equal
deleted
inserted
replaced
37 \begin{axis}[ |
37 \begin{axis}[ |
38 xlabel={year}, |
38 xlabel={year}, |
39 ylabel={\% of total attacks}, |
39 ylabel={\% of total attacks}, |
40 ylabel style={yshift=-1em}, |
40 ylabel style={yshift=-1em}, |
41 enlargelimits=false, |
41 enlargelimits=false, |
42 xtick={1997,1999,2001,...,2015}, |
42 xtick={1997,2000,2002,...,2016}, |
43 xmin=1996.5, |
43 xmin=1996.5, |
44 xmax=2016, |
44 xmax=2017, |
45 ymax=21, |
45 ymax=21, |
46 ytick={0,5,...,20}, |
46 ytick={0,5,...,20}, |
47 scaled ticks=false, |
47 scaled ticks=false, |
48 axis lines=left, |
48 axis lines=left, |
49 width=12cm, |
49 width=12cm, |
402 starts at address \pcode{0x0804852c} (top address in the |
402 starts at address \pcode{0x0804852c} (top address in the |
403 left column). |
403 left column). |
404 |
404 |
405 \begin{figure}[p] |
405 \begin{figure}[p] |
406 \lstinputlisting[language=C]{../progs/C2.c} |
406 \lstinputlisting[language=C]{../progs/C2.c} |
407 \caption{A vulnerable login implementation. The use of the |
407 \caption{A vulnerable login implementation. The use of the `own' |
408 `own' \pcode{get\_line} function makes this program |
408 \code{get\_line} function makes this program vulnerable. The |
409 vulnerable. The developer should have used \emph{safe} |
409 developer should have used \emph{safe} library functions |
410 library functions instead.\label{C2}} |
410 instead.\label{C2}} |
411 \end{figure} |
411 \end{figure} |
412 |
412 |
413 This kind of attack was very popular with commercial programs |
413 This kind of attack was very popular with commercial programs |
414 that needed a key to be unlocked. Historically, hackers first |
414 that needed a key to be unlocked. Historically, hackers first |
415 broke the rather weak encryption of these locking mechanisms. |
415 broke the rather weak encryption of these locking mechanisms. |
564 pointer given at the end). |
564 pointer given at the end). |
565 |
565 |
566 \begin{figure}[p] |
566 \begin{figure}[p] |
567 \lstinputlisting[language=C]{../progs/C3.c} |
567 \lstinputlisting[language=C]{../progs/C3.c} |
568 \caption{Overwriting a buffer with a string containing a |
568 \caption{Overwriting a buffer with a string containing a |
569 payload. Lines 14 and 15 write the address of the buffer |
569 payload. Lines 14 and 15 write the address of the buffer into |
570 into \pcode{large\_string}. The payload is copied in |
570 \code{large\_string}. The payload is copied in Lines 17 and 18. Line |
571 Lines 17 and 18. Line 20 copies the (too large) string |
571 20 copies the (too large) string into the buffer.\label{C3}} |
572 into the buffer.\label{C3}} |
|
573 \end{figure} |
572 \end{figure} |
574 |
573 |
575 By the way you might naw have the question how do attackers |
574 By the way you might naw have the question how do attackers |
576 find out about vulnerable systems in the first place? Well, |
575 find out about vulnerable systems in the first place? Well, |
577 the automated version uses \emph{fuzzers}, which throw |
576 the automated version uses \emph{fuzzers}, which throw |