Tag Info

Hot answers tagged

6

"Traditional Way" could mean anything. I'm assuming you're referring to a buffer overflow where the return address is replaced with an attacker controlled address on the memory to execute artbitrary code. Yes, this is mitigated by the NX bit. But, no. This does not stop attackers from using other mechanisms such as Return oriented programming which uses ROP ...


4

"Drive-by-download" refers to the behaviour of the malware: it will (attempt to) infect the user during normal interaction with a web page. Buffer and stack overflow, on the other hand, are two technics used to attack a vulnerable application. They are not limited to the web in any way. (any software that takes some form of input - i.e. all software - is ...


2

First, a small clarification: Classic heap sprays never needed to fill the entire virtual address anyway. They only needed to fill enough of memory to cover the range of uncertainty you have for the address of whether the shellcode will be. Thus, 100MB or so were enough. The picture changed a lot with the advent of DEP, because one can no longer spray ...


2

In C, when you are finished using memory on the heap, you free() it which makes it available for use elsewhere. free() doesn't clear/wipe the memory to all zeros, so the next caller who asks for that memory will get the memory with its sensitive contents still intact unless you explicitly zero it before calling free(). Programs also often implement their own ...


2

Peter(corelanc0d3r) - Corelan team has one of the best Buffer Overflow tutorials on the internet


2

A drive-by-download isn't an attack. It just means that the malware will be automatically downloaded and executed without the user doing anything (I.E. You only have to visit a site for you to be infected). It may well be delivered via a JS exploit. This differentiates it from user-initiated malware, where a website will trick you into downloading and ...


2

A great, in-depth resource on a buffer overflow attack is the Smashing the Stack tutorial by Aleph One. While stack overflow and heap overflow are subtly different, the techniques are similar/related. Felix "FX" Lindner writes an excellent article (2006) on The H Security which describes your exploit in depth. Condensed version below; strongly recommend ...


1

(1) Drive-By-Download Attack A 'drive-by-download' attack is a malware delivery technique that is triggered simply because the user visited a website. A drive-by download Malware will usually take advantage of (or “exploit”) a browser, app, or operating system that is out of date and has a security flaw. ...


1

Windows has had Data Execution Protection since XP SP 2, but it's not always enabled by default, and it can be disabled for specific applications. So, many stack cracking exploits will be blocked, but probably not all of them. As for "all news OSes", YMMV. It's better to ask about specific ones.


1

One way to overcome the no execute bit is to use different overflow targets entirely. People focus too much on the shell code style overflow vulnerabilities, and ignore a large portion of the vulnerabilities that are out there. For example, you can overflow into other arrays and even strings. You don't need to corrupt the stack or heap state to exploit a ...


1

Glibc has some inherent capabilities at detecting overruns, and they can be activated with the environment variable MALLOC_CHECK_. See mcheck and mallopt for details. Trying it out on a 64-bit Ubuntu 14.04 system, it seems that when allocating many memory blocks, malloc() rounds up the requested size to the next multiple of 8, and uses 8 extra bytes. E.g., ...


1

A similar approach is function pointer encryption, similar to that used to protect malloc metadata. This is proposed in section 2.4 of "Protection Against Overflow Attacks" The book's analysis is favorable. There is also an older paper about this technique (and another one). However, as far as I know, this technique is not is active use. I have absolutely ...


1

Canaries within an object run into one practical problem: it changes the in-memory layout of these objects. This layout needs to be consistent when passed between, say, the program and libraries. If you passed a pointer of type struct whatever * from a program compiled with this instrumentation, to a library compiled without this instrumentation (but with ...


1

Heap Spraying is more the distraction used to enable someone to perform the actual attack. It in itself does not compromise any security measure. It is typically used in conjunction with injected code which is the payload. Think of it as a no op sled.



Only top voted, non community-wiki answers of a minimum length are eligible