Decades On, Buffer Overflows Still the Target

Buffer overflows have been a serious security problem for software developers for several decades now, but the history of exploitation research on this class of flaws is relatively short.

Attackers and researchers originally focused on finding, fixing or exploiting buffer overflows on non-x86 systems, as those were the machines operating the networks that mattered in the 1980s and early 1990s. And, as researcher Nate Lawson explains, that soon changed.

 In August [1995], 8lgm published an advisory for syslog() on SunOS SPARC, but no public exploit. In December, the splitvt exploit for Linux x86 was published. However, a month later, some people were still wondering how it worked.

In November 1996, Aleph1 published “Smashing the Stack for Fun and Profit“. This important article described in detail the evolution of a stack overflow exploit. Though I don’t know the exact history, Aleph1′s x86 shellcode is nearly identical to the splitvt exploit, so perhaps his method was derived from it. The article also provided shellcode for SunOS and Solaris on SPARC, which was an important advance since such machines were still more “interesting” than x86 systems.

After this paper, numerous stack overflows were published. Research on both sides advanced rapidly, with new techniques such as heap overflow exploitation and stack integrity protection. So why had research in this area taken so long to reach this inflection point of rapid growth?

Once Aleph1's paper was published, it focused a lot of attention and energy on buffer overflow exploitation and defense. It's been nearly 15 years since that paper's publication, and in that time software vendors such as Microsoft, Sun, Mozilla and dozens of others have addressed buffer overflows, and memory exploits in general, by adding a number of protection mechanisms.

But technologies like ASLR and DEP, while effective in many scenarios, can't stop everything. Creative exploitation techniques have shown that in the last couple of years. As Lawson points out, the arms race that began in 1996--or earlier--on buffer overflow defense and exploitation, is still running.

Commenting on this Article is closed.