4 ms·

I remember when my University copied a couple of these, I decided to go the full mile on the one where you exploit buffer overflow. I got myself a remote connec

I remember when my University copied a couple of these, I decided to go the full mile on the one where you exploit buffer overflow. I got myself a remote connection via execve, and was going to mess around, but soon realized I could also see and edit others' scores which could get me in significant trouble, so I had to make one log-scrubbing attack then stop. I'm surprised they never fixed the hole by containerizing it or something.

josephg 8y ago
I ran an in-class test/competition once where students submitted C code to a web server running on my laptop. My laptop compiled and ran their code - then checked it against a test suite and graded it all live. One student asked about security - and we got into a great discussion about permissions and what havoc he could and couldn’t pull off with the restricted user account. I encouraged him to figure out how to write a fork bomb - which he got working after the test. He was nervous about it because he didn’t want to get in trouble. With some reassurances he dove into API documentation and got it working. My computer totally died and needed a reboot. It was a great little teaching opportunity that I’m glad I didn’t pass up
- techntoke 8y ago
  Ah, how simple it would have been to run in a virtual machine.
  - josephg 8y ago
    How simple it would have been to miss this teaching opportunity! If my laptop were fully protected from that attack, it wouldn't have been as much fun for my student to wreck my machine in front of everyone. And so he might not have done it, and my class would have missed out on a beautiful demonstration and discussion of practical security engineering.
- paulmd 8y ago
  I forkbombed our server once by accident. I normally code a snippet at a time, see if it works, then go a little bit farther. Unfortunately you don't really want to have a loop with a fork in it with no exit condition. Really failed to think that one through. (in my defense you probably should have ulimits set on a server where students are going to be logging in and working...)
  - SiempreViernes 8y ago
    The web interface to our local cloud at university became downright unusable for a week before we found that the problem was that a server on the cloud used for teaching was getting ddos'ed. Apparently some student set up a mmorpg server and then made some enemies...

josephg 8y ago

I ran an in-class test/competition once where students submitted C code to a web server running on my laptop. My laptop compiled and ran their code - then checked it against a test suite and graded it all live. One student asked about security - and we got into a great discussion about permissions and what havoc he could and couldn’t pull off with the restricted user account. I encouraged him to figure out how to write a fork bomb - which he got working after the test. He was nervous about it because he didn’t want to get in trouble. With some reassurances he dove into API documentation and got it working. My computer totally died and needed a reboot. It was a great little teaching opportunity that I’m glad I didn’t pass up

techntoke 8y ago
Ah, how simple it would have been to run in a virtual machine.
- josephg 8y ago
  How simple it would have been to miss this teaching opportunity! If my laptop were fully protected from that attack, it wouldn't have been as much fun for my student to wreck my machine in front of everyone. And so he might not have done it, and my class would have missed out on a beautiful demonstration and discussion of practical security engineering.
paulmd 8y ago
I forkbombed our server once by accident. I normally code a snippet at a time, see if it works, then go a little bit farther. Unfortunately you don't really want to have a loop with a fork in it with no exit condition. Really failed to think that one through. (in my defense you probably should have ulimits set on a server where students are going to be logging in and working...)
- SiempreViernes 8y ago
  The web interface to our local cloud at university became downright unusable for a week before we found that the problem was that a server on the cloud used for teaching was getting ddos'ed. Apparently some student set up a mmorpg server and then made some enemies...