CS 231: Computer Security

Buffer overflow attacks

Lab exercise. Nothing to hand in.

Note that people who have taken CS208 and/or CS251 are likely to find this exercise easier than people who have not. Either way, write down questions about things don't understand so we can follow up later.

1. Open a terminal and ssh to your account on spectra.mathcs.carleton.edu
2. Go through the steps described in this buffer overflow tutorial. I was able to get his exploit to work on spectra this morning (and in fact, for me, the specific numbers the tutorial author was using were identical to the numbers I saw on spectra, so it was really easy to make the bad thing happen in his example).
3. Can you make the same thing happen on a Mac instead of on spectra (which runs Linux)?

Want to know more about the history and variety of buffer overflow attacks?

• The Wikipedia article on buffer overflow
• A classic how-to: Smashing the Stack for Fun and Profit, by Aleph One
• The Wikipedia article on the Morris Worm, a famous example of the use of buffer overflow attacks (among other things).