3 ms·
This is (yet) another buffer overflow exploit. Writing your code in a safe language makes buffer overflows obsolete. This problem was solved a long time ago. It
by winter_blue 9y ago
This is (yet) another buffer overflow exploit. Writing your code in a safe language makes buffer overflows obsolete. This problem was solved a long time ago. It should have been obsolete by now.
Even with code written in unsafe languages, ASLR and the XD/NX bit makes this class of exploits almost completely obsolete. I'm assuming the DNA software they were using had neither turned on.
I'm a bit exhausted of hearing about buffer overflow exploits. There's nothing smart or clever about them (anymore).
- ajross 9y agoThe vulnerability was deliberately injected for the demonstration.
- Gaelan 9y agoWait what? “Code with security bugs is subject to malware” is not news. The only interesting bit of this headline would be an existing bug in DNA-reading code.
- snakeanus 9y ago> Writing your code in a safe language makes buffer overflows obsolete Most languages can be safe with a safe implementation and most languages can be unsafe with an unsafe implementation. Just use a safe implementation next time, or go all-in and formally verify your programs.
- dreamcompiler 9y agoWhat's a "safe implementation" of C?
- snakeanus 9y agoSomething like https://staff.aist.go.jp/y.oiwa/FailSafeC/index-en.html https://staff.aist.go.jp/y.oiwa/FailSafeC/index-en.html or GCC/Clang with the sanitisers.
- pdimitar 9y agoToo generalizing. I don't think -- an example off the top of my head, don't nitpick please -- that Clojure and Erlang/Elixir are that easily exploited with buffer overflows. I'd even say they are immune but I am not a security researcher.