4 ms·

Snippets from Zatko’s Wikipedia page: > Mudge was responsible for early research into a type of security vulnerability known as the buffer overflow. In 1995 he

Snippets from Zatko’s Wikipedia page: > Mudge was responsible for early research into a type of security vulnerability known as the buffer overflow. In 1995 he published "How to Write Buffer Overflows", one of the first papers on the topic. > He was one of the seven L0pht members who testified before a Senate committee in 1998 about the serious vulnerabilities of the Internet at that time. And they say he wasn’t doing a good enough job at a company whose only job is to pass some text back and forth lol. Didn’t the breach happen because some slack channel inside Twitter had the password pinned to the top? https://en.m.wikipedia.org/wiki/Peiter_Zatko https://en.m.wikipedia.org/wiki/Peiter_Zatko

fmajid 4y ago
Er, the (in)famous Robert Tappan Morris worm of 1988 used a buffer overflow. Zatko may be a renowned security expert but he didn't invent the buffer overflow. I'm inclined to believe everything he says about Twitter from my experience implementing Twitter APIs then constantly working around their incessant random breakage.
- stonogo 4y ago
  Nobody claimed he invented the buffer overflow. The claim is that he was one of the first researchers to investigate them. That claim is justified.
  - tptacek 4y ago
    Literally every "researcher" in 1995 was working on this problem. I was in the room with Mudge at Pumpcon while he was doing the research work for this, with like a dozen other people. All of them were I believe primarily motivated by 8lgm --- that's why Mudge's post uses a contrived syslog(3) example instead of a real bug, because the 8lgm Sendmail exploit was an overflow in syslog(3). It's fine, it's a solid post, it's an early post. But Lopatic and 8lgm set this in motion, and the actual blueprint for this attack was probably splitvt.
    - bink 4y ago
      Having also been at Pumpcon 95 I'm a little surprised that any work got done there at all.
- homarp 4y ago
  https://en.wikipedia.org/wiki/Buffer_overflow#History https://en.wikipedia.org/wiki/Buffer_overflow#History confirms The earliest documented hostile exploitation of a buffer overflow was in 1988. It was one of several exploits used by the Morris worm to propagate itself over the Internet. The program exploited was a service on Unix called finger. (source code here https://0x00sec.org/t/examining-the-morris-worm-source-code-malware-series-0x02/685 https://0x00sec.org/t/examining-the-morris-worm-source-code-... ) Later, in 1995, Thomas Lopatic independently rediscovered the buffer overflow and published his findings on the Bugtraq security mailing list. A year later, in 1996, Elias Levy (also known as Aleph One) published in Phrack magazine the paper "Smashing the Stack for Fun and Profit", a step-by-step introduction to exploiting stack-based buffer overflow vulnerabilities. And here is "How to write buffer overflow" by Mudge (10/20/95) : https://insecure.org/stf/mudge_buffer_overflow_tutorial.html https://insecure.org/stf/mudge_buffer_overflow_tutorial.html
  - e12e 4y ago
    Thanks for linking to Mudge's article - and for providing a time-line. For completeness - Smashing the stack for fun and profit: http://phrack.org/issues/49/14.html#article http://phrack.org/issues/49/14.html#article And in the same issue: a profile on Mudge!: http://phrack.org/issues/49/4.html#article http://phrack.org/issues/49/4.html#article > We discussed for a long time who in the hacking world today best exemplifies everything that is right with hacking today, and we came up with a unanimous conclusion that it was Mudge. And so we were quite happy that our first choice for the first pro-phile that we have done accepted our invitation. He cracked your Apple warez when you couldn't, he wrote buffer overflows before they were cool, he owned your Sendmail (and probably still does), and he still manages to give more back to the community than anyone else around.
    - e12e 4y ago
      Heh: > Past handles: Many old Apple ][ crackers remember me by a different handle. That handle is long put to rest thanks to the government. And just the other day I learned that Steve Wozniak got kicked out of UC Boulder, Colorado for hacking their mainframe. Tried to figure out what it was named - but sadly couldn't find the name. Thought it'd make a good name for my new laptop.
tptacek 4y ago
The first public modern overflow exploit, following the Morris Worm itself, was Thomas Lopatic's 1995 HP-UX httpd exploit. It was followed shortly thereafter by 8lgm teasing a syslog stack overflow in Sendmail 8.6.12. New Sendmail vulnerabilities were the gold standard of the underground at the time, and 8lgm set off a race to work out how to reliably exploit overflows. I posted about this on Twitter a year or two ago, and Neil Woods showed up and posted the exploit, which is a highlight for me. https://twitter.com/MrNeilWoods/status/1332579039832367106 https://twitter.com/MrNeilWoods/status/1332579039832367106 The first blueprint for a stack overflow exploit on a widely-available architecture --- really, the first how-to of how to implement a stack overflow for ordinary security researchers --- was probably vicm and daveg's Linux splitvt exploit. To my lights, if we're spreading credit for overflows around, primary credit goes to Lopatic, and then to vicm and daveg, whose exploit was cut-and-pasted a bunch of times for the 1996 userland bloodbath. The most important document of these attacks was Aleph One's "Smashing The Stack For Fun And Profit", which is the one that's taught in college courses.
- 1letterunixname 4y ago
  The original ping of death, Code Red/Nmida, and Blaster/Welchia were particularly sporting times to be in help desk for a university profit-center.

fmajid 4y ago

Er, the (in)famous Robert Tappan Morris worm of 1988 used a buffer overflow. Zatko may be a renowned security expert but he didn't invent the buffer overflow. I'm inclined to believe everything he says about Twitter from my experience implementing Twitter APIs then constantly working around their incessant random breakage.

stonogo 4y ago
Nobody claimed he invented the buffer overflow. The claim is that he was one of the first researchers to investigate them. That claim is justified.
- tptacek 4y ago
  Literally every "researcher" in 1995 was working on this problem. I was in the room with Mudge at Pumpcon while he was doing the research work for this, with like a dozen other people. All of them were I believe primarily motivated by 8lgm --- that's why Mudge's post uses a contrived syslog(3) example instead of a real bug, because the 8lgm Sendmail exploit was an overflow in syslog(3). It's fine, it's a solid post, it's an early post. But Lopatic and 8lgm set this in motion, and the actual blueprint for this attack was probably splitvt.
  - bink 4y ago
    Having also been at Pumpcon 95 I'm a little surprised that any work got done there at all.
homarp 4y ago
https://en.wikipedia.org/wiki/Buffer_overflow#History https://en.wikipedia.org/wiki/Buffer_overflow#History confirms The earliest documented hostile exploitation of a buffer overflow was in 1988. It was one of several exploits used by the Morris worm to propagate itself over the Internet. The program exploited was a service on Unix called finger. (source code here https://0x00sec.org/t/examining-the-morris-worm-source-code-malware-series-0x02/685 https://0x00sec.org/t/examining-the-morris-worm-source-code-... ) Later, in 1995, Thomas Lopatic independently rediscovered the buffer overflow and published his findings on the Bugtraq security mailing list. A year later, in 1996, Elias Levy (also known as Aleph One) published in Phrack magazine the paper "Smashing the Stack for Fun and Profit", a step-by-step introduction to exploiting stack-based buffer overflow vulnerabilities. And here is "How to write buffer overflow" by Mudge (10/20/95) : https://insecure.org/stf/mudge_buffer_overflow_tutorial.html https://insecure.org/stf/mudge_buffer_overflow_tutorial.html
- e12e 4y ago
  Thanks for linking to Mudge's article - and for providing a time-line. For completeness - Smashing the stack for fun and profit: http://phrack.org/issues/49/14.html#article http://phrack.org/issues/49/14.html#article And in the same issue: a profile on Mudge!: http://phrack.org/issues/49/4.html#article http://phrack.org/issues/49/4.html#article > We discussed for a long time who in the hacking world today best exemplifies everything that is right with hacking today, and we came up with a unanimous conclusion that it was Mudge. And so we were quite happy that our first choice for the first pro-phile that we have done accepted our invitation. He cracked your Apple warez when you couldn't, he wrote buffer overflows before they were cool, he owned your Sendmail (and probably still does), and he still manages to give more back to the community than anyone else around.
  - e12e 4y ago
    Heh: > Past handles: Many old Apple ][ crackers remember me by a different handle. That handle is long put to rest thanks to the government. And just the other day I learned that Steve Wozniak got kicked out of UC Boulder, Colorado for hacking their mainframe. Tried to figure out what it was named - but sadly couldn't find the name. Thought it'd make a good name for my new laptop.

tptacek 4y ago

The first public modern overflow exploit, following the Morris Worm itself, was Thomas Lopatic's 1995 HP-UX httpd exploit. It was followed shortly thereafter by 8lgm teasing a syslog stack overflow in Sendmail 8.6.12. New Sendmail vulnerabilities were the gold standard of the underground at the time, and 8lgm set off a race to work out how to reliably exploit overflows. I posted about this on Twitter a year or two ago, and Neil Woods showed up and posted the exploit, which is a highlight for me. https://twitter.com/MrNeilWoods/status/1332579039832367106 https://twitter.com/MrNeilWoods/status/1332579039832367106 The first blueprint for a stack overflow exploit on a widely-available architecture --- really, the first how-to of how to implement a stack overflow for ordinary security researchers --- was probably vicm and daveg's Linux splitvt exploit. To my lights, if we're spreading credit for overflows around, primary credit goes to Lopatic, and then to vicm and daveg, whose exploit was cut-and-pasted a bunch of times for the 1996 userland bloodbath. The most important document of these attacks was Aleph One's "Smashing The Stack For Fun And Profit", which is the one that's taught in college courses.

1letterunixname 4y ago
The original ping of death, Code Red/Nmida, and Blaster/Welchia were particularly sporting times to be in help desk for a university profit-center.