Race Conditions - CompTIA Security+ SY0-701 - 2.3 — Transcript

Full transcript

1. 0:01a race condition is when two events
2. 0:04happen at nearly the same time with an
3. 0:06application and the application doesn't
4. 0:08take into account that these two
5. 0:10conditions may be operating
6. 0:13simultaneously this is something
7. 0:14application developers commonly check
8. 0:16when they're building their application
9. 0:18but there may be times when a
10. 0:19combination of different events inside
11. 0:21the application might have an unexpected
12. 0:24outcome and this would be the textbook
13. 0:26example of a race condition one common
14. 0:29type of erace condition is a Toto this
15. 0:32is a time of check to time of use attack
16. 0:36this means the application is going to
17. 0:37check the system to retrieve information
18. 0:40that may be stored and then after it
19. 0:42retrieves that information it may
20. 0:44perform a particular function with that
21. 0:46value but sometimes there's another
22. 0:49process that occurs behind the scenes
23. 0:51between the time when you've checked the
24. 0:53system for the value and you're actually
25. 0:55using that particular value and if you
26. 0:57don't take into account that that value
27. 0:59might change without you knowing it
28. 1:01you've run into a race condition let's
29. 1:04look at a practical example of a race
30. 1:06condition where you have two users that
31. 1:09are moving dollars between two different
32. 1:11accounts there's user one and user two
33. 1:14and the two accounts are account a and
34. 1:16account B the race condition that you're
35. 1:18going to see here is one that was
36. 1:20created because the application
37. 1:22developer takes deposits that are put
38. 1:24into the account and has them
39. 1:26immediately updated in the application
40. 1:29but if someone withdraws money from an
41. 1:31account that information may not be
42. 1:33immediately updated in The Ledger let's
43. 1:36see how this would play out if the two
44. 1:38users are transferring information from
45. 1:40one account to another we'll start with
46. 1:42two accounts account a and account B and
47. 1:44both have a starting account value of
48. 1:47$100 user one is going to transfer $50
49. 1:50from account a to account B user one is
50. 1:54going to check the balance and see that
51. 1:56account a is $100 and account B has $100
52. 2:00user 2 is also going to check the
53. 2:02balance and see that both of the
54. 2:03balances are indeed at
55. 2:05$100 so far everything is working as you
56. 2:08would expect now user one is going to
57. 2:10add $50 to account B because deposits
58. 2:13are updated immediately we know that now
59. 2:16account a has $100 and account B with
60. 2:19extra $50 in it has a
61. 2:22$150 value now user 2 is going to
62. 2:25perform the same function they're going
63. 2:26to add $50 to account B and when they do
64. 2:29that because this deposit is represented
65. 2:32immediately we now have account a with
66. 2:34$100 and account B with $200 and again
67. 2:38everything is still working exactly as
68. 2:40expected now user one is going to remove
69. 2:43$50 from account a from user one's
70. 2:45perspective account a now has $50 and
71. 2:48account B has $200 now user two is going
72. 2:52to perform the same transaction and
73. 2:54remove $50 from account a because these
74. 2:57withdrawals are not updated immediately
75. 2:59for all users from user 2's perspective
76. 3:02account a has $50 and account B has $200
77. 3:07this is the step where the race
78. 3:08condition really occurs because the
79. 3:10application is not immediately taken
80. 3:12into account any withdrawals the final
81. 3:14ending account value for user two is
82. 3:17going to have account a as $50 and
83. 3:19account b as 200 when in reality account
84. 3:22a should have
85. 3:230 these types of race conditions can
86. 3:26occur anywhere the application is not
87. 3:28taking into account one of these many
88. 3:30different events that can occur in 2004
89. 3:34we saw a race condition occur on the
90. 3:36planet Mars with the Mars rover Spirit
91. 3:39there's a safety mechanism within the
92. 3:40Rover where it will reboot itself if it
93. 3:43recognizes that a fatal error has
94. 3:45occurred and in the case of Mars Rover
95. 3:48the problem that was occurring was with
96. 3:50the file system itself so during this
97. 3:52reboot process the Rover recognizes that
98. 3:55there's a file system error and its
99. 3:57programming knows that it should be
100. 3:58rebooting itself to correct this it
101. 4:00reboots itself and runs into exactly the
102. 4:03same file system error again and we
103. 4:05effectively have a reboot loop in this
104. 4:08example the developers were able to send
105. 4:10additional code to the Rover to bypass
106. 4:12this particular error and get the Rover
107. 4:14back up and running and it seems
108. 4:16appropriate that we should have a race
109. 4:18condition that occurs inside of a car
110. 4:21and indeed we had one during Pond to own
111. 4:23in Vancouver 2023 with a Tesla Model 3
112. 4:28this Toto attack took Vantage of a
113. 4:30vulnerability in the Tesla of its
114. 4:32infotainment system that you could
115. 4:34access through Bluetooth they were able
116. 4:36to elevate privileges to be the root
117. 4:38user of the infotainment system and this
118. 4:41allowed the attackers to earn a
119. 4:43$100,000 US prize and they keep the
120. 4:56Tesla