Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any good online resources to pick up knowledge about how memory allocations affect security?

Its a new area for me, and any pointers on where to get started would be appreciated.

share|improve this question
2  
I think you need to rephrase because I am not sure what you are asking. Can you link to an example of what you are wondering about? –  schroeder May 30 '12 at 15:46

3 Answers 3

up vote 2 down vote accepted

I saw what you did there, asking about memory allocation & security then mentioning pointers ;)

In my opinion, the best way to start off learning about memory (in general) is to write code. I'm not sure there is any other way of approaching this. Not just any code, find a language which forces memory management on the programmer, no managed environments such as Java or the .NET Framework. These are great languages for RAD, but don't provide the lower level aspects that would be required. I recommend C or C++. Learn about pointers, dangling references, dynamic memory allocation & deallocation, etc.

Assembly is a fantastic language if you want to learn the ins and outs of how software runs, but it also is hella-difficult to understand. You don't necessarily need to be able to write assembly code, though. Just pickup a few documents on the language and I guarantee you'll increase your understanding of memory substantially.

Sometimes the only way to truly understand how something works, is to take it apart. Pick up a book on operating system architecture such as Operating Systems - Design and Implementation or a reverse engineering book Reversing: Secrets of Reverse Engineering. Take some stuff apart, become familiar with a debugger and analyze applications running in memory. Start toying around with breakpoints and see what your debugger tells you about whats going on.

In conclusion, the best way in my opinion to learn about memory is to be responsible for managing it. Start off slow, learn C++ and work towards harder stuff.

http://www.cprogramming.com/debuggers.html

share|improve this answer

Buffer Overflows might be what you are trying to refer to. Once you figure out exactly what it is you want to learn, you may want to build your own testing environment to observe how it works. DVWA is a great place to start with that.

share|improve this answer

The memory allocator may influence security in the following way: the choice of memory allocator may affect the ease or difficulty of exploiting buffer overrun and other memory-safety-related vulnerabilities.

For instance, randomizing the location at which objects are allocated can disrupt exploits that rely upon these objects to be at predictable locations -- thus defeating the attacker. Thus, a well-designed memory allocator can play a role in implementing ASLR (address-space layout randomization). In general, a memory allocator can potentially help defend against some "heap exploits".

See, e.g., the following research papers for some work on building hardened memory allocators that make it harder to exploit these kinds of vulnerabilities:

Here's some more information about how deployed operating systems are implementing these ideas:

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.