wpe41.gif (23084 bytes)CIS3355: Business Data Structures
Fall, 2008
 

What happens if we use “illegal” offsets?? 
 

First of all, what is an array? 

 

An array is a regular order or arrangement containing a fixed number of contiguously storage elements (that is, there are no gaps between elements) of the same data type (although they may have different values). For example, you could have an array of integers, an array of characters or an array of anything that has a defined data type.

 

For example, we could store the first 10 prime numbers (1, 2, 3, 5, 7, 11, 13, 17, 19, 23) in RAM by storing them as individual integer variables one for each number. Using the following c declaration:

Unconverted Image
 

 

 

Since an array is a fixed number of contiguous storage all of the same data type, in RAM (assuming that the first contiguous block was at address 2000) it would look like this (2-bytes per integer): 

 

Unconverted Image
 

 

 

Another example

An array which contains 5 integer values of type int called example could be represented this way:

example

Unconverted Image

 

The blank panels represent an element of the array (the array’s objects). These particular objects or elements, are the type int. They are also in sequential order. By being in sequential order, if the computer knows where the first element is, then it is relatively easy for it to find the second, the third, and so forth. Also since this is an array of type int, we are asking for 4-bytes per element (4*5=20 contiguous bytes of RAM)                

Note: The array did not begin with the number 1. Rather it began with the number 0. Each element is offset from the beginning of an array starting at 0.

Why is the first element labeled 0?

Because it is zero elements away from the beginning of the array. This means that the second element is actually 1 away from the beginning the array. The third element is 2 away from the beginning of the array and so forth.

Get the picture? 

Any array of size N has an offset range of 0 to N-1. In our case the range is from 0 to 4.

Please note: Arrays can have more than one dimension. A one-dimensional array is called a vector or pointer, which contains the address of a location in memory; a two-dimensional array is called a matrix, that is, an array of rows and columns.

What is an address? 

 

It is a location of data, usually in main memory or on a disk. It is an array of storage boxes, each of which is one byte in length. Each box has an address—a unique number assigned to it, which makes it easier to locate. 

 

Unconverted Image
 

 

 

What is a string? 

 

A string is a sequence of data values, usually bytes, which stand for characters (a

“character string”). A character string differs from a name in that it does not represent anything. For example, a bit string is a sequence of bits. 

 

A character string is usually defined by enclosing the characters in single or double quotes:  

 

WASHINGTON would be a name, but 'WASHINGTON' and "WASHINGTON" would be character strings.  

 

The length of a character string is usually the number of characters in it: 

 

The character string "WASHINGTON" has a length of 10 (the quote marks are not included). 

 

What is an offset? 

 

An offset (subscript) is an index or position in an array, string, or block of memory—usually a non-negative integer.  

 

For example: 0, 1, 2, 3… 

 

It is a value added to a base address to create a second address.  

 

For example, if B represents address 100, then the _expression,

B+5

would indicate the address 105. The 5 in the _expression is the offset.  

 

Let’s take an array and figure out the offset by using the following formula :

ELEMENT ADDRESS = BASE ADDRESS OF THE ARRAY+ (OFFSET # * 4)

*Remember we have to multiply the offset by 4 since we are using integers. Therefore the 4 bytes * 4 elements = 16 continguous bytes of RAM needed!

First, let’s say our base address starts at 100. 

 

int example[4] ={1,3,5,7}        

Element number/position/index  Addresses                    Reference

            1                                              100 to 103                 example[0]

            2                                              100+4=104 (to 107)    example[1]

            3                                              104+4=108 (to 111)    example[2]

            4                                              108+4=112 (to 115)   example[3]                              

 

RAM Allocation:

100 example[0] 101 example[0] 102 example[0] 103 example[0]
00000000 00000000 00000000 0000001
104 example[1] 105 example[1] 106 example[1] 107 example[1]
00000000

108 example[2]

00000000

112 example[3]

00000000

1122222

00000000

109 example[2]

00000000

113 example[3]

00000000

00000000

110 example[2]

00000000

114 example[3]

00000000

00000011

111 example[2]

00000101

115 example[3]

00000111

100 to 103 example[0] 104 to 107 example[1] 108 to 111 example[2] 112 to 115 example[3]
1 3 5 7

 

Offset                                       Address:

0                                                                                            100 +( 0*4) =100

1                                                                                            100 +(1*4)  =104

2                                                                                            100 +(2*4) =108

3                                                                                            100 +(3*4) =112

 

We would follow the same procedure for a float and character array. Except that for a character array we multiply the offset by 1 (1 byte of storage) and then add it to the base address.  

 

 

Okay, now that we know what offsets are and how do they work, what happens if we use “illegal” offsets? 

 

Illegal offsets are alterations than can cause malicious fragmentation, most commonly known as computer viruses. Many attackers, for example, send illegal offsets within a TCP packet.  

 

TCP stands for Transmission Control Protocol. Is a connection-oriented protocol that utilizes various flags to indicate that a connection is being started or ended, or that there’s a high priority on the data that it carries.  

 

Attackers altered the TCP flags in a way that firewalls or intrusion detection systems are unable to detect them.  

 

What are flags?  

 

Flags are a bit of information that signals a particular condition or status. For example, a record might contain an error flag to indicate that the record consists of incorrect data.  

 

What type of flags should be set in a TCP packet? 

 

At least one of the following flags should be set in a TCP packet; each one takes up to 1 bit of storage. 

 

SYN (Synchronization) Initiate a TCP connection.
ACK (Acknowledgment) Indicates that the value in the acknowledgment number field is valid.
FIN (Finish) Smoothly end a TCP connection.
RST (Reset) Quickly end a TCP connection.
PSH (Push) Tells the receiver to pass on the data as quickly as possible.
URG (Urgent) Indicates that the urgent pointer is valid.
 

 

Note: Besides the six flag bits described here, TCP packets have two additional bits which are reserved for future use. These are commonly referred to as the "reserved bits".  

 

What constitutes a normal flag combination? 

 

The following are normal flag combinations: 

 

SYN, SYN ACK, ACK Every packet in a connection must have the ACK bit set, except for the initial SYN packet.
FIN ACK, ACK These are used during the smooth ending of a connection.
PSH FIN ACK Is also seen at the start of a smooth termination.
RST or RST ACK Can be used to quickly end an existing connection.
 

 

What are the abnormal flag combinations (viruses) an attacker may send to a computer? 

 

The following are examples of abnormal flag combinations: 

 

SYN FIN Is the best known illegal combination. Remember: SYN is used to start a connection, and FIN is used to end a connection. Therefore, any SYN FIN packets are malicious.
SYN FIN PSH,

SYN FIN RST,

SYN FIN RST PSH

Attackers who know that certain intrusion detection systems may be looking for packets with only the SYN and FIN bits set, not additional bits set use these packets, which are definitely malicious.
FIN FIN packets are used for port scans and network mapping. Packets must never contain just a FIN flag.
Null These packets have no flags set. It is illegal to have a packet with zero flags set.

Visit the following links for more detail information:

numeric arrays tutorial: 4.20 what are offsets and how do they work?

http://www.securityfocus.com/infocus/1200

http://www.cs.wright.edu/pmateti/InternetSecurity/Lectures/Ipexploits/

http://www.giac.com/practical/EAVazquezJr.html

http://www.web.ask.com/redir?bpg=http%2f%2fweb.ask.com%2fweb%

Review Questions

1. Which one of the following is a position in an array, string, or block of memory?

  1. Base Address
  2. B+5
  3. Offset
  4. Array
  5. String

(answer: c)

2. Which one of the following malicious fragmentation is most commonly knows as?

  1. Fragmentation
  2. Computer Viruses
  3. Flags
  4. TCP
  5. Illegal Offsets

(answer: b)

3. Which one of the following is a bit of information that signals a particular condition?

  1. Record
  2. Error
  3. Firewall
  4. Flag
  5. Detection System

(answer: d)

4. If my base address were 23456 and int example[4] ={0,4,8,12} What would my address be for the third offset?

Answer:

 

23456 example[0] 23457 example[0] 23458 example[0] 23459 example[0]
00000000 00000000 00000000 00000000
23460 example[1] 23461 example[1] 23462 example[1] 23463 example[1]
00000000 00000000 00000000 00000100
23464 example[2] 23465 example[2] 23466 example[2] 23467 example[2
00000000 00000000 00000000 00001000
23468 example[3] 23469 example[3] 23470 example[3] 23471 example[3]
00000000 00000000 00000000 00001100

  

23456 to 23459

example[0]

23460 to 23463 example[1] 23464 to 23467 example[2] 23468 to 23471 example[3]
0 4 8 12

 

Offset                           Address:

0                                                                  23456 + (0*4) =23456

1                                                                  23456 +(1*4) =23460

2                                                                  23456 + (2*4) = 23464

3                                                                  23456 + (3*4) = 23468

My third offset is actually offset number 2, not 3. Offsets always start at 0 not at 1. Therefore my address for the third offset will be 23464.

5. What would happen if I had a character instead of an integer in the previous problem? Explain.

 

Answer:

Instead of multiplying the offset number by 4, I would have to multiply it by 1 to get the address of the third offset.

 

Offset                           Address:

0                                  23456 + (0*1) =23456

1                                  23456 + (1*1) =23457

2                                  23456 + (2* 1) =23458

3                                  23456 + (3*1) =23459

 

My answer would then be 23458 because offset 2 is my third offset. 

 

6. What type of fragmentation can illegal offsets cause?

(Answer: malicious fragmentation)

7. What does TCP stand for?

(Answer: Transmission Control Protocol)

8. What are some examples of normal flag combinations?

(Answer: SYN, SYN ACK, ACK; FIN ACK, ACK; PSH FIN ACK; RST/RST ACK)

9. Describe some abnormal flag combinations an attacker may send to a computer.

(Answer: SYN FIN; SYN FIN PSH, SYN FIN RST, SYN FIN RST PSH; FIN; NULL)