버퍼 오버플로우 공격 방지를 위한 취약 함수 변환기 구현
Implementation of a function translator converting vulnerable functions for preventing buffer overflow attacks
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
C language is frequently used to develop application and system programs. However,programs using C language are vulnerable to buffer overflow attacks. To prevent buffer overflow, programmers have to check boundaries of buffer areas when they develop programs. But vulnerable programs frequently result from improper programming habits and mistakes of programmers. Existing researches for preventing buffer overflow attacks only inform programmers of warnings about vulnerabilities and not remove vulnerabilities in advance so that the programs still include vulnerabilities. In this paper,we propose a function translator which prevents creating programs including buffer overflow vulnerabilities. To prevent creating binary from source including vulnerabilities,the proposed translator searches vulnerable functions which cause buffer overflows, and converts them into secure functions. Accordingly, developing vulnerable programs by programmers which lack in knowledge on security can be prevented.
Abstract
C language is frequently used to develop application and system programs. However,programs using C language are vulnerable to buffer overflow attacks. To prevent buffer overflow, programmers have to check boundaries of buffer areas when they develop programs. But vulnerable programs frequently result from improper programming habits and mistakes of programmers. Existing researches for preventing buffer overflow attacks only inform programmers of warnings about vulnerabilities and not remove vulnerabilities in advance so that the programs still include vulnerabilities. In this paper,we propose a function translator which prevents creating programs including buffer overflow vulnerabilities. To prevent creating binary from source including vulnerabilities,the proposed translator searches vulnerable functions which cause buffer overflows, and converts them into secure functions. Accordingly, developing vulnerable programs by programmers which lack in knowledge on security can be prevented.
참고문헌 (11)
- J. Viega, "ITS4:A static vulnerability scanner for c and c++ code", proceeding of the 16th Annual Computer Security Applications Conference (2000)
- D. Wagner, "A First Step towards Automated Detection of Buffer Overrun Vulnerabilities", Proceedings of the Network and Distributed System Security Symposium (2000)
- Y. Xie, "ARCHER:Using Symbolic,Path-sensitive Analysis to Detect Memory Acess Errors", Proceedings of the 9th European Software Engineering Conference (2003)
- C. Cowan, "StackGuard:Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks", proceeding of the 7th conference on USENIX Security (1998)
- R. Seacord, "Secure Coding in C and C++" (2005), Addison Wesley
- E. Gaugh, "Testing C Programs for Buffer Overflow Vulnerabilities", proceedings of the Network and Distributed System Security Symposium (2003)
- J. Pincus, "Beyond stack smashing: Recent advances in exploiting buffer overruns", IEEE Security and Privacy, 2(4), pp.20~27 (2004)
- 김익수, "관리자 인증 강화를 위한 추가적인 패스워드를 가지는 보안커널모듈 설계 및 구현", 정보처리학회논문지C, 10(6), pp.675~682 (2003), 한국정보처리학회
- Kurt Wall, "The GCC Book" (2003), APress