Buffer Overflow Attack -- Detection, Analysis, and Prevention

Author: [USA] Foster
Publisher:
Publish Date: 2006-12-01
Features: For buffer overflows, there are three things that impressed me: once successfully exploited a buffer overflow on Linux's imapd; once independently discovered and exploited a buffer overflow in local Linux; once successfully entered someone else's host by writing a buffer overflow. After reading Aleph1's important paper on buffer overflows, "Buffer Overflows for Fun and Profit," most people primarily think of the benefits it brings. Because those proficient in writing buffer overflow programs can earn an annual salary of $90,000 to $120,000 as consultants in any major company in the industry. However, on the other hand, many people have a big misconception about acquiring this skill, thinking that once they learn it, they can rest on their laurels. Indeed, in the IT field, many tricks can be learned, and once you understand them, you possess them. But writing buffer overflow programs is not like that. You can learn the basics from books or crash courses, but the programming environment is always changing. On one hand, hackers are constantly searching for new methods to better exploit vulnerabilities and discover new vulnerability methods; on the other hand, Microsoft is adding protections to its code every day. If you don't write buffer overflow code for three months, the original techniques will become outdated. The hardest part of writing buffer overflows is to come up with new countermeasures based on the ever-changing environment. The tools used to write overflow programs are also constantly changing. Previously, writing an overflow program only required a copy of Softice or GDB, and it could be done by one person alone. But today, even a simple buffer overflow requires considerable investment from Immunity. For example, you need a specialized debugger to query and scriptize running programs; a specialized compiler to create and adjust shellcode needed to overcome weaknesses; reverse engineering tools purchased or generated to solve various problems; and complete MySQL and SSL libraries written in Python. A relatively complex vulnerability exploitation requires coordination from an entire working group. Forensic investigations into some notorious Internet attacks (such as the SQLSlammer and Blaster worms) show that buffer overflows are weaknesses chosen by sophisticated hackers for attacks. These worms slowed down or even paralyzed the Internet and cost billions of dollars to clean up. Currently, more powerful and insidious threats have emerged in the form of "Custom Exploits," where each attack's exploit is different, making them harder to detect and prevent. Neither their names are easily remembered, nor is there related media coverage, but they can bring severe disasters. This book clearly explains that the only way to prevent endless variations of buffer overflow attacks is to improve the design, coding, and testing of all applications. This book is currently the only professional book used for detecting, analyzing, and preventing buffer overflow attacks.