Hack Security Pro.pdf - Index of

}
}
printf("Opening of file authorized !\n");
//Opening of file
if( (fd = open(av[1], O_APPEND|O_WRONLY) ) == -1){
perror(NULL);
exit(4);
}
printf("Writing ....\n");
//Writing in the file
if( write(fd,av[2], strlen(av[2])) == -1 )
perror(NULL);
close(fd);
The countermeasure
The one countermeasure that immediately comes to mind for this type of attack is the locking of files,
in other words to place a lock when an application has access to a file in order to prevent another
application from having access to the same file.
One might think of using semaphores as they can block access to data that will remain inaccessible
until they are ready.
A more complicated remedy could be to establish a diamond that would be the only one to be able to
have access to the files; this diamond could not be bypassed during the opening of a file. When an
application requests such an opening, it would ask this diamond that it effectively open the file and
take care to note that the file is open, so that if another application were to ask for the opening of the
same file, the diamond would refuse, the consequence being to refuse any competing opening of files.
Finally, the countermeasure we suggest is a most simple one and it is also very efficient...
All that has to be done actually is to modify the order of the instructions. So we will start by opening the
file and we take good care to lock it to prevent any other actions on it. We then check the user's rights,
and once that is done we take off the security lock and then proceed to write in data.
This way, we avoid encountering a problem of the “race condition” type.
The Hackademy DMP -163/209- SYSDREAM