Tag Info

Hot answers tagged

6

"Traditional Way" could mean anything. I'm assuming you're referring to a buffer overflow where the return address is replaced with an attacker controlled address on the memory to execute artbitrary code. Yes, this is mitigated by the NX bit. But, no. This does not stop attackers from using other mechanisms such as Return oriented programming which uses ROP ...


2

A great, in-depth resource on a buffer overflow attack is the Smashing the Stack tutorial by Aleph One. While stack overflow and heap overflow are subtly different, the techniques are similar/related. Felix "FX" Lindner writes an excellent article (2006) on The H Security which describes your exploit in depth. Condensed version below; strongly recommend ...


2

First, a small clarification: Classic heap sprays never needed to fill the entire virtual address anyway. They only needed to fill enough of memory to cover the range of uncertainty you have for the address of whether the shellcode will be. Thus, 100MB or so were enough. The picture changed a lot with the advent of DEP, because one can no longer spray ...


2

In C, when you are finished using memory on the heap, you free() it which makes it available for use elsewhere. free() doesn't clear/wipe the memory to all zeros, so the next caller who asks for that memory will get the memory with its sensitive contents still intact unless you explicitly zero it before calling free(). Programs also often implement their own ...


2

Peter(corelanc0d3r) - Corelan team has one of the best Buffer Overflow tutorials on the internet


1

Glibc has some inherent capabilities at detecting overruns, and they can be activated with the environment variable MALLOC_CHECK_. See mcheck and mallopt for details. Trying it out on a 64-bit Ubuntu 14.04 system, it seems that when allocating many memory blocks, malloc() rounds up the requested size to the next multiple of 8, and uses 8 extra bytes. E.g., ...


1

A similar approach is function pointer encryption, similar to that used to protect malloc metadata. This is proposed in section 2.4 of "Protection Against Overflow Attacks" The book's analysis is favorable. There is also an older paper about this technique (and another one). However, as far as I know, this technique is not is active use. I have absolutely ...


1

Canaries within an object run into one practical problem: it changes the in-memory layout of these objects. This layout needs to be consistent when passed between, say, the program and libraries. If you passed a pointer of type struct whatever * from a program compiled with this instrumentation, to a library compiled without this instrumentation (but with ...


1

Windows has had Data Execution Protection since XP SP 2, but it's not always enabled by default, and it can be disabled for specific applications. So, many stack cracking exploits will be blocked, but probably not all of them. As for "all news OSes", YMMV. It's better to ask about specific ones.


1

One way to overcome the no execute bit is to use different overflow targets entirely. People focus too much on the shell code style overflow vulnerabilities, and ignore a large portion of the vulnerabilities that are out there. For example, you can overflow into other arrays and even strings. You don't need to corrupt the stack or heap state to exploit a ...


1

Heap Spraying is more the distraction used to enable someone to perform the actual attack. It in itself does not compromise any security measure. It is typically used in conjunction with injected code which is the payload. Think of it as a no op sled.



Only top voted, non community-wiki answers of a minimum length are eligible