5 ms·
I like how they spin it in Robert Morris profile on the YC page: "In 1988 his discovery of buffer overflow first brought the Internet to the attention of the ge
by azov 13y ago
I like how they spin it in Robert Morris profile on the YC page: "In 1988 his discovery of buffer overflow first brought the Internet to the attention of the general public." (http://ycombinator.com/people.html http://ycombinator.com/people.html)
- tptacek 13y agoHijacking the thread a little: one of the weird timeline things I'm a little obsessed with is the gap between the Morris Worm and the first "modern" stack overflow. As near as I can tell, Thomas Lopatic kicked off the era of modern memory corruption exploits in February 1995 with his HPUX NCSA httpd overflow. That was followed shortly by 8lgm's Sendmail 8.6.12 syslog() stack overflow, which 8lgm created a small mania about by explaining roughly how the bug worked but not publishing the exploit, which meant every amateur vulnerability researcher at the time (myself included) spent a couple weeks figuring it out for ourselves. 1988 to 1995 is a long time! During that period, near as I can tell, nobody published or even referenced a modern memory corruption flaw ("modern" meaning "allowed you to upload code into a remote system"; there were overflows prior to 1995, but they worked by overwriting variables in memory to alter program logic). Why did Morris have this technique back in 1988? (Besides the obvious reason). Why did nobody extend the work between '88 and '95? The whole Internet was vulnerable to this bug! And that timeframe was the hacker renaissance; it corresponds to the Sun Devil raids and the LoD/MoD war.
- makerops 13y agoI have read about LoD/MoD, 8lGm etc..it seemed that low hanging fruit was probably the reasoning right? I mean, there were probably so many systems you could access through stupid bugs, that delving deep into SO wasn't necessary?
- tptacek 13y agoMaybe. But there was low-hanging fruit well into the late '90s (and remember that SQL Injection, the "ultimate" low-hanging fruit, is also a late '90s bug) --- but after the 8lgm stack overflow mania, there was a decisive shift towards using memory corruption to take over machines directly, rather than (say) overwriting strategic files on target systems with NFS bugs.
- makerops 13y agoVery True. Smashing the stack for fun and profit? That was the first interaction I had with more advanced techniques anyways. I read it as a soph/freshman in HS (97 or so I think)? Timing seems to be close. That could account for the explosion at least; I don't have any theories on the "dead" period.
- tptacek 13y agoI'm happy to give Elias credit for a big part of the shift, but the reality is that first x86 exploit was published well before that Phrack article, and people quickly repurposed it. (I'm a little biased here, since the author of that exploit is a partner of mine). The vulnerability research community in 1995 was very close-knit (not tiny, but you could fit them in a hotel banquet hall for Summercon), and they worked pretty quickly to educate each other about the attack.
- hect0r 13y agoInteresting. Who published it prior to Aleph One?
- Zenst 13y agoI'm sure the whole pirating of games during the C64 days would have touched upon memory corruption, so whilst not in the context we think of today it is certainly older area than we think.
- meowface 13y agoI think it would be really cool if someone (perhaps you) interviewed Morris about his initial development of the worm and its exploit.
- lawnchair_larry 13y agoSince nobody else is going to, I'll take the letters N, S, and I'd like to buy a vowel.