4 ms·

Damn interesting I might say. It piqued my interest and is truly strange in that the waves of buffer overflow exploits took time to become mainstream. I have

Damn interesting I might say. It piqued my interest and is truly strange in that the waves of buffer overflow exploits took time to become mainstream. I have seen it with other stuff like good mobile, killer apps, standards etc. Where ideas are talked about for a long time then finally they get written, then packaged and products, then mass adoption after a certain time. I would argue is that when it became a game, people played, competition stifled... The article states “Smashing the Stack for Fun and Profit“ was released and then many examples spawned, which further spawned more and more ad infinitum. I mean which one piques your interest: - COMPUTER SECURITY TECHNOLOGY PLANNING STUDY OR - “Smashing the Stack for Fun and Profit“ Game it...

viraptor 17y ago
> took time to become mainstream One more important event is not mentioned. Internet became a mainstream thing in middle 90' - that's more or less when the flood of buffer overflows and format string exploits really started. Before that, network apps were mostly created and used by people who "knew stuff" in general...
- barrkel 17y ago
  You've pin-pointed it. Without a commonly available transmission vector, buffer overflow exploits were the hard way to get around - and if you weren't coming from across a network, you likely already had full control over the local machine, as it was probably running DOS, Windows 3.11, Win 95, etc. Much easier was boot sector viruses, particularly since PCs by default tried to boot off any floppy left in the drive when turned on; that, and infected executables.
  - tptacek 17y ago
    No. Attacks against machines running Windows weren't common until the second half of the '90s. Far and away the most popular targets in the earlier '90s were NFS servers. And nobody attacked machines by trying to infect them with boot sector malware.
    - barrkel 17y ago
      It depends on what you mean by "attack"; and I include DOS and Win 3.11. In the early 90s, the most common viruses I saw were infected executables (i.e. modified programs that when run, searched for other executables to infect) and boot sector viruses, often both in one. I worked part-time as a PC technician in the early 90s, building, upgrading and repairing PCs. I was there :)
- InclinedPlane 17y ago
  More so, the internet became so popular that significant portions of the IP v4 address space was in use. This is important because it means that a very simple piece of worm code which merely probes random IP addresses attempting to infect other vulnerable machines will have a non-trivially high success rate. High enough in fact to be able to spread exponentially through the internet until nearly all vulnerable hosts have been infected over a matter of mere days. This combination: massive vulnerabilities in popular operating systems due to a failure to take the risk of exploitation seriously; large numbers of computers operated by unsophisticated users directly on the internet (plugged directly into a cable or dsl modem, for example) with no firewall or NAT bridge protecting any of their services; and an address space full of vulnerable systems, led to a perfect storm for the spread of computer worms.
  - tptacek 17y ago
    The first genuinely successful worm didn't strike until 8 years after the first modern overflow exploit. So I don't think that's a compelling argument.
- NateLawson 17y ago
  I disagree. The Internet had grown enough by 1988 to host the Internet worm, which exploited a buffer overflow among other things. So that doesn't explain this 7-year gap. The best explanation is that there were plenty of other Unix holes (race conditions, rhosts, etc.) to exploit that didn't require inventing an entirely new technique. The second part of the article goes into this in much more depth (HN link). http://news.ycombinator.com/item?id=1321562 http://news.ycombinator.com/item?id=1321562

viraptor 17y ago

> took time to become mainstream One more important event is not mentioned. Internet became a mainstream thing in middle 90' - that's more or less when the flood of buffer overflows and format string exploits really started. Before that, network apps were mostly created and used by people who "knew stuff" in general...

barrkel 17y ago
You've pin-pointed it. Without a commonly available transmission vector, buffer overflow exploits were the hard way to get around - and if you weren't coming from across a network, you likely already had full control over the local machine, as it was probably running DOS, Windows 3.11, Win 95, etc. Much easier was boot sector viruses, particularly since PCs by default tried to boot off any floppy left in the drive when turned on; that, and infected executables.
- tptacek 17y ago
  No. Attacks against machines running Windows weren't common until the second half of the '90s. Far and away the most popular targets in the earlier '90s were NFS servers. And nobody attacked machines by trying to infect them with boot sector malware.
  - barrkel 17y ago
    It depends on what you mean by "attack"; and I include DOS and Win 3.11. In the early 90s, the most common viruses I saw were infected executables (i.e. modified programs that when run, searched for other executables to infect) and boot sector viruses, often both in one. I worked part-time as a PC technician in the early 90s, building, upgrading and repairing PCs. I was there :)
InclinedPlane 17y ago
More so, the internet became so popular that significant portions of the IP v4 address space was in use. This is important because it means that a very simple piece of worm code which merely probes random IP addresses attempting to infect other vulnerable machines will have a non-trivially high success rate. High enough in fact to be able to spread exponentially through the internet until nearly all vulnerable hosts have been infected over a matter of mere days. This combination: massive vulnerabilities in popular operating systems due to a failure to take the risk of exploitation seriously; large numbers of computers operated by unsophisticated users directly on the internet (plugged directly into a cable or dsl modem, for example) with no firewall or NAT bridge protecting any of their services; and an address space full of vulnerable systems, led to a perfect storm for the spread of computer worms.
- tptacek 17y ago
  The first genuinely successful worm didn't strike until 8 years after the first modern overflow exploit. So I don't think that's a compelling argument.
NateLawson 17y ago
I disagree. The Internet had grown enough by 1988 to host the Internet worm, which exploited a buffer overflow among other things. So that doesn't explain this 7-year gap. The best explanation is that there were plenty of other Unix holes (race conditions, rhosts, etc.) to exploit that didn't require inventing an entirely new technique. The second part of the article goes into this in much more depth (HN link). http://news.ycombinator.com/item?id=1321562 http://news.ycombinator.com/item?id=1321562