I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf
It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force each byte of the canary individually along with time analysis". How can you do time analysis on a byte-for-byte basis? Isn't the whole canary compared at once? I thought that the the four bytes were compared with only one instruction.
This attack is also referenced in http://www.phrack.org/issues.html?issue=67&id=13