The Future of Software
The software security problem is likely to get worse before it gets better. The problem is that software itself is changing faster than software security technology. The trinity of trouble has a significant impact on many of the trends outlined in this section.
•Table of Contents
At• the risk ofIndbeingx seriously wrong, we now consult our crystal ball and peer into the future ofExplsoftwareiting Software. Our missionHow to Breakis toCodeunderstand where things are going and think about how they
will impact software security and the art of exploiting software. Our presentation is organized
ByGreg Hoglund,Gary McGraw
in three time ranges. (Of course, anyone who purports to predict what is coming is destined
to be wrong. So take these musings with a grain of salt.[14])
Publisher: Addison Wesley
Pub[14]Date: February 17, 2004
An acknowledgement is in order. This material was developed with the input of many people, not the
least of whom make up Cigital's Technical Advisory Board. Major contributors include Jeff Payne (Cigital),
ISBN: 0-201-78695-8
Peter Neumann (SRI), Fred Schneider (Cornell), Ed Felten (Princeton), Vic Basilli (Maryland), and Elaine
Pages: 512
Weyuker (AT&T). Of course any errors and omissions are our fault.
Short-Term Future: 2003–2004
How does software break? How do attackers make software break on purpose? Why are
We begin with a discussion of what's on the immediate horizon as far as software goes. Many firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys?
of these trends are readily apparent as we write this book. Some have been emerging for a What tools can be used to break software? This book provides the answers.
few years.
Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and
More components: Component-based software is finally catching on. One reason for techniques used by bad guys to break software. If you want to protect your software from
this is the need for more robust, reliable, secure systems. Businesses with missionattack, you must first learn how real attacks are really carried out.
critical code are using systems such as Enterprise Java Beans (EJB), CORBA, and COM
(including its .NET instantiation). Components written in these frameworks work This must-have book may shock you—and it will certainly educate you.Getting beyond the
naturally in a distributed environment and were created with inter-object script kiddie treatment found in many hacking books, you will learn about
communication between multiple servers in mind. A handful of advanced development
shops are creating standardized components for special-purpose use (sometimes
creatingWhy softwaresecurityexploit-criticalwillcomponents,continue to besucha seriousas a componentproblem for proper user
authentication). This can be extremely helpful when tackling the problem of building
Whensecuritynetwork-criticalsecuritysoftware,mechanibecausemsstandarddo not wcomponentsrk implementing reasonable
security architecture can be integrated seamlessly into a new design. However, the art
Attack patterns
of composing components into a coherent system while maintaining emergent
properties such as security is extremely difficult and poorly understood, making
Reverse engineering
component-based software subject to exploitation.
Classic attacks against server software
Tighter OS integration: Microsoft's integration of Internet Explorer into its base OS
was no accident. What was once a clear line between OS and application has become
Surprising attacks against client software
very blurry. Many activities that once required special-purpose applications now come
standard in many OSs, and what appear to be stand-alone applications often are mere 
Techniques for crafting malicious input
façades created on top of multiple OS services. Deep OS integration leads to security
risk because it runs counter to the principle of compartmentalization. When exploiting The technical details of buffer overflows
an application has as a side effect of complete compromise of the OS, exploiting a
system through software becomes much easier. Rootkits
Beginning of encapsulation: Operating systems tend to do too much, in any case. Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break
This leads to security and reliability problems. One way to combat the "too much stuff" software.
phenomenon brought about by tight integration of applications and OSs is to
encapsulate like functions together and then protect them from the outside. A good
example of what we mean can be found in the encapsulation of the OS by the JVM. The
JVM places much tighter control over programs that it runs than a generic OS. This is a
boon for software security. Of course, advanced security models based on language-
based encapsulation are hard to get exactly right. Many known software exploits have
been leveled against the JVM (see Securing Java [McGraw and Felten, 1998]).
|
Beginning of wireless: Wireless system adoption is beginning in earnest. Soon |
|
802.11b and its (hopefully improved) successors will be widespread. Wireless |
|
networking has a large (negative) impact on security because it works to break down |
|
physical barriers even more. With no requirement for a wire to connect machines |
|
physically, determining where a security perimeter is located becomes much harder |
|
than it once was. Software exploits of wireless systems were widely trumpeted by the |
|
press in 2001, and included a complete break of the wired equivalent privacy (WEP) |
• |
encryption algorithm[15] and the reemergence of address resolution protocol (ARP) |
Table of Contents |
|
|
cache poisoning attacks (http://www.cigital.com/news/wireless-sec.html). 802.11i is |
•Index
being rapidly adopted as this book goes to press. It promises a superior approach to security than the much-maligned WEP.
ByGreg Hoglund,Gary McGraw
[15] The WEP crack was popularized by Avi Rubin and Adam Stubblefield. For more information, see
http://www.nytimes.com/2001/08/19/technology/19WIRE.html or http://www.avirubin.com.
Publisher: Addison Wesley
Pub Date: February 17, 2004
More PDAs (and other embedded systems): PDAs like the Palm Pilot are becoming commonplaceISBN: 0-201-78695. New-8 generations of these devices include embedded Internet capability. Handspring'sP ges: 512 Treo represents the convergence of phone, PDA, and e-mail system into one highly portable networked device. These devices are simple, hand-held network appliances that can be used to carry out many security-critical activities, including checking e-mail, ordering dinner, and buying stocks. PDAs are often programmed remotely and make use of the mobile code paradigm to receive and install new
programs. Although there have been few software exploits of PDAs to date, standard How does software break? How do attackers make software break on purpose? Why are
PDAs do not typically include a security framework.
firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys?
What tools can be used to break software? This book provides the answers.
Logically distributed systems: Component-based software and distributed systems Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and
go hand in hand. Components, done right, provide logical pieces of functionality that techniques used by bad guys to break software. If you want to protect your software from
can be put together in interesting ways. Functionality of a complete system is thus attack, you must first learn how real attacks are really carried out.
logically distributed among a number of interconnected components. This sort of
modular design is helpful in the sense that it enables separation of concerns as well as This must-have book may shock you—and it will certainly educate you.Getting beyond the
compartmentalization, yet at the same time distributed systems are complicated and script kiddie treatment found in many hacking books, you will learn about
hard to get right. The most common distributed systems today are geographically
colocated and often make use of a single common processor. The Windows family of
OSs, made up of hundreds of components such as DLLs, is a prime example. Windows is Why software exploit will continue to be a erious problem
a logically distributed system. Unfortunately, complexity is the friend of software
exploit;When networkthus, distributedsecurity mechanismssystems oftendo notmakeworkthe job of exploiting software easier.
IntroductioAttack patternsof .NET: Microsoft has joined the mobile code fray with the introduction
of .NET. Usually, when Microsoft enters a market in a serious way, this is a sign that the
Reverse engineering
market is mature and ready to be exploited. Java introduced the world to mobile code
and modern network-centric software design. .NET is likely to play a real role in mobile
Classic attacks against server software
code as it evolves. Exploits against advanced security models meant to protect against
malicious mobile code have been discussed for years. The emergence of an entire range
Surprising attacks against client software
of VM technology, running from VMs for tiny 8-bit smart card processors at one end to
complicated application server VMs supporting systems like J2EE mean that one size 
Techniques for crafting malicious input
does not fit all from a security perspective. Much work remains to be done to determine
the type of security mechanisms that are reasonable for resource-constrained devices 
The technical details of buffer overflows
(including J2ME devices).[16] In the meantime, new VMs in the range are ripe for
software exploit. Rootkits
[16] McGraw is currently doing Defense Advanced Research Projects Agency (DARPA)-supported
Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break research on this problem: DARPA grant no. F30602-99-C-0172, entitled An Investigation of
software. Extensible System Security for Highly Resource-Constrained Wireless Devices.
Mobile code in use: The introduction of Java in 1995 was heralded with much hubbub about applets and mobile code. The problem was, mobile code was ahead of its time. As embedded Internet devices become more common, and many disparate systems are networked together, mobile code will come into its own. This becomes obvious when you consider that phones with JVMs are unlikely to be programmed through the phone's buttons. Instead, code will be written elsewhere and will be loaded into the phone as necessary. Although there are certainly critical security concerns surrounding mobile
|
code (see Securing Java [McGraw and Felten, 1998] for examples), demand for and use |
|
of mobile code will increase. |
|
Web code and XML: Although the .com meltdown has lessened the hype surrounding |
|
e-business, the fact remains that Web-based systems really do compress business value |
|
chains in tangible ways. Business will continue to take advantage of Web-centric |
• |
systems to make itself more efficient. XML, a simple markup language for data, plays a |
Table of Contents |
|
|
major role in data storage and manipulation in modern e-business systems. Web-based |
• |
Index |
|
code comes with many security head aches. If your business uses a Web server to store |
Exploiting Software How to Break Code
mission-critical data, the security of that server (and any applications that run on it)
ByGreggainsHoglundin,importanceGary McGraw. Huge numbers of exploits in the early 2000s aim to compromise Web-based software.
Publisher: Addison Wesley
Subscription services: The idea of paying for what you actually use is beginning to be
Pub Date: February 17, 2004
applied to software as well as other digital content. This leads to an obvious set of
ISBN: 0-201-78695-8
security concerns, not the least of which is protecting the service or content (the target
Pages: 512
of the subscription) from being stolen. Protecting digital content is, according to computer science theory, an unsolved and unsolvable problem. Software exploits in this area abound, even though egregious laws such as the Digital Millennium Copyright Act (DMCA) aim to make such exploits illegal.
The near future of software is already upon us. The current state of the trends identified here How does software break? How do attackers make software break on purpose? Why are
can be gleaned from digging into the following technologies, concepts, and ideas: firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys?
What tools can be used to break software? This book provides the answers.
Advanced programming languages (especially those languages with properties of type Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and
safety)
techniques used by bad guys to break software. If you want to protect your software from
attack, you must first learn how real attacks are really carried out. 
Java, scheme, Eiffel, ML (knowledge of lambda calculus is helpful)
This must-have book may shock you—and it will certainly educate you.Getting beyond the
Distributed computing
script kiddie treatment found in many hacking books, you will learn about
Containers
Why software exploit will continue to be a serious problem
Building secure software
When network security mechanisms do not work 
"Sandboxing" and encapsulation of executing code
Attack patterns
WAP, iMode, 2.5G, 3G
Reverse engineering
Low-level networking
Classic attacks against server software
MediumS rprising-TermattacksFuture:against2005client–software2007
Techniques for crafting malicious input
The short-term trends we discussed earlier are likely to evolve, resulting in a new set of
salient ideas. Keep in mind that the further we peer into our crystal ball, the more likely we The technical details of buffer overflows
are to be wrong.
Rootkits
Special-purpose computational units: Devices that serve one and only one
computational purpose are likely to emerge. Many such computational objects exist in Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break
telecommunications systems today.[17] The emergence of everyday devices with software.
embedded software is interesting from a security perspective, especially if these devices
are network enabled. The famed "Internet toaster" may become a reality, with the
downside being a risk that your breakfast will be maliciously burned by a bad guy.
[17] Note that there are counterexamples to this trend as well. For example, the only difference between classes of engines in some automobile product lines is the control software that changes engine performance parameters. This has led to the emergence of black market engine control code (used to soup things up). Such control software runs on standard computation platforms. Hacking control software in cars is commonly referred to as "chipping" the car.
Emergence of true objects: Objects in the physical world have form and function. Computational capability will be added to many "ordinary" objects to enhance their capabilities. Whether the new capability will take the form of a universal computer that accepts mobile code to determine its function is an open question. From a user perspective, "smart objects" will be the result. Software will play a major role in smart objects, and compromising such objects from a security perspective is likely to involve exploiting software.
•Table of Contents
• |
.NET and Java: Systems involving VMs that run the same code on many diverse |
Index |
|
|
platforms will become much more common. (Sun's pithy way of putting this is "write |
Exploiting Software How to Break Code
once; run anywhere.") Since the introduction of Java in 1995, the JVM has taken the ByGregsoftwareHoglund,GaryworldMcGrawby storm. .NET is Microsoft's response to the Java phenomenon.
Although VM technology allows for the use of advanced language-based security
models, VMs are also a critical extensibility driver, and, as we discussed earlier,
Publisher: Addison Wesley
extensibility is dangerous.
Pub Date: February 17, 2004
ISBN: 0-201-78695-8
Pages: 512
Encapsulation of OS: OS encapsulation spearheaded by Java and .NET will continue to gain prominence. The proliferation of such platforms brings the idea of a VM that can really deliver "write once; run anywhere" capability closer to reality. Embedded devices with hardware implementations of VMs will become more common. The end game of this trend may well be "special-purpose" OSs that are built specifically for the device
they support. An early example is the Palm OS. Because OS kernels typically run with How does oftware break? How do attackers make software break on purpose? Why are
privilege, the idea of privileged code and superuser (SUID) capability will be transferred firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys?
to the device itself. This is a likely area for exploitation.
What tools can be used to break software? This book provides the answers.
Widespread |
and embedded systems: The concept of wireless network |
||
Exploiting Softwarewirelessis oaded with examples of real attacks, attack patterns, tools, and |
|||
will become deeply entrenched and widespread. Security |
will grow as more |
||
techniques used by bad guys to break software. If you want toconcernsprot ct your software from |
|||
business-critical applications come to include wireless |
. |
||
attack, you must first learn how real attacks are really carriedcomponentut. |
|||
This mustGeographicallyve- |
|
distributed systems: Logically distributed systems such as Win32 |
|
book may shock you—and it will certainly educate you.Getting beyond the |
|||
will evolve into geographically distributed systems as |
-purpose computational |
||
script kiddie treatment found in many hacking books, you willspecialle rn about
units come into play. Once these systems begin to use the network as a communications
medium, security concerns are raised. Transport-level security through cryptography
Why software exploitthesewill continue to be a serious problem
can help to address concerns, but "person-in-the-middle" attacks will become
commonplace, as will timing-related attacks such as race conditions. Software
When network security mechanisms do not work
exploitation in a geographically distributed system is interesting because the range of
protections offered by various different hosts in the system is likely to vary. Because
Attack patterns
security is only as strong as the weakest link, part of an attack strategy will be to
determine which of a number of distributed hosts is the weakest. 
Reverse engineering
Adoption of outsourced computation: Computation may come to be more like 
Classic attacks against server software
electricity, with cycles available for the taking simply by "plugging something in." There
are myriad security concerns invoked by the idea of outsourcing computation.[18] 
Surprising attacks against client software
Questions like, How can you trust an answer? How can you protect knowledge about the
problem you are solving from the host doing the computation? And how can you
Techniques for crafting malicious input
properly delegate resources and charge for use? will become commonplace. The impact
on exploiting software will be large, because an attacker will need to determine not only The techn cal details of buffer overflows
how to attack, but where, and redundancy will be used to detect attacks.
Rootkits
[18] This is, of course, reminiscent of the time-sharing systems from the 1960s and 1970s.
Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break
software.
Software distribution: The idea of installing copies of an enterprise-grade program on every machine will begin to make less sense. Instead, software functionality will be delivered according to need, and users will be charged for the functions they use. The Application Service Provider (ASP) model of software licensing is likely to catch on. Software companies are preparing for this by changing the way they license and charge for software today. A new class of software attacks directed at surreptitiously stealing functions will evolve.
Mobile code taking over: Because of the pervasiveness of networking, all code in the
future will be mobile code. The term mobile code will fall out of use because it will be redundant. Language-based security models will take on more importance, and attacks against these kinds of security mechanisms (many of which were invented in the mid 1990s) will be seen in the wild.
Software practitioners interested in reacting to these trends and protecting code against exploit should learn as much as possible about the following ideas:
• |
Table of Contents |
• |
Index |
|
Object-oriented thinking |
Exploiting Software How to Break Code
Understanding temporal implications
ByGreg Hoglund,Gary McGraw
Distributed systems
Publisher: Addison Wesley
PubSecurityDate: Februaryin hostile17, 2004environment
ISBN: 0-201-78695-8
Assume nothing
Pages: 512
Programming languages
Simplicity
How doesFaultsoftwareinjectionbreak? How do attackers make software break on purpose? Why are firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys?
Privacy and control
What tools can be used to break software? This book provides the answers.
Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and
techniques used by bad guys to break software. If you want to protect your software from
Long-Term Future: 2008–2010
attack, you must first learn how real attacks are really carried out.
Now we move ourselves way out on a limb to make some predictions for the long-term future This must-have book may shock you—and it will certainly educate you.Getting beyond the
of software. Because software development and Internet time has led to a serious script kiddie treatment found in many hacking books, you will learn about
acceleration in software change, these predictions are likely to be completely wrong. Take these with a complete salt lick (not just a grain of salt).
Why software exploit will continue to be a serious problem
True objects: The ultimate end at the intersection of computational objects, OS
Whenencapsulatinetworkn, securityand geograpmechicallyanismsdistributeddo not workcomputation will result in true objects
becoming commonplace. Pens and paper will have application programming interfaces
Attack patterns
(APIs). Light switches will run code. Exploiting software will be more fun than ever.
Reverse engineering
Disappearance of the OS: After being "embraced" and encapsulated by the VM, the
OS will begin to disappear. Applications will get their own OS-like services from various
Classic attacks against server software
components. Microsoft appears to agree, and it is easy to see why Microsoft is serious
about .NET. McNealy's "network as computer" message will come true. This trend may
Surprising attacks against client software
make exploiting software harder. Today, with common monolithic platforms all sharing
the same vulnerabilities in widespread use, there is a huge number of potential targets. 
Techniques for crafting malicious input
In the future, picking targets is less likely to be so easy.
The technical details of buffer overflows
Computational services: The software distribution trend may evolve into a
marketplace of computational services. These services may be sold "by the cycle" to Rootkits
programs that attach to them and request subcomputations.
Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break
Fabric of computation (ubiquity): Cycles may become as ubiquitous as air. Charging software.
for cycles (and for CPUs) will no longer make sense.
Intelligent devices: Devices will not only be "smart" in the sense that they will have built-in software, artificial intelligence (AI) techniques will begin to be used in everyday devices. AI techniques will be pressed into service for security, reliability, and other emergent software properties.
All code mobile: Because the network is the computer, all code will be network based.
Location-based computation: Programs that react to where they are running will be common. Cryptographic algorithms that only work at certain global positioning satellite (GPS) coordinates will be widely used (not simply used by intelligence agencies like today). There will be programs that help human users by reminding them of things (and selling them things) based on physical proximity ("Don't forget to pick up milk."). WAP phones are leading the way to a certain extent, with location-sensitive advertising capabilities.
•Table of Contents
• |
Self-organizing systems and emergent computation: Software that organizes itself |
Index |
|
|
to solve a problem may come to be. Using genetic algorithms, classic search methods, |
Exploiting Software How to Break Code
and biological metaphors, new kinds of software programs will come into being. Natural ByGregbiologicalHoglund,GarydefensesMcGraw(such as an immune system) will be copied by future software
systems that wish to survive and thrive in a hostile environment. Self-organizing
software may be harder to exploit than the barely cobbled-together code of today.
Publisher: Addison Wesley
Pub Date: February 17, 2004
Some pie-in-the-sky fields will deeply influence the far future of software. These are likely to
ISBN: 0-201-78695-8
include
Pages: 512
AI
Emergent systems and chaos theory
How does software break? How do attackers make software break on purpose? Why are
Automatic testing
firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys?
What tools can be used to break software? This book provides the answers. 
Fault injection at component interfaces
Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and
Privacy
techniques used by bad guys to break software. If you want to protect your software from
attack, you must first learn how real attacks are really carried out. Interfaces
This must-have book may shock you—and it will certainly educate you.Getting beyond the
script kiddie treatment found in many hacking books, you will learn about
Ten Threads Emerge
Why software exploit will continue to be a serious problem
Ten threads are woven throughout the previous predictions. They are
When network security mechanisms do not work
Attack patterns
1. Disappearance of the OS
Reverse engineering
2. Mass adoption of wireless networks
Classic attacks against server software
3. Embedded systems and specialized computational devices
Surprising attacks against client software 4. Truly distributed computation
Techniques for crafting malicious input 5. Evolution of "objects" and components
The technical details of buffer overflows 6. Information fabric (ubiquity)
Rootkits
7. AI, knowledge management, and emergent computation
Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break 8. Pay by the byte (or cycle or function)
software.
9. High-level design/programming tools
10. Location-based computation (peer to peer)
Because of the speed with which software has evolved in its relatively short life span, exploiting software is easy. Clearly, software evolution is not slowing down. If anything, this makes the job of creating software that behaves extremely hard, and gives software attackers plenty of working room.
•Table of Contents
•Index
Exploiting Software How to Break Code
ByGreg Hoglund,Gary McGraw
Publisher: Addison Wesley
Pub Date: February 17, 2004
ISBN: 0-201-78695-8
Pages: 512
How does software break? How do attackers make software break on purpose? Why are firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What tools can be used to break software? This book provides the answers.
Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and techniques used by bad guys to break software. If you want to protect your software from attack, you must first learn how real attacks are really carried out.
This must-have book may shock you—and it will certainly educate you.Getting beyond the script kiddie treatment found in many hacking books, you will learn about
Why software exploit will continue to be a serious problem
When network security mechanisms do not work
Attack patterns
Reverse engineering
Classic attacks against server software
Surprising attacks against client software
Techniques for crafting malicious input
The technical details of buffer overflows
Rootkits
Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break
software.