Gera's Insecure Programming tutorial on advanced Buffer Overflows was quite seminal. The site is gone but there's a GitHub repo now.
Smashing the Stack for Fun and Profit (1996)
41–50 of 66 posts
Re: Smashing the Stack for Fun and Profit (1996)
#42Earlier quoted context omitted.
The assumptions about environment and the system-under-test has been the Achilles' heel in any certification I've been part of. It isn't like the CC folks aren't aware of the problem. The idea was that the Security Target (definition of the system) could declare conformance to a standardized Protection Profile which consumers could use as a shortcut to understanding what was promised. However, nobody looks at STs nor…
Just like almost every FIPS 140 validated crypto module has a "FIPS mode" that is what was validated but is never actually used in production, even by government customers.
I'm unfortunately quite familiar with that.
Beyond getting slower updates, etc, FIPS mode has the unintentional side effect of being the "look at me I have interesting stuff" flag for potential attackers. It is usually quite easy to determine remotely that a networked device is in FIPS mode, too (due to allowed crypto protocols, etc).
Re: Smashing the Stack for Fun and Profit (1996)
#43A classic, but these days if you want to reproduce those bugs you need to build your code with -fno-stack-protector, enable executable stack, disable ASLR in the kernel, etc.
I believe Hacking: The Art of Exploitation comes with a disc that has an exploitable image on it.
Re: Smashing the Stack for Fun and Profit (1996)
#44Reading this article back in the day is how I learned how stack smashing works! I also remember when the EFF stopped hosting Phrack because most of their bandwidth was people downloading every issue off the EFF’s web server.
[deleted]
Re: Smashing the Stack for Fun and Profit (1996)
#45Reading this article back in the day is how I learned how stack smashing works! I also remember when the EFF stopped hosting Phrack because most of their bandwidth was people downloading every issue off the EFF’s web server.
Correction: it was hosted on an anonymous FTP server, not a web server. Also, I was one of those people who downloaded every issue, probably with ncftp.
Re: Smashing the Stack for Fun and Profit (1996)
#462009 had the main discussion: https://news.ycombinator.com/item?id=943185
I thought there were others but maybe not? Single-comment threads from 2016, 2014, 2012, 2011:
https://news.ycombinator.com/item?id=11007757
https://news.ycombinator.com/item?id=10821934
https://news.ycombinator.com/item?id=8773298
Re: Smashing the Stack for Fun and Profit (1996)
#47This paper also inspired the recent academic paper "Attacking Zcash Protocol For Fun And Profit" available at https://attackingzcash.com and on IACR: https://eprint.iacr.org/2020/627
It describes new kinds of metadata leakage attacks that can be launched against privacy coins, by adversaries with large budgets, such as professional criminal organizations, blockchain analysis companies and nation states. The privacy coin HUSH has developed this defensive technology and was first to implement it in September 2019.
There is a YouTube video where the author explains why he named the paper this way, this link has the timestamp where it's talked about: https://youtu.be/berM7Dnnoz4?t=405
"This is a whole new research field I am creating, that is why I called it Attacking Zcash Protocol For Fun And Profit, just like Smashing The Stack for Fun And Profit, it created a whole new field"
Also, for the hardcore HN nerds: The paper focuses on Zcash Protocol, but the ideas apply to any cryptocoin with a transaction graph, so Monero is definitely vulnerable. Much more vulnerable that Zcash Protocol.
Re: Smashing the Stack for Fun and Profit (1996)
#48This paper also inspired the recent academic paper "Attacking Zcash Protocol For Fun And Profit" available at https://attackingzcash.com and on IACR: https://eprint.iacr.org/2020/627 It describes new kinds of metadata leakage attacks that can be launched against privacy coins, by adversaries with large budgets, such as professional criminal organizations, blockchain analysis companies and nation states. The privacy c…
Interesting. So hush is the only privacy coin in your opinion?
Re: Smashing the Stack for Fun and Profit (1996)
#49This article, and then working through the book "Hacking and the Art of Exploitation" taught me the true fundamentals of the C programming language, and Linux. The other key ingredient was working through the classic "digital evolution" wargames where you'd SSH into a box as level1 and work your way up from there.
Another good book is 'Reversing: Secrets of Reverse Engineering' Books like that should be required reading when learning C. It shows you so much that the typical book won't cover.
Yes! What it taught me was, to master a layer of abstraction, learn the layer it sits on top of as well.
Re: Smashing the Stack for Fun and Profit (1996)
#50I learned so much from this article about how memory works when I was starting out, thanks phrack!