what ever happened to buffer overflows?

Keep on learning with Brilliant at brilliant.org/LowLevelLearning. Get started for free, and hurry - the first 200 people get 20% off an annual premium subscription with my URL! Thanks again Brilliant for sponsoring this video!
You may have heard the term, buffer overflow, but you may never have heard of the little bird protecting you from this evil attack. These hero's of the night are "stack canaries", and, whether you realize it or not, they've been hiding in your code for years.
In this video, we discuss what stack canaries are, what they look like, and how they protect your code from attack.
🏫 COURSES 🏫
www.udemy.com/course/c-progra...
🔥🔥🔥 SOCIALS 🔥🔥🔥
Low Level Merch!: lowlevel.store/
Follow me on Twitter: / lowleveltweets
Follow me on Twitch: / lowlevellearning
Join me on Discord!: / discord

[@LowLevelLearning]

GO TRY OUT BRILLIANT GOGOGOGOGOGOGO brilliant.org/LowLevelLearning

[@umikaliprivate]

I know, go is a great language

[@Stopinvadingmyhardware]

where are you pimping your merch at?

[@kayakMike1000]

@@Stopinvadingmyhardware I second that.

[@grantonthenet]

really just hit me with the ad spot flashbang

[@TheSkyline77]

Fun fact! The "canary in the coal mine" didn't actually die. That bottle on the top of the cage? That's so that if the bird passes out, the miner can fill the cage with oxygen and the bird recovers

[@Isaacrl67]

Only after the invention of the Canary Resuscitator, but even after that they often just had tiny little square cages that did not have resuscitators on them. Mostly they were used after a mine explosion by the rescue team trying to save miners. If the canary showed signs of distress, they would pull the rescue team and the canary out, so it didn't usually die at least.

[@sootikins]

@@Isaacrl67 But the question on everyone's mind is: which is better, a dead canary or a canary with hypoxia induced brain damage??

[@serzaknightcore5208]

@@sootikins Well, if it can still detect carbon monoxyde...

[@JustPyroYT]

I don't have birds in my code. Only bugs...

[@LowLevelLearning]

PORQUE NO LOS DOS

[@alexevier]

porque se come los bugs :(

[@stavros222]

You know, canary eats bugs

[@alexzaslavskis4623]

be aware bugs attract birds

[@stapler942]

This thread reminds me of the incident where one of Mao's five-year plans involved eliminating Eurasian tree sparrows, which resulted in a huge increase in locusts. The lesson being, keep some of those birds around, you might need them to fight the bugs.

[@PhoenixBird9000]

Birds and programming absolutely mix. I am a bird. I program. Your videos are awesome. Please keep it up! Also, respect the canaries. Both kinds.

[@IngwiePhoenix]

Chirp! =)

[@PhoenixBird9000]

@@IngwiePhoenix Chirp chirp! :D

[@snarkyerica]

CHIIIIRP

[@CodingSunset]

🐥🔫

[@PhoenixBird9000]

@@CodingSunset Not sure what you mean there.

[@atdit]

RIP stack canary. He died for our sins. 😔

[@roygalaasen]

In the late 80’s/early 90’s I had a computer with a small executable file running at the end of the autoexec file. All it did was saying “The canary bird is alive and all is well.” Until one day it said: “The canary bird is dead.” It was an exe file that checked an internal checksum, and if it was changed, the canary was dead, and you knew that you had been infected by a computer virus.

[@davidtalysson4175]

Brilliant ! how it works ?

[@jvmgang]

​@@davidtalysson4175 my friend have you read the comment

[@KingBowserLP]

@@davidtalysson4175 a lot of viruses infected a computer by inserting themselves into executable files as they're run. Changing a file changes its checksum so the next time the computer starts, it sees the checksum mismatch and outputs that message.

[@AJMansfield1]

There actually are heap canaries! You just have to call `mprobe()` on the buffer after you finish any risky operation. Unfortunately since nobody actually "owns" heap memory, the compiler can't just automatically insert this check at every function return. Alternately, you can ask nicely to have the compiler try to make its best guess by calling `mcheck()` or passing `-lmcheck` when linking. You can also do one better if you use a more paranoid allocator that uses separate virtual memory pages for each allocation and flanks them with guard pages -- that way, you get an automatic hardware exception any time something even _reads_ outside each buffer's closest 4096-byte block. (That is, in fact, what a segfault is; guard pages just make segfaults happen for buffers in the middle of the heap too, not just at the end.)

[@cFyugThCzvAqYaGmxRgfCKTuvHMEjQ]

Alternatively, you can rewrite it in Rust!

[@TheCustomFHD]

@@cFyugThCzvAqYaGmxRgfCKTuvHMEjQ Fuck Rust, Rust is the reason Devs get dumber, and move away from the Hardware. Also the reason why a browser takes 500MB ram, instead of the 50M that it should take max.

[@龗]

or use AddressSanitizer

[@jonshouse1]

I used to place variables with test values manually at the end of arrays for testing, these days I use "-fsanitize=address" with gcc, great feature.

[@cihatkececi2310]

Clang and MSVC also have address sanitizer

[@TheBainMeister]

Absolutely, great videos. I haven't done much C since Uni, but need to get back into it. These videos definitely help inspire me to do that, keep up the great work man!

[@LowLevelLearning]

Great to hear!

[@xxxPrzybyLxxx]

"Here we have a C code..." - there You go You have find Your first canary.

[@IsaacShekelberg]

Tried stack based overflows for educational purposes on self written binarys and i was wondering why my arbitrary shellcode was not executed besides NX turned off. I will go and check for canarys. Thanks! UPDATE: Yes it has canary

[@MrRedwires]

I guess the main problem with heap memory is knowing when to check it... But I saw another comment referring to heap canaries, which is cool! There should be support for automatic checks in some of the std memory containers, e.g. after passing the .data() pointer of a std::vector Also, fun fact! Canary bytes were re-implemented on things that don't natively support them. FreeRTOS, a popular microcontroller scheduler, allows the placement of canary bytes too. It's very useful!

[@JorgetePanete]

"Here I wrote some C code-" ah, I see the problem "that's vulnerable" reduntant

[@reverse.engineer.]

Some notes on canaries: - Based on idea of ‘canary in a coal mine’ - AKA Stack Cookies - Method: Random number is placed between local variables on the stack and the return address on the stack ~**Before you return from a function you check that random number and ask if it's corrupted or not. If safe return; If not *buffer may have floweth'd over* - *USUALLY* Added by compiler Canaries are a form of Mitigation because the principal falls under certain ASSUMPTIONS: //In the words of a good friend - Never make Assumptions. 1) Linear-writing buffer overflows will corrupt the canary, and that corruption will be detected before anything bad can happen. 2) It's Hard for attacker to guess the 32/64-bit random number. 3) Not possible for attacker to read the number and then write the same number back as part of the overflow. ***Assumptions ( each of these could be violated by an attacker ) --- if attacker has control of destination pointer. --- Did the implementers have adequate randomization for the 32/64-bit number? Is there a chance the attacker can guess it? --- Can the attacker read the canary? If they can read the canary then they could write back the exact value while they're doing the linear buffer overflow. (depends on information disposal) - At the end of the day canaries are a cheap, good exploit mitigation mechanism that should be enabled.

[@williamdrum9899]

Why use a random number and not just use the actual return address?

[@roygalaasen]

@@williamdrum9899 my guess is that a random number always will be harder to guess for an attacker trying to exploit your code?

[@_modiX]

Now I understand why Microsoft calls their nightly Edge builds canary builds.

[@naturallyinterested7569]

2:57 I think that's supposed to be the function epilog? (pro - before, epi - after, so after the function might have clobbered the canary)

[@sergiopolarbear810]

omg thank you for this. i was using ghidra for the first time today and was wondering what that fs:offset and chk stack fail were

[@mateuszmyalski9005]

The heap can be protected by specifying the max size of the heap in the linker, and then creating small section of the memory at the end of the heap that has no write permission flag on

[@kayakMike1000]

Does this trigger a hard fault like IRQ 3 in arm cortex-m0+?

[@jurekrasovec]

This happened to me just yesterday with "char query[1024];" and then copy/paste "memset(query, 0x00, 2048);". Too bad you didn't post this video yesterday as I had no idea what is wrong :)

[@ericbwertz]

That's exactly why magic numbers in your code are bad. The only constants you should ever see in your code are (perhaps) -1, 0, 1 and NULL/null/None.

[@anon_y_mousse]

@@ericbwertz Indeed, BUFSIZ or whatever user defined macro/constant would be best.

[@williamdrum9899]

Honestly I don't have a problem with magic numbers if they're powers of 2

[@anon_y_mousse]

@@williamdrum9899 Read the original post, those are both powers of two.

[@ericbwertz]

@@anon_y_mousse , @William Drum And murder is OK, as long as the mess is contained in a heavy-duty Hefty bag.

[@macktheripper7454]

What a great channel, subbed

[@Luxcium]

I have no clue why I love ❤️ watching those videos I don’t even program in C or anything I am a Typical TypeScript ScriptKiddy but not the kind that copy then paste… I am no longer merely duplicating and replicating text, for I have transcended the realm of simple synonym substitution. With the power of ChatGPT-4, I now engage in a sophisticated art of textual transmutation, skillfully weaving words and phrases to forge novel compositions that retain the essence of the original, all while evading the pedestrian confines of mere copy-pasting. 😮

[@williamdrum9899]

Not sure if this counts as a canary, but this is a trick for Sega Genesis (or any Motorola 68000 CPU). The registers are all 32 bit but the addressable memory is only 24 bit, the top byte is discarded. Many times when I was first learning the language, I would dereference a pointer more than I should have. I'd know this happened when I was expecting a memory address in a register but I got something where the top byte wasn't zero. So the trick is that you can use any value greater than 0x00FFFFFF as a canary, since that's the last memory address the CPU can load from

[@esquilo_atomico]

nice video, nice channel, everything is so nice im happy under effect of the product

[@huntabadday2663]

+respect for the canary

[@Luxcium]

Canaries also consume insects and other small invertebrates, I believe it’s why they are used to eat bugs in code… 😅

[@smlgd]

So one thing I don't understand, the canary check code is inserted by the compiler, right? But does it detect when a function is vulnerable to buffer overflow or does it do it for every function? Is it possible to force it to not check the canary on specific functions?

[@CrittingOut]

Funny enough, learnt about this a few months ago. Fun.

[@kayakMike1000]

Ooooo this is so cool. Stack smashing was a thing that might be related.

[@williamdrum9899]

Yep, canaries exist to block stack smashing attempts

[@lt3lt3lt3]

Excellent!!

[@nalayak862]

what's checksec stack canary meant to protect against the buffer overflow

[@_AN203]

Press F to pay respect....

[@LowLevelLearning]

🦆🙏

[@Facebook-sk2iy]

well it'snt very secure format string vulns can bypass it by overwriting the stack chk fail function

[@raptoress6131]

Cool, I gotta try this out

[@LowLevelLearning]

Please do!

[@funtoxin]

01:40 😐 we all were thinking of that 😂

[@klevisimeri607]

How did you open the code in assembly.

[@ChickenNugget-je8ir]

Respect the canary

[@eljuano28]

Hey, my Veterans! I know you're singing it with me: "See the little birdy with the little yellow bill!..."

[@heitortremor]

Respect

[@trannusaran6164]

me, watching this in 6502 land: "huh, interesting!"

[@kayakMike1000]

I've been there once or twice!

[@williamdrum9899]

I've been there for far too long haha. Spent a couple years trying to make a NES game but I got tired of it

[@trannusaran6164]

@@williamdrum9899 could always hop on the 2600 like me lol

[@larrycarlson3088]

Would be cool if you could do a video on how to take info off a serial and convert it into integer values or strings. I'm finding it hard to learn.

[@eightsprites]

Not sure what you mean by serial. But to convert string to interger or integer to string look at functions ”atoi”, ”itoa” and ”sprintf”, ”sscanf”.

[@fatkhajit3293]

don't use atoi, it's not secure cause it can returns false values (returns 0 on invalid value but how you differentiate this case from passing the string "0" ?) use strtol and derivates like this : char *s = "7"; char *endptr; long n = strtol(s,&endptr,10); if (*endptr != 0) //error case else // n holds integer value 7 on error case endptr will be pointing among the passes string

[@fatkhajit3293]

btw sprintf is not secure too andcan lead to buffer overflows,uses snprintf instead

[@draakisback]

I wrote a database for secrets. One of the things that I did to protect the encrypted secrets in memory was to use canary pointers. After all, if a user could dump the secret using an overflow then it isn't very secret... Turns out, that the Canary was an easy way to find the secrets in the memory space if a user was able to do a core dump. Main issue was that the canaries themselves were not random, or at least every canary was the same throughout the program (was using libsodium). Eventually found a solution for this but it was interesting that a protection feature didn't protect the program in this case.

[@bradywb98]

Buffer overflows being used to overwrite the return address on the stack is a commonly cited example for how a hacker can get local code execution going. However, I’m not sure why it actually matters if they’re able to overwrite the return address. The CPU’s MMU is configured by the kernel to put W/R/X permissions on memory pages… the text (code) section of a typical process should not have W permissions enabled, so trying to write in there would cause a SEGFAULT. And the data sections of the process would not have the X permission enabled, so if a hacker was able to transfer execution there, again you’d SEGFAULT. Maybe I’m missing something here because it’s a great example to show how stacks and buffers and such work, but I don’t think it enables self modifying (intentional or by hacker) as it might’ve in the past. We have memory protection these days.

[@lucaspolidori]

It’s complicated. There’s a technique called ROP that is extremely interesting. It essentially lets you run multiple chunks of code by adding them to your long buffer overflow input in a precise way. You can load registers, write strings and other values in memory and much more. Every c program also is connected to libc which has the system function. So (oversimplifying) if you call that with /bin/sh as a parameter, you add shell code to your payload (in a precise manner) and get your remote code execution. It’s really complicated, so I can’t really explain it in a short comment. It’s also super cool imo. There are simple ways to counter the canary (and other more powerful mitigations he didn’t mention) that admittedly don’t work all the time, but these vulnerabilities are still very prevalent and this guy does not fully understand what he’s talking about.

[@tomaszkarwik6357]

I always thought this was called "stack cookies", but I see there is a different name

[@querela92]

Respect the canary 😮

[@oj0024]

somehow I was expecting this to be about combinators

[@cFyugThCzvAqYaGmxRgfCKTuvHMEjQ]

Correction: at 4:17 you meant to say least significant byte

[@Yukinebi]

Oh, I use rust now. So this does not apply does it?

[@conradludgate]

Rust explicitly checks for overflowing the memory at runtime with bounds checks. If you were to read into an array more than its capacity, it would panic with an out of bounds errors. Unless you're explicitly use unsafe and get_unchecked, then it will be vulnerable to overflows again

[@HiImKyle]

Not me totally going "Canary Wharf in London!"

[@AmCanTech]

Canariiieees

[@guilherme5094]

👍F for the canary.

[@galihsurya5606]

RIP for the canary, it dies after protecting us from the bug😢

[@madcode-hub6901]

Respect the canaries 👍

[@user-uu5xf5xc2b]

if you don't bring canaries the file screams

[@thedrunknmunky6571]

I'm commenting before I watch the video, trying to see if i can guess what its about. Lets see if I am right! Canaries and protecting writing out of bounds.

[@meto4545]

3:15

[@GIJOEG36]

F for the canaries

[@LowLevelLearning]

🙏

[@kayakMike1000]

F

[@jwbowen]

So are we getting a "Respect the canary" t-shirt soon?

[@somerandomdragon558]

If birds are basically huge bugs, then no. My code has no birds. It has airplanes.

[@muhammadyusoffjamaluddin]

I thought Canary really already in programming. For example: Google Chrome Canary Edition (Crash easier than beta edition). Kinda confused when he say it's not in programming tho...

[@micycle8778]

3:26 you've been taking too many notes from theprimeagen

[@centdemeern1]

No birds were harmed in the making of this video

[@LowLevelLearning]

false

[@fotnite_]

*Numerous canaries died in the making of this video.*

[@poenanster5285]

"respect the canary"

[@Tristan-mr3pk]

Does this mean the canary ate my bugs?

[@AntonioNoack]

Great video, except for the title :/ If I was looking for canaries, I probably wouldn't find this video.

[@dagoberttrump9290]

-f is for flag afaik

[@Tferdz]

easy fix: rust.

[@alexzaslavskis4623]

be aware bugs attract birds

[@lukeonuke]

w canary

[@Nameorsmth]

BRID UP!!!!

[@LowLevelLearning]

🦆

[@sanjai1038]

F Canary 🐤

[@GamePlays_1230]

I'm confused here , the OS shouldn't care what happens to your process , this feature just makes no sense

[@Dashpoint-lk3zf]

TOOOKYOOOOOOO

[@Scriabinfan593]

Disrespect the canary.

[@jbray250]

Reply F to pay respects for canary

[@kayakMike1000]

F

[@QmVuamFtaW4]

you look way different in this video.

[@FaZekiller-qe3uf]

2.

[@LowLevelLearning]

3.

[@doommusic4738]

It should ne klller

[@kermitdafrog8]

@@LowLevelLearning 4.

[@vini9598]

1.

[@LowLevelLearning]

AYYYYYYYYYY

[@ryan1696]

I'm early!

[@HoSza1]

spare dying canaries, use rust instead.

[@mcspud]

F for canaries

[@rick_er2481]

2.