Being totally immature here, but "Smashing the stack for fun and profit" would make a great book title for the Chaturbate memoir.
Smashing the Stack for Fun and Profit (1996)
51–60 of 66 posts
Re: Smashing the Stack for Fun and Profit (1996)
#52What a classic! Phrack stopped publishing some time ago but the world of security ploughs on, who can recommend similar modern resources to Phrack? Here's a few I'm aware of: https://www.alchemistowl.org/pocorgtfo/ https://secret.club/
While Phrack has stopped, there is the Paper Feed (no generic link, just have to link to the latest in the feed) http://phrack.org/papers/escaping_from_freebsd_bhyve.html
I think one big change these days is just that more people will self-publish their writeups and research. There are also a lot more security conferences that people present at some with a more narrow focus than the well known conferences too leading to more specialty content.
I do a weekly podcast[0] talking just about the latest exploits and strategies/research from the last week and pulling content for that is basically just following a ton of RSS feeds. There is a lot more getting written these days compared with the years when Phrack was regularly released. Unfortunately its also more spread out and harder to find.
Re: Smashing the Stack for Fun and Profit (1996)
#53This article, and then working through the book "Hacking and the Art of Exploitation" taught me the true fundamentals of the C programming language, and Linux. The other key ingredient was working through the classic "digital evolution" wargames where you'd SSH into a box as level1 and work your way up from there.
Another good book is 'Reversing: Secrets of Reverse Engineering' Books like that should be required reading when learning C. It shows you so much that the typical book won't cover.
I'm particular to "Rootkits: Subverting the Windows Kernel". The more you understand about the system you're running on, the more you can do!
Re: Smashing the Stack for Fun and Profit (1996)
#54What a classic! Phrack stopped publishing some time ago but the world of security ploughs on, who can recommend similar modern resources to Phrack? Here's a few I'm aware of: https://www.alchemistowl.org/pocorgtfo/ https://secret.club/
[deleted]
Re: Smashing the Stack for Fun and Profit (1996)
#55This paper also inspired the recent academic paper "Attacking Zcash Protocol For Fun And Profit" available at https://attackingzcash.com and on IACR: https://eprint.iacr.org/2020/627 It describes new kinds of metadata leakage attacks that can be launched against privacy coins, by adversaries with large budgets, such as professional criminal organizations, blockchain analysis companies and nation states. The privacy c…
Interesting. So hush is the only privacy coin in your opinion?
No, there are many privacy coins, but most are indeed just copies of Monero or Zcash. The author of that paper has discovered multiple CVE's in Zcash (https://www.cvedetails.com/cve/CVE-2019-16930/ and https://www.cvedetails.com/cve/CVE-2019-11636/ ).
There are very few unique source codebases which implement privacy coins, maybe a half dozen depending on how lenient you are (i.e. is DASH a privacy coin? Barely, but it could be considered one. Blockchain analysis companies make fun of the "privacy" of DASH.)
I believe when he says "inventing a whole new field" he means inventing a whole new field of attacks and defenses, just like the Phrack paper invented a whole new industry of attacks and then their defenses.
Taking these new kinds of attacks into account, all existing privacy coins are vulnerable. Monero is more vulnerable than Zcash Protocol, since it does not have Zero Knowledge Math. It uses Group Theory, which leaks metadata like crazy.
Re: Smashing the Stack for Fun and Profit (1996)
#56In 2017 I got a second hand Cisco ASA just to play with the shadowbrokers tools. EXTRABACON was the codename for the SNMP exploit using a buffer overflow. This was an interesting excercise because there were NO logs of this happening on the Cisco ASA, not even when ramping every loglevel to debug. Well only on the console port. Exception in readline() or something like it. Doing stuff for security monitoring in daily…
CCTL testing of commercial products at basically any level is a joke; you can just look at the list of certified commercial products and the subsequent vulnerability feeds for them. I'm unaware of anyone in the field that takes them seriously.
Re: Smashing the Stack for Fun and Profit (1996)
#57This has been required reading for all the pentesters at my org for the past 20 years.
Why? Exploitation of novel memory corruption vulnerabilities is pretty rare on penetration tests.
Re: Smashing the Stack for Fun and Profit (1996)
#58I think the main thing to discuss here is how, 25 yrs later, we're still getting overflow bugs.
I seem to recall there being some efforts to standardize "fixes" for C, and they never got adopted by anybody important, so the C development community kind of just failed hardcore to prevent it. IMHO it was never about the tools, it was about how we used them and the interfaces for common conventions.
Actually, I take that back: it is also the tools' fault. GCC should just refuse to compile any reference to strcpy().
Re: Smashing the Stack for Fun and Profit (1996)
#59Does someone know why weren't stack overflow exploits more common in the early 90s?
If the Morris worm used them in 88, how did the technique get lost until this phrack article come out?
Makes me wonder if there are still entire classes of exploits that are undiscovered out there.
Re: Smashing the Stack for Fun and Profit (1996)
#60This article, and then working through the book "Hacking and the Art of Exploitation" taught me the true fundamentals of the C programming language, and Linux. The other key ingredient was working through the classic "digital evolution" wargames where you'd SSH into a box as level1 and work your way up from there.
Your comment caused a forgotten memory to pop up to the surface. Did you by chance happen to participate in the Zebulun Cyber Army Challenge(s) [1]? Those games were very rewarding for a high schooler on the early internet. [1] https://www.ca-zeb.com/
I remember CyberArmy, I think maybe that was where to find war games before dievo? I don't remember the Zebulon name though.