苹果安全编码指南：防御缓冲区溢出与注入攻击

需积分: 9 149 浏览量更新于2024-07-19 收藏 1.19MB PDF 举报

"Secure Coding Guide (Apple Inc)" 是苹果公司发布的一份关于代码安全的内部指导文档，旨在帮助开发者遵循最佳实践，防止各种安全漏洞，包括缓冲区溢出、输入验证、竞态条件、权限提升、用户界面设计、辅助程序和服务的安全设计以及注入攻击和跨站脚本(XSS)等问题。在文档的开头，它介绍了安全编码的重要性，指出黑客、破解者和攻击者无处不在，无论哪个平台都有可能受到攻击。文档强调了如何使用这份指南，并提供了其他相关资源的链接。接着，它详细阐述了各种类型的 security vulnerabilities： 1. **缓冲区溢出**：当程序写入数据超过预分配的内存空间时，可能导致系统崩溃或恶意代码执行。缓冲区溢出分为栈溢出和堆溢出，其中栈溢出通常利用函数返回地址的篡改，而堆溢出则涉及动态分配的内存区域。字符串处理和不正确的缓冲区大小计算是常见的引发溢出的原因。 2. **未验证的输入**：不检查输入数据的有效性可能导致数据注入攻击，如SQL注入或命令注入。输入验证是防止这类攻击的关键。 3. **竞态条件**：多线程或并发环境下，如果没有正确同步，可能导致数据不一致或安全漏洞。 4. **进程间通信的安全性**：不当的通信方式可能导致敏感信息暴露或控制流被劫持。 5. **不安全的文件操作**：不正确的文件访问控制可能导致数据泄露或权限提升。 6. **访问控制问题**：确保只有授权的实体才能访问特定资源。 7. **安全存储和加密**：提倡使用安全的方法存储敏感信息，并实施加密策略以保护数据。 8. **社会工程学**：提醒开发者防范通过欺骗手段获取用户信息的攻击。为了防止这些漏洞，文档给出了具体策略，如避免缓冲区溢出和下溢，使用地址空间布局随机化(ASLR)来增加攻击的难度，以及非可执行的栈和堆来阻止恶意代码执行。对于输入验证，它强调了风险，比如格式字符串攻击、URL和文件处理中的漏洞，以及对归档数据的修改。此外，还提到了模糊测试(fuzzing)和对跨进程通信的安全考虑。这份指南还涵盖了设计安全用户界面和辅助程序、守护进程的方法，以减少攻击面并确保服务的安全性。最后，它提供了一些检测和防止上述问题的调试技巧和工具，帮助开发者构建更安全的软件环境。

Each service has appropriate uses, and each has limitations. For example, FileVault, which encrypts the contents

of a user’s root volume (in OS X v10.7 and later) or home directory (in earlier versions), is a very important

security feature for shared computers or computers to which attackers might gain physical access, such as

laptops. However, it is not very helpful for computers that are physically secure but that might be attacked

over the network while in use, because in that case the home directory is in an unencrypted state and the

threat is from insecure networks or shared files. Also, FileVault is only as secure as the password chosen by the

user—if the user selects an easily guessed password, or writes it down in an easily found location, the encryption

is useless.

It is a serious mistake to try to create your own encryption method or to implement a published encryption

algorithm yourself unless you are already an expert in the field. It is extremely difficult to write secure, robust

encryption code that generates unbreakable ciphertext, and it is almost always a security vulnerability to try.

For OS X, if you need cryptographic services beyond those provided by the OS X user interface and high-level

programming interfaces, you can use the open-source CSSM Cryptographic Services Manager. See the

documentation provided with the Open Source security code, which you can download at http://developer.ap-

ple.com/darwin/projects/security/. For iOS, the development APIs should provide all the services you need.

For more information about OS X and iOS security features, read Authentication, Authorization, and Permissions

Guide .

Social Engineering

Often the weakest link in the chain of security features protecting a user’s data and software is the user himself.

As developers eliminate buffer overflows, race conditions, and other security vulnerabilities, attackers increasingly

concentrate on fooling users into executing malicious code or handing over passwords, credit-card numbers,

and other private information. Tricking a user into giving up secrets or into giving access to a computer to an

attacker is known as social engineering.

For example, in February of 2005, a large firm that maintains credit information, Social Security numbers, and

other personal information on virtually all U.S. citizens revealed that they had divulged information on at least

150,000 people to scam artists who had posed as legitimate businessmen. According to Gartner (www.gart-

ner.com), phishing attacks cost U.S. banks and credit card companies about $1.2 billion in 2003, and this number

is increasing. They estimate that between May 2004 and May 2005, approximately 1.2 million computer users

in the United States suffered losses caused by phishing.

Software developers can counter such attacks in two ways: through educating their users, and through clear

and well-designed user interfaces that give users the information they need to make informed decisions.

For more advice on how to design a user interface that enhances security, see “Designing Secure User

Interfaces” (page 74).

Types of Security Vulnerabilities

Social Engineering

Buffer overflows, both on the stack and on the heap, are a major source of security vulnerabilities in C,

Objective-C, and C++ code. This chapter discusses coding practices that will avoid buffer overflow and underflow

problems, lists tools you can use to detect buffer overflows, and provides samples illustrating safe code.

Every time your program solicits input (whether from a user, from a file, over a network, or by some other

means), there is a potential to receive inappropriate data. For example, the input data might be longer than

what you have reserved room for in memory.

When the input data is longer than will fit in the reserved space, if you do not truncate it, that data will overwrite

other data in memory. When this happens, it is called a buffer overflow. If the memory overwritten contained

data essential to the operation of the program, this overflow causes a bug that, being intermittent, might be

very hard to find. If the overwritten data includes the address of other code to be executed and the user has

done this deliberately, the user can point to malicious code that your program will then execute.

Similarly, when the input data is or appears to be shorter than the reserved space (due to erroneous assumptions,

incorrect length values, or copying raw data as a C string), this is called a buffer underflow. This can cause any

number of problems from incorrect behavior to leaking data that is currently on the stack or heap.

Although most programming languages check input against storage to prevent buffer overflows and underflows,

C, Objective-C, and C++ do not. Because many programs link to C libraries, vulnerabilities in standard libraries

can cause vulnerabilities even in programs written in “safe” languages. For this reason, even if you are confident

that your code is free of buffer overflow problems, you should limit exposure by running with the least privileges

possible. See “Elevating Privileges Safely” (page 60) for more information on this topic.

Keep in mind that obvious forms of input, such as strings entered through dialog boxes, are not the only

potential source of malicious input. For example:

Buffer overflows in one operating system’s help system could be caused by maliciously prepared embedded

images.

A commonly-used media player failed to validate a specific type of audio files, allowing an attacker to

execute arbitrary code by causing a buffer overflow with a carefully crafted audio file.

[

CVE-2006-1591

CVE-2006-1370]

There are two basic categories of overflow: stack overflows and heap overflows. These are described in more

detail in the sections that follow.

Avoiding Buffer Overflows and Underflows

剩余122页未读，继续阅读

chin_ke_moon

粉丝: 0
资源: 2

苹果安全编码指南：防御缓冲区溢出与注入攻击

SecureCodingGuide.pdf

Apple Secure Coding Guide 2012

secure coding in c and c++

java protect

Live Coding in Python

操作系统安全相关参考文献

Reed-Solomon coding in programming languages such as python

小林coding计算机网络

python 安装arithmetic_coding

最新资源