Buffer Overflow Attack - Detection, Analysis, and Prevention

Author: Foster et al. (USA), translated by Cai Mian
Publisher:
Publish Date: 2006-12-01
Features: For buffer overflows, three things impressed me: once successfully exploited a buffer overflow on Linux's imapd; once independently discovered and exploited a buffer overflow in local Linux; once successfully entered someone else's host by writing a buffer overflow. After reading Aleph1's important paper on buffer overflows, "Buffer Overflows for Fun and Profit," most people primarily think of the benefits it brings. Those proficient in writing buffer overflow programs can earn an annual salary of $90,000 to $120,000 as consultants in any major company in the industry. However, on the other hand, many people have a significant misconception about acquiring this skill, believing that once they learn it, they can rest on their laurels. Indeed, in the IT field, many tricks can be learned—once you understand them, you possess them. However, writing buffer overflow programs is not like that. You can learn the basics from books or crash courses, but the programming environment is always changing. On one hand, hackers are constantly seeking new methods to better exploit vulnerabilities and discover new ones; on the other hand, Microsoft is adding protections to its code every day. If you don’t write buffer overflow code for three months, your existing techniques will become outdated. The hardest part of writing buffer overflows is to come up with new countermeasures based on the ever-changing environment. The tools used to write overflow programs are also constantly evolving. Previously, writing an overflow program only required a copy of Softice or GDB, and it could be done by one person alone. But today, even a simple buffer overflow requires considerable investment from Immunity. For example, you need a specialized debugger to query and scriptize running programs; a specialized compiler to create and adjust shellcode needed to overcome weaknesses; reverse engineering tools purchased or generated to solve various problems; and complete MySQL and SSL libraries written in Python. A relatively complex vulnerability exploitation requires coordination from an entire working group. Forensic investigations into some notorious Internet attacks (such as the SQLSlammer and Blaster worms) show that buffer overflows are weaknesses chosen by sophisticated hackers for attacks. These worms slowed down or even paralyzed the Internet and cost billions of dollars to clean up. Currently, more powerful and insidious threats have emerged in the form of "Custom Exploits," where each attack's exploit is different, making them harder to detect and prevent. Neither their names are easily remembered, nor is there related media coverage, but they can still cause severe disasters. This book clearly explains that the only way to prevent endless variations of buffer overflow attacks is to ensure perfect design, coding, and testing of all applications. This book is the only professional book currently available for detecting, analyzing, and preventing buffer overflow attacks.