8 ms·

Smashing the Stack for Fun and Profit (1996)

181 points by keskadale 6y ago

maerF0x0 6y ago
I think the main thing to discuss here is how, 25 yrs later, we're still getting overflow bugs.
- saagarjha 6y ago
  It's a bit disappointing to still see overflows around, but at least blindly smashing the stack is no longer usually exploitable for modern systems with basic security.
- 0xbadcafebee 6y ago
  I seem to recall there being some efforts to standardize "fixes" for C, and they never got adopted by anybody important, so the C development community kind of just failed hardcore to prevent it. IMHO it was never about the tools, it was about how we used them and the interfaces for common conventions. Actually, I take that back: it is also the tools' fault. GCC should just refuse to compile any reference to strcpy().
ctocoder 6y ago
how I loved trying this in the computer science lab when this 1st hit gopher.
__jf__ 6y ago
In 2017 I got a second hand Cisco ASA just to play with the shadowbrokers tools. EXTRABACON was the codename for the SNMP exploit using a buffer overflow. This was an interesting excercise because there were NO logs of this happening on the Cisco ASA, not even when ramping every loglevel to debug. Well only on the console port. Exception in readline() or something like it. Doing stuff for security monitoring in daily life this ehm was alarming, but not unexpected. Fixing “No logs” is often a challenge for blue teams. Anyway it was alarming enough to find and read through the Common Criteria EAL4+ certification docs for the Cisco ASA only to find that SNMP was excluded from certification scope. I still have the idea in the back of my head to explore scope exclusions in other certification docs for other unfortunate exclusions. Also the lack of mitigations like stack canaries, ASLR or others was quite surprising for a certified black box security device on the network perimeter.
- jnwatson 6y ago
  The assumptions about environment and the system-under-test has been the Achilles' heel in any certification I've been part of. It isn't like the CC folks aren't aware of the problem. The idea was that the Security Target (definition of the system) could declare conformance to a standardized Protection Profile which consumers could use as a shortcut to understanding what was promised. However, nobody looks at STs nor PPs except the vendor and the certifier, so all that work is for naught. You could absolutely get a CC cert with the environment that it is unplugged from a network.
  - ralph84 6y ago
    Just like almost every FIPS 140 validated crypto module has a "FIPS mode" that is what was validated but is never actually used in production, even by government customers.
    - jnwatson 6y ago
      I'm unfortunately quite familiar with that. Beyond getting slower updates, etc, FIPS mode has the unintentional side effect of being the "look at me I have interesting stuff" flag for potential attackers. It is usually quite easy to determine remotely that a networked device is in FIPS mode, too (due to allowed crypto protocols, etc).
- tptacek 6y ago
  CCTL testing of commercial products at basically any level is a joke; you can just look at the list of certified commercial products and the subsequent vulnerability feeds for them. I'm unaware of anyone in the field that takes them seriously.
somesortofsystm 6y ago
A true classic that is just as relevant today as ever. Know thy stack! Yes, you still have a .text section!
f00zz 6y ago
A classic, but these days if you want to reproduce those bugs you need to build your code with -fno-stack-protector, enable executable stack, disable ASLR in the kernel, etc.
- wizzwizz4 6y ago
  Not really. If you can overwrite the return address, and you have some time to plan out your payload in advance, you can write a program by “returning” into other bits of the program or its libraries.
  - waynecochran 6y ago
    If you're exploit using existing code (which would be limited), but if you want to inject code you typically need to put on the stack. Maybe one could inject code into the .bss/.data section, but this is probably protected from execution as well. The .text section is probably read only.
  - guerrilla 6y ago
    https://en.wikipedia.org/wiki/Return-oriented_programming https://en.wikipedia.org/wiki/Return-oriented_programming I wonder if anyone's ever automated it.
    - saagarjha 6y ago
      Fully automating ROP is difficult, but people have written many scripts to find interesting "gadgets" that set various registers and also found useful "targets" to ROP to, such as a handful of instructions inside of most libc's system command that can yield a shell if jumped to with light constraints.
  - e12e 6y ago
    > you can write a program by “returning” into other bits of the program or its libraries. Phrack has you covered, eg: from 2001: The advanced return-into-lib(c) exploits: PaX case study by Nergal <nergal@owl.openwall.com> http://phrack.org/issues/58/4.html#article http://phrack.org/issues/58/4.html#article Think I actually looked at this and an (at the time) recent 0day for opensshd that was found and written up by a couple of Finnish students - as a motivational presentation for PaX and/or grsecurity while at university.
no-dr-onboard 6y ago
This has been required reading for all the pentesters at my org for the past 20 years.
- rixrax 6y ago
  Should propably be required reading for every programmer and especially for those that work with memory unsafe languages. With a side of modern mitigation techniques.[0] [0] https://en.m.wikipedia.org/wiki/Buffer_overflow https://en.m.wikipedia.org/wiki/Buffer_overflow (See buffer overflow protection)
  - e12e 6y ago
    A simple compare and contrast between C and zig/rust/D might be interesting - or even golang for that matter (the idea being that code could be reasonably similar, and yet somewhat idiomatic - and illustrate how the C code is exploitable, but the safe language version isn't - except when made to be).
- notsureaboutpg 6y ago
  This was required reading in my university's CS program.
- tptacek 6y ago
  Why? Exploitation of novel memory corruption vulnerabilities is pretty rare on penetration tests.
hyper_reality 6y ago
What a classic! Phrack stopped publishing some time ago but the world of security ploughs on, who can recommend similar modern resources to Phrack? Here's a few I'm aware of: https://www.alchemistowl.org/pocorgtfo/ https://www.alchemistowl.org/pocorgtfo/ https://secret.club/ https://secret.club/
- opticnerve 6y ago
  Paged Out - https://pagedout.institute/ https://pagedout.institute/ Rafale - https://www.rafale.org https://www.rafale.org
  - hyper_reality 6y ago
    Paged Out is great, Rafale appears to be offline though (and French only).
- TrueDuality 6y ago
  2600: https://www.2600.com/ https://www.2600.com/
- kdbg 6y ago
  While Phrack has stopped, there is the Paper Feed (no generic link, just have to link to the latest in the feed) http://phrack.org/papers/escaping_from_freebsd_bhyve.html http://phrack.org/papers/escaping_from_freebsd_bhyve.html I think one big change these days is just that more people will self-publish their writeups and research. There are also a lot more security conferences that people present at some with a more narrow focus than the well known conferences too leading to more specialty content. I do a weekly podcast[0] talking just about the latest exploits and strategies/research from the last week and pulling content for that is basically just following a ton of RSS feeds. There is a lot more getting written these days compared with the years when Phrack was regularly released. Unfortunately its also more spread out and harder to find. [0] https://dayzerosec.com https://dayzerosec.com
- muricula 6y ago
  Google Project Zero has an excellent blog: https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/
tekstar 6y ago
This article, and then working through the book "Hacking and the Art of Exploitation" taught me the true fundamentals of the C programming language, and Linux. The other key ingredient was working through the classic "digital evolution" wargames where you'd SSH into a box as level1 and work your way up from there.
- zith 6y ago
  Exactly the same experience as me. I got pretty deeply involved in the digital evolution community. Great way to spend my teenage years, and a great foundation to have while programming in any language. :)
- m00dy 6y ago
  Same here. It also inspired me for my master thesis which is ‘Using Bitcoin For Fun and Profit’.
  - jcpham2 6y ago
    Slashdot circa 2011 “bitcoin mining for fun and profit” Phrack is standard required reading
- tylerjwilk00 6y ago
  Your comment caused a forgotten memory to pop up to the surface. Did you by chance happen to participate in the Zebulun Cyber Army Challenge(s) [1]? Those games were very rewarding for a high schooler on the early internet. [1] https://www.ca-zeb.com/ https://www.ca-zeb.com/
  - tekstar 6y ago
    I remember CyberArmy, I think maybe that was where to find war games before dievo? I don't remember the Zebulon name though.
- bluedino 6y ago
  Another good book is 'Reversing: Secrets of Reverse Engineering' Books like that should be required reading when learning C. It shows you so much that the typical book won't cover.
jdblair 6y ago
Reading this article back in the day is how I learned how stack smashing works! I also remember when the EFF stopped hosting Phrack because most of their bandwidth was people downloading every issue off the EFF’s web server.
- deleted 6y ago
  [deleted]
- jdblair 6y ago
  Correction: it was hosted on an anonymous FTP server, not a web server. Also, I was one of those people who downloaded every issue, probably with ncftp.
eb0la 6y ago
This and the SYNflood attack are IMHO the best hacking papers I ever seen. This one ages extremely well.
NOGDP 6y ago
http://smashthestack.org/wargames.html http://smashthestack.org/wargames.html > The Smash the Stack Wargaming Network hosts several Wargames. A Wargame in our context can be described as an ethical hacking environment that supports the simulation of real world software vulnerability theories or concepts and allows for the legal execution of exploitation techniques. Software can be an Operating System, network protocol, or any userland application.
hegzploit 6y ago
I sometimes wish time would rewind so I can experience the hacking scene in it's full glory.
- waynecochran 6y ago
  The internet was open and fun back in the day. But evil people are why we can't have that anymore.
deleted 6y ago
[deleted]
alecco 6y ago
Gera's Insecure Programming tutorial on advanced Buffer Overflows was quite seminal. The site is gone but there's a GitHub repo now. https://github.com/gerasdf/InsecureProgramming https://github.com/gerasdf/InsecureProgramming
dang 6y ago
2009 had the main discussion: https://news.ycombinator.com/item?id=943185 https://news.ycombinator.com/item?id=943185 I thought there were others but maybe not? Single-comment threads from 2016, 2014, 2012, 2011: https://news.ycombinator.com/item?id=11007757 https://news.ycombinator.com/item?id=11007757 https://news.ycombinator.com/item?id=10821934 https://news.ycombinator.com/item?id=10821934 https://news.ycombinator.com/item?id=8773298 https://news.ycombinator.com/item?id=8773298 https://news.ycombinator.com/item?id=4903622 https://news.ycombinator.com/item?id=4903622 https://news.ycombinator.com/item?id=3061955 https://news.ycombinator.com/item?id=3061955
hushhush 6y ago
This paper also inspired the recent academic paper "Attacking Zcash Protocol For Fun And Profit" available at https://attackingzcash.com https://attackingzcash.com and on IACR: https://eprint.iacr.org/2020/627 https://eprint.iacr.org/2020/627 It describes new kinds of metadata leakage attacks that can be launched against privacy coins, by adversaries with large budgets, such as professional criminal organizations, blockchain analysis companies and nation states. The privacy coin HUSH has developed this defensive technology and was first to implement it in September 2019. There is a YouTube video where the author explains why he named the paper this way, this link has the timestamp where it's talked about: https://youtu.be/berM7Dnnoz4?t=405 https://youtu.be/berM7Dnnoz4?t=405 "This is a whole new research field I am creating, that is why I called it Attacking Zcash Protocol For Fun And Profit, just like Smashing The Stack for Fun And Profit, it created a whole new field" Also, for the hardcore HN nerds: The paper focuses on Zcash Protocol, but the ideas apply to any cryptocoin with a transaction graph, so Monero is definitely vulnerable. Much more vulnerable that Zcash Protocol.
- JoJoBinks 6y ago
  Interesting. So hush is the only privacy coin in your opinion?
  - hushhush 6y ago
    No, there are many privacy coins, but most are indeed just copies of Monero or Zcash. The author of that paper has discovered multiple CVE's in Zcash (https://www.cvedetails.com/cve/CVE-2019-16930/ https://www.cvedetails.com/cve/CVE-2019-16930/ and https://www.cvedetails.com/cve/CVE-2019-11636/ https://www.cvedetails.com/cve/CVE-2019-11636/ ). There are very few unique source codebases which implement privacy coins, maybe a half dozen depending on how lenient you are (i.e. is DASH a privacy coin? Barely, but it could be considered one. Blockchain analysis companies make fun of the "privacy" of DASH.) I believe when he says "inventing a whole new field" he means inventing a whole new field of attacks and defenses, just like the Phrack paper invented a whole new industry of attacks and then their defenses. Taking these new kinds of attacks into account, all existing privacy coins are vulnerable. Monero is more vulnerable than Zcash Protocol, since it does not have Zero Knowledge Math. It uses Group Theory, which leaks metadata like crazy.
jeffrom 6y ago
I learned so much from this article about how memory works when I was starting out, thanks phrack!
__abc 6y ago
Being totally immature here, but "Smashing the stack for fun and profit" would make a great book title for the Chaturbate memoir.
rel2thr 6y ago
Does someone know why weren't stack overflow exploits more common in the early 90s? If the Morris worm used them in 88, how did the technique get lost until this phrack article come out? Makes me wonder if there are still entire classes of exploits that are undiscovered out there.
- tptacek 6y ago
  This is a big question in vulnerability research! A previous thread: https://news.ycombinator.com/item?id=6656303 https://news.ycombinator.com/item?id=6656303 Since then, I've talked to some people I trust who say they were exploiting overflows prior to 1995 (by like a year or so), so it was in the air before then, but I haven't seen much evidence that anything like a full-fledged stack overflow had been exploited in the 5 years between '88 and '95. (Also: Neil Woods tweeted the 8lgm syslog shellcode, which was pretty rad: https://twitter.com/tqbf/status/1332579786682724354 https://twitter.com/tqbf/status/1332579786682724354).
mokha 6y ago
Elias is my hero.

181 points by keskadale 6y ago

maerF0x0 6y ago

I think the main thing to discuss here is how, 25 yrs later, we're still getting overflow bugs.

saagarjha 6y ago
It's a bit disappointing to still see overflows around, but at least blindly smashing the stack is no longer usually exploitable for modern systems with basic security.
0xbadcafebee 6y ago
I seem to recall there being some efforts to standardize "fixes" for C, and they never got adopted by anybody important, so the C development community kind of just failed hardcore to prevent it. IMHO it was never about the tools, it was about how we used them and the interfaces for common conventions. Actually, I take that back: it is also the tools' fault. GCC should just refuse to compile any reference to strcpy().

ctocoder 6y ago

how I loved trying this in the computer science lab when this 1st hit gopher.

__jf__ 6y ago

In 2017 I got a second hand Cisco ASA just to play with the shadowbrokers tools. EXTRABACON was the codename for the SNMP exploit using a buffer overflow. This was an interesting excercise because there were NO logs of this happening on the Cisco ASA, not even when ramping every loglevel to debug. Well only on the console port. Exception in readline() or something like it. Doing stuff for security monitoring in daily life this ehm was alarming, but not unexpected. Fixing “No logs” is often a challenge for blue teams. Anyway it was alarming enough to find and read through the Common Criteria EAL4+ certification docs for the Cisco ASA only to find that SNMP was excluded from certification scope. I still have the idea in the back of my head to explore scope exclusions in other certification docs for other unfortunate exclusions. Also the lack of mitigations like stack canaries, ASLR or others was quite surprising for a certified black box security device on the network perimeter.

jnwatson 6y ago
The assumptions about environment and the system-under-test has been the Achilles' heel in any certification I've been part of. It isn't like the CC folks aren't aware of the problem. The idea was that the Security Target (definition of the system) could declare conformance to a standardized Protection Profile which consumers could use as a shortcut to understanding what was promised. However, nobody looks at STs nor PPs except the vendor and the certifier, so all that work is for naught. You could absolutely get a CC cert with the environment that it is unplugged from a network.
- ralph84 6y ago
  Just like almost every FIPS 140 validated crypto module has a "FIPS mode" that is what was validated but is never actually used in production, even by government customers.
  - jnwatson 6y ago
    I'm unfortunately quite familiar with that. Beyond getting slower updates, etc, FIPS mode has the unintentional side effect of being the "look at me I have interesting stuff" flag for potential attackers. It is usually quite easy to determine remotely that a networked device is in FIPS mode, too (due to allowed crypto protocols, etc).
tptacek 6y ago
CCTL testing of commercial products at basically any level is a joke; you can just look at the list of certified commercial products and the subsequent vulnerability feeds for them. I'm unaware of anyone in the field that takes them seriously.

somesortofsystm 6y ago

A true classic that is just as relevant today as ever. Know thy stack! Yes, you still have a .text section!

f00zz 6y ago

A classic, but these days if you want to reproduce those bugs you need to build your code with -fno-stack-protector, enable executable stack, disable ASLR in the kernel, etc.

wizzwizz4 6y ago
Not really. If you can overwrite the return address, and you have some time to plan out your payload in advance, you can write a program by “returning” into other bits of the program or its libraries.
- waynecochran 6y ago
  If you're exploit using existing code (which would be limited), but if you want to inject code you typically need to put on the stack. Maybe one could inject code into the .bss/.data section, but this is probably protected from execution as well. The .text section is probably read only.
- guerrilla 6y ago
  https://en.wikipedia.org/wiki/Return-oriented_programming https://en.wikipedia.org/wiki/Return-oriented_programming I wonder if anyone's ever automated it.
  - saagarjha 6y ago
    Fully automating ROP is difficult, but people have written many scripts to find interesting "gadgets" that set various registers and also found useful "targets" to ROP to, such as a handful of instructions inside of most libc's system command that can yield a shell if jumped to with light constraints.
- e12e 6y ago
  > you can write a program by “returning” into other bits of the program or its libraries. Phrack has you covered, eg: from 2001: The advanced return-into-lib(c) exploits: PaX case study by Nergal <nergal@owl.openwall.com> http://phrack.org/issues/58/4.html#article http://phrack.org/issues/58/4.html#article Think I actually looked at this and an (at the time) recent 0day for opensshd that was found and written up by a couple of Finnish students - as a motivational presentation for PaX and/or grsecurity while at university.

no-dr-onboard 6y ago

This has been required reading for all the pentesters at my org for the past 20 years.

rixrax 6y ago
Should propably be required reading for every programmer and especially for those that work with memory unsafe languages. With a side of modern mitigation techniques.[0] [0] https://en.m.wikipedia.org/wiki/Buffer_overflow https://en.m.wikipedia.org/wiki/Buffer_overflow (See buffer overflow protection)
- e12e 6y ago
  A simple compare and contrast between C and zig/rust/D might be interesting - or even golang for that matter (the idea being that code could be reasonably similar, and yet somewhat idiomatic - and illustrate how the C code is exploitable, but the safe language version isn't - except when made to be).
notsureaboutpg 6y ago
This was required reading in my university's CS program.
tptacek 6y ago
Why? Exploitation of novel memory corruption vulnerabilities is pretty rare on penetration tests.

hyper_reality 6y ago

What a classic! Phrack stopped publishing some time ago but the world of security ploughs on, who can recommend similar modern resources to Phrack? Here's a few I'm aware of: https://www.alchemistowl.org/pocorgtfo/ https://www.alchemistowl.org/pocorgtfo/ https://secret.club/ https://secret.club/

opticnerve 6y ago
Paged Out - https://pagedout.institute/ https://pagedout.institute/ Rafale - https://www.rafale.org https://www.rafale.org
- hyper_reality 6y ago
  Paged Out is great, Rafale appears to be offline though (and French only).
TrueDuality 6y ago
2600: https://www.2600.com/ https://www.2600.com/
kdbg 6y ago
While Phrack has stopped, there is the Paper Feed (no generic link, just have to link to the latest in the feed) http://phrack.org/papers/escaping_from_freebsd_bhyve.html http://phrack.org/papers/escaping_from_freebsd_bhyve.html I think one big change these days is just that more people will self-publish their writeups and research. There are also a lot more security conferences that people present at some with a more narrow focus than the well known conferences too leading to more specialty content. I do a weekly podcast[0] talking just about the latest exploits and strategies/research from the last week and pulling content for that is basically just following a ton of RSS feeds. There is a lot more getting written these days compared with the years when Phrack was regularly released. Unfortunately its also more spread out and harder to find. [0] https://dayzerosec.com https://dayzerosec.com
muricula 6y ago
Google Project Zero has an excellent blog: https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/

tekstar 6y ago

This article, and then working through the book "Hacking and the Art of Exploitation" taught me the true fundamentals of the C programming language, and Linux. The other key ingredient was working through the classic "digital evolution" wargames where you'd SSH into a box as level1 and work your way up from there.

zith 6y ago
Exactly the same experience as me. I got pretty deeply involved in the digital evolution community. Great way to spend my teenage years, and a great foundation to have while programming in any language. :)
m00dy 6y ago
Same here. It also inspired me for my master thesis which is ‘Using Bitcoin For Fun and Profit’.
- jcpham2 6y ago
  Slashdot circa 2011 “bitcoin mining for fun and profit” Phrack is standard required reading
tylerjwilk00 6y ago
Your comment caused a forgotten memory to pop up to the surface. Did you by chance happen to participate in the Zebulun Cyber Army Challenge(s) [1]? Those games were very rewarding for a high schooler on the early internet. [1] https://www.ca-zeb.com/ https://www.ca-zeb.com/
- tekstar 6y ago
  I remember CyberArmy, I think maybe that was where to find war games before dievo? I don't remember the Zebulon name though.
bluedino 6y ago
Another good book is 'Reversing: Secrets of Reverse Engineering' Books like that should be required reading when learning C. It shows you so much that the typical book won't cover.

jdblair 6y ago

Reading this article back in the day is how I learned how stack smashing works! I also remember when the EFF stopped hosting Phrack because most of their bandwidth was people downloading every issue off the EFF’s web server.

deleted 6y ago
[deleted]
jdblair 6y ago
Correction: it was hosted on an anonymous FTP server, not a web server. Also, I was one of those people who downloaded every issue, probably with ncftp.

eb0la 6y ago

This and the SYNflood attack are IMHO the best hacking papers I ever seen. This one ages extremely well.

NOGDP 6y ago

http://smashthestack.org/wargames.html http://smashthestack.org/wargames.html > The Smash the Stack Wargaming Network hosts several Wargames. A Wargame in our context can be described as an ethical hacking environment that supports the simulation of real world software vulnerability theories or concepts and allows for the legal execution of exploitation techniques. Software can be an Operating System, network protocol, or any userland application.

hegzploit 6y ago

I sometimes wish time would rewind so I can experience the hacking scene in it's full glory.

waynecochran 6y ago
The internet was open and fun back in the day. But evil people are why we can't have that anymore.

deleted 6y ago

[deleted]

alecco 6y ago

Gera's Insecure Programming tutorial on advanced Buffer Overflows was quite seminal. The site is gone but there's a GitHub repo now. https://github.com/gerasdf/InsecureProgramming https://github.com/gerasdf/InsecureProgramming

dang 6y ago

2009 had the main discussion: https://news.ycombinator.com/item?id=943185 https://news.ycombinator.com/item?id=943185 I thought there were others but maybe not? Single-comment threads from 2016, 2014, 2012, 2011: https://news.ycombinator.com/item?id=11007757 https://news.ycombinator.com/item?id=11007757 https://news.ycombinator.com/item?id=10821934 https://news.ycombinator.com/item?id=10821934 https://news.ycombinator.com/item?id=8773298 https://news.ycombinator.com/item?id=8773298 https://news.ycombinator.com/item?id=4903622 https://news.ycombinator.com/item?id=4903622 https://news.ycombinator.com/item?id=3061955 https://news.ycombinator.com/item?id=3061955

hushhush 6y ago

This paper also inspired the recent academic paper "Attacking Zcash Protocol For Fun And Profit" available at https://attackingzcash.com https://attackingzcash.com and on IACR: https://eprint.iacr.org/2020/627 https://eprint.iacr.org/2020/627 It describes new kinds of metadata leakage attacks that can be launched against privacy coins, by adversaries with large budgets, such as professional criminal organizations, blockchain analysis companies and nation states. The privacy coin HUSH has developed this defensive technology and was first to implement it in September 2019. There is a YouTube video where the author explains why he named the paper this way, this link has the timestamp where it's talked about: https://youtu.be/berM7Dnnoz4?t=405 https://youtu.be/berM7Dnnoz4?t=405 "This is a whole new research field I am creating, that is why I called it Attacking Zcash Protocol For Fun And Profit, just like Smashing The Stack for Fun And Profit, it created a whole new field" Also, for the hardcore HN nerds: The paper focuses on Zcash Protocol, but the ideas apply to any cryptocoin with a transaction graph, so Monero is definitely vulnerable. Much more vulnerable that Zcash Protocol.

JoJoBinks 6y ago
Interesting. So hush is the only privacy coin in your opinion?
- hushhush 6y ago
  No, there are many privacy coins, but most are indeed just copies of Monero or Zcash. The author of that paper has discovered multiple CVE's in Zcash (https://www.cvedetails.com/cve/CVE-2019-16930/ https://www.cvedetails.com/cve/CVE-2019-16930/ and https://www.cvedetails.com/cve/CVE-2019-11636/ https://www.cvedetails.com/cve/CVE-2019-11636/ ). There are very few unique source codebases which implement privacy coins, maybe a half dozen depending on how lenient you are (i.e. is DASH a privacy coin? Barely, but it could be considered one. Blockchain analysis companies make fun of the "privacy" of DASH.) I believe when he says "inventing a whole new field" he means inventing a whole new field of attacks and defenses, just like the Phrack paper invented a whole new industry of attacks and then their defenses. Taking these new kinds of attacks into account, all existing privacy coins are vulnerable. Monero is more vulnerable than Zcash Protocol, since it does not have Zero Knowledge Math. It uses Group Theory, which leaks metadata like crazy.

jeffrom 6y ago

I learned so much from this article about how memory works when I was starting out, thanks phrack!

__abc 6y ago

Being totally immature here, but "Smashing the stack for fun and profit" would make a great book title for the Chaturbate memoir.

rel2thr 6y ago

Does someone know why weren't stack overflow exploits more common in the early 90s? If the Morris worm used them in 88, how did the technique get lost until this phrack article come out? Makes me wonder if there are still entire classes of exploits that are undiscovered out there.

tptacek 6y ago
This is a big question in vulnerability research! A previous thread: https://news.ycombinator.com/item?id=6656303 https://news.ycombinator.com/item?id=6656303 Since then, I've talked to some people I trust who say they were exploiting overflows prior to 1995 (by like a year or so), so it was in the air before then, but I haven't seen much evidence that anything like a full-fledged stack overflow had been exploited in the 5 years between '88 and '95. (Also: Neil Woods tweeted the 8lgm syslog shellcode, which was pretty rad: https://twitter.com/tqbf/status/1332579786682724354 https://twitter.com/tqbf/status/1332579786682724354).

mokha 6y ago

Elias is my hero.