Thursday, February 5, 2009

Writing Security Tools And Exploits

Image

Exploits.In most information technology circles these days,the term exploits has become synonymous with vulnerabilities or in some cases,buffer overflows.It is not only a scary word that can keep you up at night wondering if you purchased the best firewalls,configured your new host-based intrusion prevention system correctly,and have patched your entire environment,but can enter the security water-cooler discussions faster than McAfee’s new wicked anti-virus software or Symantec’s latest acquisition.

Exploits are proof that the computer science,or software programming,community still does not have an understanding (or,more importantly,firm knowledge) of how to design,create,and implement secure code.

Like it or not,all exploits are a product of poorly constructed software programs and talented software hackers – and not the good type of hackers that trick out an application with interesting configurations.These programs may have multiple deficiencies such as stack overflows,heap corruption,format string bugs,and race conditions—the first three commonly being referred to as simply buffer overflows.Buffer overflows can be as small as one misplaced character in a million-line program or as complex as multiple character arrays that are inappropriately handled.

Building on the idea that hackers will tackle the link with the least amount of resistance,it is not unheard of to think that the most popular sets of software will garner the most identified vulnerabilities.While there is a chance that the popular software is indeed the most buggy,another angle would be to state that the most popular software has more prying eyes on it.

http://online-upload.info/files/writ_sec_tool_and_expl1.rar.html


No comments: