WHAT CAN A HACKER DO TO YOUR SYSTEM

This is one of the prime questions which needs to be answered before actually taking the vulnerability into account. If there is a vulnerability in the system, the same may be exploited to do a number of thinngs. They can be broadly classified into following

FIRST CHANCE EXCEPTION: This is the most common among exploits. Usually you will not even be able to notice what happened and it is also benign. But if a debugger is attached to the explorer or any application which is causing first chance exception, the application will break into the debugger. First chance exception referes to something wrong which happened while the code was getting executed. Though it should not have happened but the application/OS was able to handle it properly. For example if there is a function which tries to write beyond the memory allocated to it, first chance exception is caused, meaning that this happened once. At a later stage the application/OS will be able to recognise that there is something wrong and correct itself. For example the caller to the above function might introduce a check into the return buffer from the called funciton and see that it has tried to write something into memory which is beyond its access and treat the whole function call as invalid. In case the OS is not able to handle the first chance exception it can happen again and the effect will be propagated beyond one function leading to some catastrophic result.

LOCAL DOS: This is one of the most common exploits of any vulnerability in any software or the operating system. Local DOS means Denial of service which can be done only when the hacker has access to the system. Suppose the operating system is not able to handle a particular case properly and crashes this causes a denial of service which the OS is supposed to give you for some time. During the period of crash or the time when the system is in a 'hang' state you cannot use your system. It leads to loss of productivity and if it is frequent the menace can actually drive you mad. For example there was recently a vulnerability in Windows, in the way the property of a file is used. A file can be programatically with certain attributes( mind you there are dozens of information about the file which the OS has to store and process) so that when you move your mouse over the file, the explorer crashes. You might have seen one of those widows when you read " unreferenced memory access" which means that the windows is trying to access some memory location which is beyond the memory alotted to it. Or you might have seen "windows has encountered a problem and needs to close" kind of windows. This is the case where an exception has happened. In such cases you have no option but to launch the explorer again. This can be done by killing the explorer. Then it launches again. The folders which are open will be closed.

REMOTE DOS: This is the elder brother of the above kind of exploit. Imagine your system can be brought in a "hang" state remotely. Yes this is posssible. You might have observed that which you try to access some sight or click on some link, the explorer crashes or goes into a hang state. This is more harmful because the attacker is able to screw your productivity remotely. he doesn't even need to access the system directly. He just need one of the social engineering techniques to make you go to a particular website and your system is crashed. For example there was a vulnerability in Windows which could be used to cause a remote DOS.
Copy and paste the following code into a file and name the file as crash.html
I am removing the "<" thing in all the places where it should be because I am not able to post if I put it there. script>

// MoBB Demonstration
function Demo() {
var a = document.getElementById('target');
alert(a.object);
}

/script>

Clicking the button below may crash your browser!


input onclick="Demo()" type="button" value="Start Demo!">

object id="target" classid="clsid:FEF10FA2-355E-4e06-9381-9B24D7F7CC88">
/object>



Open the html file and click on the button which appears. Your explorer will crash. This will happen on XP and windows2003 with max Sp1. It was later fixed by Microsoft as one of the security fixes. This crash is because of an integer overflow in explorer which happens because in one of the cases the size which an integer can have was not handled properly. This was an exampleof local DOS. Now let us see how we can expand our thought to cause a remote DOS. If this same link is present on some website and if you click on that link, the same set of steps will follow. Once the code path of windows has reached explorer, after going through the network code path, all that will happen is crash of explorer. Yes you just now hacked Windows ;)

BSOD: This is very serious vulnerability if present in windows. Sometimes you would have seen that suddenly while you were using windws, a blue screen appeared. This is called Blue Screen Of Death (BSOD). When you get a blue screen it means that either your kernel has met some exception which it was not able to handle or some driver in your system has done an operation which in turn could not be handled by the kernel. Thus you get a blue screen. During the blue screen you get a message like "the system is generating the dump" This dump is actually the information which was present in the registers, the stacks and the operation which was being performed. This information is used to debug the issue and verify if it was caused by a kernel exception or becasue of some faulty third party driver. The stack will give you the functions which were called just before it happened and the parameters which were passed. Then you can check which function generated the problematic parameter and which function failed to handle it properly although it was entrusted this job. This is very severe, as it not only needs a reboot of the system but also if you are in the middle of something, say some article or some data that you had written and not saved till now, it will be lost. This might be further exploitable if the attacker can get access to some kernel handle he can exploit this vulnerability to execute some arbitrary code on the system.


LOCAL EOP: The previous line sounds interesting. This part will make it clearer. Suppose there is a stack overflow in the explorer. Say when you enter a very long value in one of the dialog box popped by the explorer, the window crashes. This means that the explorer is trying to push the value in the stack and it is overflowing. Now all the attacker has to do is, sit on your system ( remember he is not an admin, if he was he neednt wear the black hat of hacker to screw your system). You think that since he doesnt have the admin previlege, he cant really do any harm to the system. He has to craft a suitable value to be put into the box. The initial few values dont matter. But suppose the explorer is expecting 100 characters but allowing and processing 120 chars, the values from 101 to 120 are important to the hacker. He will put the location of some harmful exe into the 121th position. When the explorer processes the stack, it thinks that 101th position is the function pointer it just now pushed. So it retrieves the pointer and continues execution. WAIT!!!!!! The explorer is thinking that it has just now got the access to address of one of its function, but since it is 101th location, it actually is executing some function which the hacker wanted. The result can be EOP. This means Elevation Of Previlege. From a non admin he just now got promoted because he can execute any exe in admin mode or system mode.

REMOTE EOP: This is the elder brother of above. Suppose you access some website. There it has put up malformed jpg file. You try to access it by clicking. Windows doesnt process it attributes properly. And a stack overflow occurs. Now the website owner can put proper values inside the file so that things like "cmd> del /Q /S C:\*" can be executed on your machine just becasue you clicked on a link or picture on the web. Worse still some trojan can be installed in your system without you knwoing it and it will report all the credit card numbers and things like that which are critical for you to some one again remotely. Thus a non admin sitting remotely is able to execute an admin previlege program on your system. Beware when you are clicking any unknown link.

The topics covered are regarding exploitation of vulnerability in Windows or some software like adobe photoshop installed on your system and not virus related. A virus works in completely different way. In fact one of these vulnerabilities can be used(misused) to install some virus on you system. For now, though, we would like to forget that.

Prefer const and inline to #define

What this topic is about?
Its about the usage of three keywords in C++, a general guide on when,where and how and how not to use them.

const: It is a keyword which means the variable after it will be a constant.

const int a = 10;

If there is a declaration like this, then the value of 'a' will continue to be 10 through the scope of the variable irrespective of what you assign to it after this.

Thus

const int a =10; a =15; printf("%d", a);

will print 10 and not 15


inline: This keyword in used to tell the compiler that the following function should be treated specially by the compiler which makes it more efficient. But there is a loss of predictability because some compilers treat this as a normal function and still other will treat it as a normal function only in memory intensive situation.


#define: This is a keyword which is used extensively by amateur programmers because on the face it looks a very cute, innocent and helpful keyword. But in actual it creates more problems than it solves......

eg:
#define INTEREST_RATE 10

After this definition the whole code will be process by the preprocessor and where ever it finds INTEREST_RATE, it will be replaced by the value 10. Thus it is called a preprocessor directive. Forget run time, it happens before the code is compiled.

Here you have very well used the #define to be convenient for you.Advantages:1. It is very readable2. It can be changed at one place and the change will be reflected throughout the programDisadvantages:1. Did you notice you are actually using it in an expression. Here the bug factor is a bit mitigate because I have initially used a variable and assigned it the value of the constant. However you are using a mathematical expression and expect everything to be in float. did you just now notice that "RATE_OF_INTEREST " is not a float. The compiler will just replace wherever it finds RATE_OF_INTEREST with its corresponding value it sees at the top.Consider the other dangerous way it could go wrong:

#define RATE_OF_INTEREST 8.5 int main() { int a = RATE_OF_INTEREST ; }

Now of course you get the .5 truncated. But is there any way you can typecast it. No. You are simply using a constant. You cannot typecast a constant. You have to live with the hell you just now created for yourself.HOW #DEFINE SCREWS UP DEBUGGING:In a big program as say windows or other such big software, you wont be debugging using the good old visual studio. So you depend like hell on symbols. Yes tell a person doing some debugging that we dont have symbols he will go mad. Here you will tell him that we have screwed up symbols he will commit suicide. Yes that is what you did just now. You created a screwed up symbol for your code by using #define. Here is how it gets screwed:You will see RATE_OF_INTEREST in your source code but the symbols will not contain this variable. It will simply contain the value 8. whatever you have defined it to be. And you end up guessing why you are not able to trace the variable.
The expression
int a = RATE_OF_INTEREST ;
will appear in the symbol file as
int a = 8.5;
#DEFINE FUNCTIONSL: God that is the Den of bugs. They are good only if you want to ask some interview question but never ever include a #define function in your code. The best example is

#define max(a,b) ((a) > (b) ? (a) : (b)) // I havnt put all those braces for no reason, try to figure out :) int a = 5, b = 0; max(++a, b);max(++a, b+10);

Compile it and I bet you cant predict the result.WHAT TO REPLACE IT WITH:Simple !!! use inline functions for #define functions and const global variables for #define variables.But dont forget the limitations which you have to overcome.

1. const char * const authorName = "Scott Meyers" can replace
#define AUTHOR_NAME "Scott Meyers".


It is a constant character pointer to constant string. You can neither play with the string nor with the pointer. Both are constant.

2. const int RATE_OF_INTEREST cannot replace the #define discussed previously!!!!!beacause it cannot handle float values then. Lesson: Try to be type safe by using as generic type as possible and make sure you declare it as constant or else you end up in the famous global variable black hole

3. inline int max(int a, int b) { return a > b ? a : b; } can replace the #define function mentioned above. Again you are forgetting what you learnt a couple of lines back. To make it type safe. Can it handle float. How to make it handle both float and int. This is needed because you may very well need functions where you are exploiting the truncation property of int. Say int a/3 will return 2 if a= 8. For this use template. A discussion of templates will end up in volumes so let us leave that for now.Still you will get some instances where you will find situations where you have to use #define statements. use them considering that you have put your neck inside the noose. One slip and you are gone. But you can always avoid that one slip :)