Hot answers tagged

175 votes
Accepted

Why are programs written in C and C++ so frequently vulnerable to overflow attacks?

C and C++, contrary to most other languages, traditionally do not check for overflows. If the source code says to put 120 bytes in an 85-byte buffer, the CPU will happily do so. This is related to the ...
user avatar
103 votes

Old OS memory space protection - was it really that bad?

Memory isolation Your example wouldn't work on Windows 95, but it did work on DOS and Windows up to 3.11 (not Windows NT). The PC architecture, and the Microsoft series of operating systems, started ...
user avatar
97 votes
Accepted

Is it dangerous to compile arbitrary C?

A bit of a weird one, but: it's a denial-of-service risk, or potential information disclosure. Because C's preprocessor will cheerfully include any file specified in an #include directive, somebody ...
user avatar
  • 39k
69 votes
Accepted

Is it important for an ethical hacker to know the C language in-depth nowadays?

Of course, you don't necessarily have to know C, or the given platform's Assembly (read: instruction set), but knowing them is a great help in figuring out many possible low-level vulnerabilities. It ...
user avatar
  • 616
58 votes

Why are programs written in C and C++ so frequently vulnerable to overflow attacks?

Note that there is some amount of circular reasoning involved: Security issues are frequently linked to C and C++. But how much of that is due to inherent weaknesses of these languages, and how much ...
user avatar
  • 911
51 votes
Accepted

I feel like it's impossible to learn reverse engineering

So let me preface this with "I'm not implying you're a child" Often when I teach kids about CIS and they hear what I do for a living, the first question is "How do I hack?" I'll tell you the same ...
user avatar
49 votes

Is C a good choice for security-related software any longer?

The main and almost unique reason why most software in the Linux ecosystem is written in C is Tradition. Developers see software written in C, libraries with a C-based API, and thus they use C, ...
user avatar
  • 168k
43 votes

Is it dangerous to compile arbitrary C?

Compiler bombs C is a very powerful language, and some of the terrible things you can do with it would shock you. For example, you can create a 16 byte C program that takes 27 minutes to compile, and ...
user avatar
37 votes

Why are programs written in C and C++ so frequently vulnerable to overflow attacks?

Actually, "heartbleed" was not really a buffer overflow. To make things more "efficient", they put many smaller buffers into one big buffer. The big buffer contained data from various clients. The bug ...
user avatar
  • 1,823
29 votes

Is it dangerous to compile arbitrary C?

@AndréBorie is correct. Compilers and the corresponding configuration will not be well vetted for security issues, so generally speaking you should not compile untrusted code. The risk is that a ...
user avatar
  • 13.8k
29 votes
Accepted

Does a single fopen introduce TOCTOU vulnerability?

A call to fopen is not in itself a TOCTOU vulnerability. By definition, TOCTOU involves two operations: a “check” and a “use”. A common example of TOCTOU vulnerability is checking access permissions ...
user avatar
29 votes

Is it important for an ethical hacker to know the C language in-depth nowadays?

It depends what you want to do. If you want to build tools that can be used to automate tasks that are often performed for ethical hacking (such as penetration testing, port scanning, SSL/TLS testing ...
user avatar
  • 19.6k
26 votes
Accepted

Why is it dangerous when an attacker can control the `n` parameter to `memcpy()`?

Assuming buf's size is either controlled by n or larger than 16, the attacker could make n any number he wanted and use that to read an arbitrary amount of memory. memcpy and C in general do not ...
user avatar
  • 468
26 votes

Why are programs written in C and C++ so frequently vulnerable to overflow attacks?

First, as others have mentioned, C/C++ is sometimes characterized as a glorified macro assembler: it is meant to be "close to the iron", as a language for system-level programming. So for instance, ...
user avatar
25 votes
Accepted

Exploiting buffer overflow leads to segfault

Your memory address 0xbffff880 is most likely non-executable, but only read/write. There are a couple of ways you can overcome this. If that is a stack address you can use -z execstack while ...
user avatar
  • 12.3k
25 votes

Is C a good choice for security-related software any longer?

You can write secure code in C. Its just that the language is unsafe by default. The safety has to be tacked on manually with extra code (which of course can itself contain bugs). For that reason, C ...
user avatar
  • 351
22 votes
Accepted

Security Implications of Neglecting the Extra Byte for NULL Termination in C/C++ Arrays

String Termination Vulnerability Upon thinking about this more, using strncpy() is probably the most common way (that I can think of) that could create null termination errors. Since generally ...
user avatar
  • 12.3k
21 votes

Why does my x86 shellcode test program segfault?

I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80) [-----...
user avatar
  • 1,954
16 votes

Why is it dangerous when an attacker can control the `n` parameter to `memcpy()`?

A good answer has already been given by sasha, but I want to look at this from another angle; specifically, what memcpy actually does (in terms of what code gets executed). Allowing for the ...
user avatar
  • 7,670
16 votes

Is it dangerous to compile arbitrary C?

Yes, it's dangerous: but as people have said it's possible to do. I'm the author and maintainer of the online compilers at https://gcc.godbolt.org/, and I've found it pretty workable to make it safe ...
user avatar
14 votes

Do high level languages allow for buffer / heap overflow?

"level" of a programming languages is not a particularly well-defined concept. C++ for example would generally be regarded as a higher-level language then C but it still leaves the user open ...
user avatar
  • 4,899
12 votes

Old OS memory space protection - was it really that bad?

If one goes back a few years before Windows, it was pretty much expected that any program running on a microcomputer would "own" the computer. If it wanted certain services to remain usable it would ...
user avatar
  • 2,029
12 votes

Is it dangerous to compile arbitrary C?

You would not want to be running the compiler as root, though I have seen this happen for "ease and convenience" reasons. It would be all too easy for an attacker to include something like: #include ...
user avatar
11 votes

I feel like it's impossible to learn reverse engineering

Reverse engineering is fun. I use IDA once every other week, so I am not an expert in the field but do it often enough. If you want to understand reverse engineering you need to know how to engineer ...
user avatar
  • 2,997
11 votes

Is it important for an ethical hacker to know the C language in-depth nowadays?

In ethical hacking (and hacking in general), the more you know about software and hardware in general, the better off you are - keep in mind there's a lot of different solutions written in lots of ...
user avatar
10 votes

Since when can't any program get MS-DOS and MS-Windows admin rights?

At the time of MS-DOS, or in the graphical derivatives (up to and including Windows ME), there was no notion of "administrative rights". There are two distinct concepts here, that should be detailed. ...
user avatar
  • 168k
9 votes
Accepted

How does using unsigned integers protect against integer overflow attacks?

Using unsigned integers does not prevent overflow. A k-bit variable can only represent 2k different values. No matter how you interpret the bits. What you're probably referring to is the fact that ...
user avatar
8 votes
Accepted

C shellcode explanation

using ndisasm, the data in the sh array can be disassembled into the following valid 64bit x86-machinecode: 00000000 EB0B jmp short 0xd 00000002 5F pop rdi 00000003 ...
user avatar
  • 364

Only top scored, non community-wiki answers of a minimum length are eligible