Conclusion

Although buffer overflows have been discussed widely, and published technical work exists for many platforms, much remains to be said about buffer overflows. This chapter introduces a number of techniques that are useful in exploiting software. Overall, we find that corrupting

•	Table of Contents
memory remains the single most powerful technique for the attacker. Perhaps stack
•	Index

overflows will vanish someday when programmers quit using the (seriously broken) libc

Exploitingstring callsSoftware. This willHowbyto Breakno meansCode completely solve the problem, however.

ByGreg Hoglund,Gary McGraw

Other common but trickier methods for memory corruption have been discussed here, such

as the off-by-one and heap overflows. As a discipline, computer science has had more than

Publisher: Addison Wesley

20 years to get memory handling right, yet code is still vulnerable to these simple problems.

Pub Date: February 17, 2004

In fact, it is very likely that programmers will be getting these kinds of things wrong for the

ISBN: 0-201-78695-8

next 20 years.

Pages: 512

Every day brings the potential of discovering a new and previously unanticipated technique for exploiting memory. For the rest of our lives we are likely to see embedded systems fall prey to these same problems you just learned about here. We predict that the core of any offensive IW platform will be based on memory exploits like the ones in this chapter.

How does software break? How do attackers make software break on purpose? Why are firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What tools can be used to break software? This book provides the answers.

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and techniques used by bad guys to break software. If you want to protect your software from attack, you must first learn how real attacks are really carried out.

This must-have book may shock you—and it will certainly educate you.Getting beyond the script kiddie treatment found in many hacking books, you will learn about

Why software exploit will continue to be a serious problem