175
votes
Accepted
Why are programs written in C and C++ so frequently vulnerable to overflow attacks?
C and C++, contrary to most other languages, traditionally do not check for overflows. If the source code says to put 120 bytes in an 85-byte buffer, the CPU will happily do so. This is related to the ...
- 325k
103
votes
Old OS memory space protection - was it really that bad?
Memory isolation
Your example wouldn't work on Windows 95, but it did work on DOS and Windows up to 3.11 (not Windows NT).
The PC architecture, and the Microsoft series of operating systems, started ...
97
votes
Accepted
Is it dangerous to compile arbitrary C?
A bit of a weird one, but: it's a denial-of-service risk, or potential information disclosure.
Because C's preprocessor will cheerfully include any file specified in an #include directive, somebody ...
- 45.4k
69
votes
Accepted
Is it important for an ethical hacker to know the C language in-depth nowadays?
Of course, you don't necessarily have to know C, or the given platform's Assembly (read: instruction set), but knowing them is a great help in figuring out many possible low-level vulnerabilities.
It ...
- 616
58
votes
Why are programs written in C and C++ so frequently vulnerable to overflow attacks?
Note that there is some amount of circular reasoning involved: Security issues are frequently linked to C and C++. But how much of that is due to inherent weaknesses of these languages, and how much ...
- 911
50
votes
Accepted
I feel like it's impossible to learn reverse engineering
So let me preface this with "I'm not implying you're a child"
Often when I teach kids about CIS and they hear what I do for a living, the first question is
"How do I hack?"
I'll tell you the same ...
- 1,451
49
votes
Is C a good choice for security-related software any longer?
The main and almost unique reason why most software in the Linux ecosystem is written in C is Tradition. Developers see software written in C, libraries with a C-based API, and thus they use C, ...
- 172k
44
votes
Is it dangerous to compile arbitrary C?
Compiler bombs
C is a very powerful language, and some of the terrible things you can do with it would shock you. For example, you can create a 16 byte C program that takes 27 minutes to compile, and ...
- 545
37
votes
Why are programs written in C and C++ so frequently vulnerable to overflow attacks?
Actually, "heartbleed" was not really a buffer overflow. To make things more "efficient", they put many smaller buffers into one big buffer. The big buffer contained data from various clients. The bug ...
- 2,125
29
votes
Is it dangerous to compile arbitrary C?
@AndréBorie is correct. Compilers and the corresponding configuration will not be well vetted for security issues, so generally speaking you should not compile untrusted code.
The risk is that a ...
- 13.9k
29
votes
Accepted
Does a single fopen introduce TOCTOU vulnerability?
A call to fopen is not in itself a TOCTOU vulnerability. By definition, TOCTOU involves two operations: a “check” and a “use”.
A common example of TOCTOU vulnerability is checking access permissions ...
29
votes
Is it important for an ethical hacker to know the C language in-depth nowadays?
It depends what you want to do.
If you want to build tools that can be used to automate tasks that are often performed for ethical hacking (such as penetration testing, port scanning, SSL/TLS testing ...
- 22.1k
26
votes
Why are programs written in C and C++ so frequently vulnerable to overflow attacks?
First, as others have mentioned, C/C++ is sometimes characterized as a glorified macro assembler: it is meant to be "close to the iron", as a language for system-level programming.
So for instance, ...
- 439
25
votes
Is C a good choice for security-related software any longer?
You can write secure code in C. Its just that the language is unsafe by default. The safety has to be tacked on manually with extra code (which of course can itself contain bugs).
For that reason, C ...
- 351
22
votes
Accepted
Security Implications of Neglecting the Extra Byte for NULL Termination in C/C++ Arrays
String Termination Vulnerability
Upon thinking about this more, using strncpy() is probably the most common way (that I can think of) that could create null termination errors. Since generally ...
- 12.4k
21
votes
Why does my x86 shellcode test program segfault?
I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80)
[-----...
- 1,954
16
votes
Is it dangerous to compile arbitrary C?
Yes, it's dangerous: but as people have said it's possible to do. I'm the author and maintainer of the online compilers at https://gcc.godbolt.org/, and I've found it pretty workable to make it safe ...
- 269
15
votes
Do high level languages allow for buffer / heap overflow?
"level" of a programming languages is not a particularly well-defined concept.
C++ for example would generally be regarded as a higher-level language then C but it still leaves the user open ...
- 5,046
12
votes
Old OS memory space protection - was it really that bad?
If one goes back a few years before Windows, it was pretty much expected
that any program running on a microcomputer would "own" the computer. If
it wanted certain services to remain usable it would ...
- 2,059
12
votes
Is it dangerous to compile arbitrary C?
You would not want to be running the compiler as root, though I have seen this happen for "ease and convenience" reasons. It would be all too easy for an attacker to include something like:
#include ...
- 1,890
11
votes
I feel like it's impossible to learn reverse engineering
Reverse engineering is fun. I use IDA once every other week, so I am not an expert in the field but do it often enough. If you want to understand reverse engineering you need to know how to engineer ...
- 3,002
11
votes
Is it important for an ethical hacker to know the C language in-depth nowadays?
In ethical hacking (and hacking in general), the more you know about software and hardware in general, the better off you are - keep in mind there's a lot of different solutions written in lots of ...
- 211
10
votes
Since when can't any program get MS-DOS and MS-Windows admin rights?
At the time of MS-DOS, or in the graphical derivatives (up to and including Windows ME), there was no notion of "administrative rights".
There are two distinct concepts here, that should be detailed. ...
- 172k
9
votes
Accepted
How does using unsigned integers protect against integer overflow attacks?
Using unsigned integers does not prevent overflow. A k-bit variable can only represent 2k different values. No matter how you interpret the bits.
What you're probably referring to is the fact that ...
- 810
9
votes
Write a Python or C program to guess the key
I agree with multithr3at3d that this question smells like a homework problem. But, it's a fun exercise - and more importantly, it highlights the reason that strong random number generators are so ...
- 22.1k
8
votes
Coding to detect DDOS
I'd try to go with established tools first, before writing my own networking interface monitoring code.
Chances are that if you're trying to protect a server, you'll be helpless against a ...
- 9,233
7
votes
What are attackers trying to achieve when doing attacks on local programs such as buffer overflows?
An aspect which hasn't been mentioned yet very clearly: suppose you have a multi-user system (as all modern PC OSes like Windows, Linux, Unix and so on are), and suppose you are a normal (non-...
- 557
7
votes
Accepted
Is `arc4random` secure enough?
Both arc4random and /dev/urandom have histories of problems. Some systems have reimplemented arc4random without RC4, but some systems kept RC4. I prefer arc4random over /dev/urandom, but if your ...
- 186
Only top scored, non community-wiki answers of a minimum length are eligible