3 ms·
The parsing is actually fine. The issue is that they forced a buffer to overflow--they put N bytes of data into a bucket that was can only hold n bytes. The ex
by mattkrause 9y ago
The parsing is actually fine.
The issue is that they forced a buffer to overflow--they put N bytes of data into a bucket that was can only hold n bytes. The extra N-n bytes were carefully chosen so that they would do something "interesting" when they spill out of the bucket and into the program's code (there are ways of avoiding this, like the No-eXcecute bit, which I guess were ignored/turned off for this demo).
In some ways, this is easier to do with unstructured data. If there was some specific format, the overflowed data would have to fit into that format AND do something malicious.
- dboreham 9y agoThis makes no sense to me as someone who has written plenty of protocol code. The DNA data is essentially random bits. It has no packet size.
- mattkrause 9y agoAssuming I understand the paper correctly.... 1. The DNA is sequenced. 2. Sequence data are compressed with a version of fqzcomp which has been modified to use/overflow a static buffer. 3. Something about this particular DNA sequence overflows a buffer in fqzcomp 4. The overflow contains some kind of exploit. The paper is a little vague about where they inserted the exploit into fzcomp(https://fqzcomp.sourceforge.io/ https://fqzcomp.sourceforge.io/), but it does process the DNA sequence a block at a time. It tracks the frequency distribution of nucleotides so it can model them for compression. I hope the exploit was something really clever, like finding a DNA sequence that puts the encoder in a weird state, but it's also possible they just set BLK_SIZE to 1 or something like that.