Thread by @mattblaze

If you’re a computer scientist and you’ve not read this seminal work, you owe it to yourself to do so. (Un)fortunately, it’s become hard to find platforms on which the attack can be reproduced in the form described, but it’s a transformative experience when you do.

https://twitter.com/aleph_one/status/1457733413155131399

Mastery of the buffer overflow attack - not just understanding it conceptually, but actually being able to execute it - is like developing a terrible superpower. You start to understand the problem of security in an entirely different way. @aleph_one’s paper made that accessible.

Anyway, @aleph_one’s paper, and an exercise based on it, is assignment #1 in every security course I teach.

@aleph_one Ah, I neglected to include a link: phrack.org/issues/49/14.h…

Also, the timeline is notable. The Morris Worm (the first large scale buffer overflow exploit) was 1988. Smashing the Stack was 1996 and was directly usable. And here in 2021, most major OSs now ship with mitigations, but vulnerable C code is still alive and well.

Buffer overflows have had an amazingly and depressingly long tail. We knew about them well before 1988, and they can still be used to exploit real systems.

Compare this with, say, our response to Y2K. That problem was identified, there was a large but manageable and orderly effort to examine systems and eradicate it, and by 2000, it was no longer a threat. All the while, buffer overflows remained unpatched and exploited.

Part of it likely had to do with the fact that Y2K was very easy to explain, even to nonprogrammers. But you can’t really internalize the reality that buffer overflows are more than a hypothetical threat until you implement one. That’s why @aleph_one’s paper was important.

(Y2K, for you young folks, was the “Year 2000 Problem”. Many programs built in the 20th century used a two character data structure to represent years, which would be fine if the world were going to end in 1999. But if you need to compare dates from different centuries, yikes).

Y2K was a consequence of unfortunate timing in computer history coupled by with a lack of imagination. Computers were invented mid century. Two digit years were unambiguous for the recent past and immediate future for most purposes. And no one thought software lasted decades.