Abstract

Buffer under runs are the attacks that are less known in the security community as compared to the buffer overflows. There are many approaches which exploit buffers in executables which are written in languages such as ‘C’ where bound checking is not done. At the same time, many ways have been discovered to prevent buffers from being exploited. One such way is ‘Cookies’, which prevents executables from buffer overflows up to some extent. This paper sheds light on an exploitation technique which bypasses Cookie prevention of buffer overflows. The technique is called as buffer under run, and is less known among the security community, because of the less number of issues found for the same. The purpose of this talk will be to show that such vulnerabilities do exist and the actual exploitation of such vulnerability.

We will be discussing about the following in our talk:

1. How executables are exploited using buffer under run.

2. Demo of the exploit and bad coding practices leading to the same.

3. How to prevent these kind of attacks.