Recherche avancée

Sur d’autres sites (14015)

• Heroic Defender of the Stack

  27 janvier 2011, par Multimedia Mike — Programming

  Problem Statement

  I have been investigating stack smashing and countermeasures (stack smashing prevention, or SSP). Briefly, stack smashing occurs when a function allocates a static array on the stack and writes past the end of it, onto other local variables and eventually onto other function stack frames. When it comes time to return from the function, the return address has been corrupted and the program ends up some place it really shouldn’t. In the best case, the program just crashes ; in the worst case, a malicious party crafts code to exploit this malfunction.

  Further, debugging such a problem is especially obnoxious because by the time the program has crashed, it has already trashed any record (on the stack) of how it got into the errant state.

  Preventative Countermeasure

  GCC has had SSP since version 4.1. The computer inserts SSP as additional code when the -fstack-protector command line switch is specified. Implementation-wise, SSP basically inserts a special value (the literature refers to this as the ’canary’ as in "canary in the coalmine") at the top of the stack frame when entering the function, and code before leaving the function to make sure the canary didn’t get stepped on. If something happens to the canary, the program is immediately aborted with a message to stderr about what happened. Further, gcc’s man page on my Ubuntu machine proudly trumpets that this functionality is enabled per default ever since Ubuntu 6.10.

  And that’s really all there is to it. Your code is safe from stack smashing by default. Or so the hand-wavy documentation would have you believe.

  Not exactly

  Exercising the SSP

  I wanted to see the SSP in action to make sure it was a real thing. So I wrote some code that smashes the stack in pretty brazen ways so that I could reasonably expect to trigger the SSP (see later in this post for the code). Here’s what I learned that wasn’t in any documentation :

  SSP is only emitted for functions that have static arrays of 8-bit data (i.e., [unsigned] chars). If you have static arrays of other data types (like, say, 32-bit ints), those are still fair game for stack smashing.

  Evaluating the security vs. speed/code size trade-offs, it makes sense that the compiler wouldn’t apply this protection everywhere (I can only muse about how my optimization-obsessive multimedia hacking colleagues would absolute freak out if this code were unilaterally added to all functions). So why are only static char arrays deemed to be "vulnerable objects" (the wording that the gcc man page uses) ? A security hacking colleague suggested that this is probably due to the fact that the kind of data which poses the highest risk is arrays of 8-bit input data from, e.g., network sources.

  The gcc man page also lists an option -fstack-protector-all that is supposed to protect all functions. The man page’s definition of "all functions" perhaps differs from my own since invoking the option does not have differ in result from plain, vanilla -fstack-protector.

  The Valgrind Connection

  "Memory trouble ? Run Valgrind !" That may as well be Valgrind’s marketing slogan. Indeed, it’s the go-to utility for finding troublesome memory-related problems and has saved me on a number of occasions. However, it must be noted that it is useless for debugging this type of problem. If you understand how Valgrind works, this makes perfect sense. Valgrind operates by watching all memory accesses and ensuring that the program is only accessing memory to which it has privileges. In the stack smashing scenario, the program is fully allowed to write to that stack space ; after all, the program recently, legitimately pushed that return value onto the stack when calling the errant, stack smashing function.

  Valgrind embodies a suite of tools. My idea for an addition to this suite would be a mechanism which tracks return values every time a call instruction is encountered. The tool could track the return values in a separate stack data structure, though this might have some thorny consequences for some more unusual program flows. Instead, it might track them in some kind of hash/dictionary data structure and warn the programmer whenever a ’ret’ instruction is returning to an address that isn’t in the dictionary.

  Simple Stack Smashing Code

  Here’s the code I wrote to test exactly how SSP gets invoked in gcc. Compile with ’gcc -g -O0 -Wall -fstack-protector-all -Wstack-protector stack-fun.c -o stack-fun’.

  stack-fun.c :

  PLAIN TEXT

  C :

  1. /* keep outside of the stack frame */
  2. static int i ;
  3.  
  4. void stack_smasher32(void)
  5. {
  6.  int buffer32[8] ;
  7.  // uncomment this array and compile without optimizations
  8.  // in order to force this function to compile with SSP
  9. // char buffer_to_trigger_ssp[8] ;
  10.  
  11.  for (i = 0 ; i <50 ; i++)
  12.   buffer32[i] = 0xA5 ;
  13. }
  14.  
  15. void stack_smasher8(void)
  16. {
  17.  char buffer8[8] ;
  18.  for (i = 0 ; i <50 ; i++)
  19.   buffer8[i] = 0xA5 ;
  20. }
  21.  
  22. int main()
  23. {
  24. // stack_smasher8() ;
  25.  stack_smasher32() ;
  26.  return 0 ;
  27. }

  The above incarnation should just produce the traditional "Segmentation fault". However, uncommenting and executing stack_smasher8() in favor of stack_smasher32() should result in "*** stack smashing detected *** : ./stack-fun terminated", followed by the venerable "Segmentation fault".

  As indicated in the comments for stack_smasher32(), it’s possible to trick the compiler into emitting SSP for a function by inserting an array of at least 8 bytes (any less and SSP won’t emit, as documented, unless gcc’s ssp-buffer-size parameter is tweaked). This has to be compiled with no optimization at all (-O0) or else the compiler will (quite justifiably) optimize away the unused buffer and omit SSP.

  For reference, I ran my tests on Ubuntu 10.04.1 with gcc 4.4.3 compiling the code for both x86_32 and x86_64.

• How to install a Matomo premium feature

  31 janvier 2018, par InnoCraft

  You may have noticed over the last few months that many fantastic new features have been launched on the Matomo Marketplace. As some of them are paid premium features, you may wonder if the process to install them is straightforward, if you can test them before, and whether there is any support behind it. No worries – we’ve got you covered ! This blog post will answer some questions you may have about getting your first premium plugin.

  So why are there some premium features ?

  Researching, building, documenting, testing and maintaining quality products take years of experience and months of hard work by the team behind the scenes. When you purchase a premium plugin, you get a fully working product and you directly help the Matomo core engineers to grow and fund the new Free Matomo versions and cool features.

  However, it is important for us to mention that Matomo will always be free, it is a Free software under GPLv3 license and it will always be the same.
  Want to know more about this ? Check out our FAQ about why there are premium features.

  Can I test a premium feature before a purchase ?

  Absolutely. There are two ways in order to do that :

  1. InnoCraft Matomo Cloud
  2. Matomo Marketplace

  1. InnoCraft Matomo Cloud

  The easiest way is to create a free trial account (one minute of your time) on our Matomo cloud service. You will then have the possibility to test all the premium features during a 30-day trial period. No credit card is required.

  

  Every premium feature can be trialled for free on the Matomo Cloud

  2. Matomo Marketplace

  The second way is to get the premium feature from the Matomo Marketplace. We have an easy and hassle-free 30-day money back guarantee period on each feature. This means that if you are not happy with a premium feature and you are within the 30-day period, then you will get a full refund for it. Guaranteed !

  How to purchase and install a premium feature ?

  Step 1 : Purchasing the feature

  In order to get a premium feature, just add it to the cart :

  

  Once done, go to your cart and complete the checkout process to confirm the order.

  When the order is confirmed, you immediately get your license key on the order confirmation page. You also receive the license key by email.

  Step 2 : Activating the feature in your Matomo

  Now that you have received the license key, it is time to activate the plugin in your Matomo :

  • Log in to your Matomo and go to “Administration => Marketplace
  • Copy / paste the license key into the license field at the top of the page and click “Activate”

  

  • The key will now be activated and you will see a couple of new buttons.

  

  • To install the premium feature(s) you just purchased in one click, simply click on “Install purchased plugins”. Alternatively, you can scroll down in the Marketplace to the premium feature you purchased and click on “Install”. You can also download the ZIP file on https://shop.matomo.org/my-account/downloads

  And that’s it. The installation of a premium feature is as easy as copy/pasting the license key and clicking a button. Because one license key is linked to all purchased premium features, you only need to enter the license key once. The next time you purchase a premium feature, you simply click on “Install” to have it up and running.

  Updating a premium feature

  Updates for premium features work just like regular plugin updates. When there is a new update available, you will see a notification in the Matomo UI and also receive an email (if enabled under “General Settings”). To upgrade the feature simply click on “Update” and you’re done.

  Which support is provided for each of those premium features ?

  Premium features represent most of our day to day activity, so you can be 100% sure that we will do our maximum in order to answer any of your questions regarding them. To be 100% transparent, we often receive answers from our customers telling us how impressed they are by the quality of the service we are offering.

  Have any questions ?

  We are happy to answer any questions you may have so feel free to get in touch with us.

  Thanks !

  The post How to install a Matomo premium feature appeared first on Analytics Platform - Matomo.

• Révision 21307 : Report de r21299 : lorsque blocfrag dispose d’attributs data-loading-callback et...

  11 avril 2014, par cedric -

  (ajout de points d’entree, aucun changement fonctionnel par defaut)