full-disclosure - Re: 18th anniversary of Internet worma.k.a.Morris worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ejanbf$emc$1@sea.gmane.org>
Date: Mon, 13 Nov 2006 21:16:30 -0000
From: "Dave \"No, not that one\" Korn" <davek_throwaway@...mail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: 18th anniversary of Internet worma.k.a.Morris
	worm

Valdis.Kletnieks@...edu wrote:
> On Sun, 12 Nov 2006 18:21:16 GMT, "Dave \"No, not that one\" Korn" said:
> > Georgi Guninski wrote:
> > > my question was:
> > >
> > > when was the first provable *public* (as in common sense)
> > > announcement of the exploitability of buffer overflows.
> >
> >   The use of smashing the stack to seize control of the program flow was 
> > in
> > everyday usage on the Commodore PET from around 1979-1980ish.  It was 
> > our
> > standard technique for making programs autorun after loading!
>
> Was that a "classic" smash-the-stack, where an overly long paramater is 
> used
> to over-write the return pointer, or were you guys just intercepting the
> return pointer directly?

  Well, it wasn't a parameter, but it was overwriting the return pointer. 
Everything lived at absolute addresses on that machine, there being no 
dynamic allocation or memory management.  The stack lived a short distance 
in memory below the area reserved for program code.  By setting the 
(absolute) load address of your program a couple of pages lower than usual, 
the first thing that got loaded was your stack, then your program area, so 
you could overwrite the stack with an address in the code region and as soon 
as the kernel's tape load routine returned you seized control.

> If the latter, I'm pretty sure there was software
> that would overlay return pointers in order to redirect program flow as 
> far
> back as IBM's OS/360 in the 1967-75 timeframe.

  Indeed, and there's also the age-old technique of implementing a computed 
goto by pushing the address on the stack and executing a ret (rts for you 
old 6502 heads out there) instruction.

  This is all kind of tangential to Georgi's question about when the first 
public announcement was made, but the point I'm getting at is that the 
general principles of stack manipulation to control program flow either 
deliberately or unexpectedly had been in the air for some time; so no matter 
when the first public announcement of *a* stack-smashing buffer overflow 
vulnerability was made, it would already have been common knowledge that 
buffer overflows *in general* could be used to manipulate the stack; I don't 
suppose there was one initial announcement and then suddenly everyone 
realised the stack could be smashed, I reckon lots of people were gradually 
putting two and two together independently.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today.... 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/