Question

Dr. Blahbah has implemented a system with an 8-bit random canary that is used to detect and prevent stack-based buffer overflow attacks. Describe an effective attack against. Dr. Blahbah's system and analyze its likelihood of success.

Answer 1

It is easy to break the security provided by the canary value once one is armed with the address and size.

Step-by-step explanation

We know Dr. Blahblah uses the random 8-bit canary value to detect and prevent stack-based buffer overflow attacks. He generates the 8-bit canary value randomly and inserts it before the return address.

However, an attacker can write a malicious code to access the address space of target function block if the attacker knows the address, size and purpose of the function block on the stack. With this knowledge, the attacker can obtain the address of the canary and the return statement which enables the attacker to overwrite the function code and return the address by leaving te address of the canary value.

So whenever the system checks for integrity of the canary value it remains unchanged meanwhile the overflow attack definitely happens.