up vote 1 down vote favorite
share [g+] share [fb]

By default, when applications run, they are limited in the amount of RAM they are allowed to access right? Technically my VLC could not access memory addresses used by Chrome. But how is it possible for the operating system/compiler to mistakingly allow access to an address a code is not allowed. I know alot of 'exploits' and 'payloads' take advantage of this fact and create variables that take up too much space and 'overflow' into other addresses, but how does this actually happen?

Are some programs more prone to this than others? Does it matter in which language they are coded in? For example, I know C is allowed to play around with memory, while Java is not.

Also, what are the advantages of this? What if someone wrote malicious code to access someplace in memory, what could they do? The only thing I can think of is passwords/keys stored in RAM.

PS I thought about putting this in Stack Overflow, but my question is much broader than just specifically related to a programming perspective. If I've placed it in the wrong place, I'm sorry.

link|improve this question
96% accept rate
its not a 'proper' answer but you should probably read 'hacking - the art of exploitation' for a good academic explanation of the process – Journeyman Geek Apr 11 '11 at 0:24
Thanks I'll look into that. – MaxMackie Apr 11 '11 at 0:25
feedback

2 Answers

up vote 1 down vote accepted

oddly enough it does involve an overflow - a stack overflow - using a carefully crafted process to use up space beyond what it should, in order to change the behaviour of a target prpgramme, or to crash it

link|improve this answer
Very cool, lots of good stuff on wikipedia from the link you gave me. I now see how data can be changed, but how does this ever allow for big bad things to happen (not like a crash, like remote logins and chances for malicious code to be executed). I think I remember seeing a talk on how the PS3 was hacked, and they used overflows to execute some of their code. How does that work exactly? I have a feeling that a big question to answer :) – MaxMackie Apr 11 '11 at 0:40
That's what the book i suggested is about. The full answer goes far beyond the scope of what i know, and can answer. A simple example from hacking the art of exploitation would be to spawn a root shell from a process running as root, allowing you to potentially do whatever you want from there – Journeyman Geek Apr 11 '11 at 0:51
Alright I'll have to read it then. I knew that most of the time the goal of a hacker (I hate using this term to designate a malicious person, hackers are friendly) is to open a root shell. Thanks for your help. – MaxMackie Apr 11 '11 at 0:55
feedback
up vote 1 down vote

A specific point: the “overflows” usually of interest do not allow one application (process) to overwrite another; rather they are just the data the process is processing causing the program to overwrite parts of itself (usually the stack, possibly indirectly) with that data, which then allows takeover of that process.

Then that process can interact by normal IPC and system calls to take over anything else your account has access to. VLC cannot access Chrome's memory space with an ordinary address, but it can:

  • Pretend to be a debugger, attach to the Chrome process, and modify it.
  • Rewrite any of your files and account settings so that its code gets run in the future every time you log in.
  • Open network connections and spread itself to other machines.

With occasional exceptions, modern operating systems, unfortunately, assume that you fully trust every program you run with everything in your account. This is an assumption that hasn't been true since the days of non-networked time-sharing systems used solely by experts (where the OS-provided protections protected the users from each other, not from their own software).

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.