
40. .FNPSZ
    1SPUFDUJPO
    
    "4-3 "EESFTT
    4QBDF
    -BZPVU
    3BOEPNJ[BUJPO
    
    BUFFER
41. .FNPSZ
    1SPUFDUJPO
    
    "4-3 "EESFTT
    4QBDF
    -BZPVU
    3BOEPNJ[BUJPO
    
    BUFFER
43. ↑
    ҅ࣘ೧ࢲ
    ߄Շח
    ઱ࣗ
    ↑
    Ҋ੿
    ػ
    ઱ࣗ
    
44. ↑
    ҅ࣘ೧ࢲ
    ߄Շח
    ઱ࣗ
    ↑
    Ҋ੿
    ػ
    ઱ࣗ
    
45. .FNPSZ
    1SPUFDUJPO
    
    "4$**
    "SNPS
    
46. .FNPSZ
    1SPUFDUJPO
    
    "4$**
    "SNPS
    BUFFER
47. .FNPSZ
    1SPUFDUJPO
    
    "4$**
    "SNPS
    BUFFER
48. .FNPSZ
    1SPUFDUJPO
    
    $BOBSZ
    
    
    BUFFER SFP RET
49. .FNPSZ
    1SPUFDUJPO
    
    $BOBSZ
    
    
    BUFFER SFP CANARY RET
50. .FNPSZ
    1SPUFDUJPO
    
    $BOBSZ
    
    
    BUFFER SFP CANARY RET "
    "
    "
    "
    "
    "
    "
    "
    "
    "
    
    
    
    
    "
    "
    "
    "
    "
    
51. .FNPSZ
    1SPUFDUJPO
    
    $BOBSZ
    
    
    CANARY RANDOM
52. .FNPSZ
    1SPUFDUJPO
    
    $BOBSZ
    
    
    CANARY RANDOM TERMINATOR
53. .FNPSZ
    1SPUFDUJPO
    
    $BOBSZ
    
    
    CANARY RANDOM TERMINATOR NULL
54. DEP
55. DEP + ASLR
56. DEP + ASLR + ASCII Armor
57. DEP + ASLR + ASCII Armor + Canary
58. ೠҴ೟ࢤ*5ো೤,4*"