dangling pointers and security

[Aravind]

I would like to know in what manner dangling pointers affect the
security of a application developed using C++.What are the loopholes
that are created by dangling pointers and how they could be exploited
by hackers?.

Aravind

[Karl Heinz Buchegger]

Aravind wrote:

I would like to know in what manner dangling pointers affect the
security of a application developed using C++.What are the loopholes
that are created by dangling pointers and how they could be exploited
by hackers?.

Do you have any idea what 'dangling pointers' are?
--
Karl Heinz Buchegger
kb******@gascad .at

[JKop]

Aravind posted:

I would like to know in what manner dangling pointers affect the
security of a application developed using C++.What are the loopholes
that are created by dangling pointers and how they could be exploited
by hackers?.

Aravind

You are way way wayyyyyyyy off!
First, what do hackers do? They access computers and networks via the
Internet and do things that you don't want them to do.

How do you stop them? Don't give them the ability in the first place!
Sounds simple? So why do people get "hacked"? Mainly because Microsoft is
stupid; it enables things like "file sharing" and "printer sharing" via the
internet protocol TCP/IP. Hackers exploit the ability *that has explicitly
been given to them*.
Now, dangling pointers:

int* pChocolate = new int;

delete pChocolate;

*pChocolate = 5;

That's what a dangling pointer is, and as you can see, it has nothing at all
whatsoever to do with hacking and/or hackers.
Hope that helps.
-JKop

[Rolf Magnus]

JKop wrote:

First, what do hackers do? They access computers and networks via the
Internet and do things that you don't want them to do.

Actually, they don't. That's what the media made out of the word
"hacker". A hacker is actually just a programmer who is good at
programming and who likes it.

[Thomas Matthews]

Rolf Magnus wrote:

JKop wrote:

First, what do hackers do? They access computers and networks via the
Internet and do things that you don't want them to do.

Actually, they don't. That's what the media made out of the word
"hacker". A hacker is actually just a programmer who is good at
programming and who likes it.

My understanding (or definition) of hacker is one who attempts
a task without reading or finding out how to do it first.

When I was growing up, hackers would figure out how to log into
other computers and browse. No malicious intent, just bragging
rights. Other hackers would attempt to write editors starting
from the bottom up without any pre-design.

At some point in time, hacker was designated with a negative
conontation (sp!). This was due to the few who were malicious.
Now, the malicious ones are hired by "The Dark Side" for
"evil purposes".

So much for being able to play "Global Thermonuclear War"
on the "Wombat" computer. "Want to play a game?"

--
Thomas Matthews

C++ newsgroup welcome message:
http://www.slack.net/~shiva/welcome.txt
C++ Faq: http://www.parashift.com/c++-faq-lite
C Faq: http://www.eskimo.com/~scs/c-faq/top.html
alt.comp.lang.l earn.c-c++ faq:
http://www.raos.demon.uk/acllc-c++/faq.html
Other sites:
http://www.josuttis.com -- C++ STL Library book

[Rolf Magnus]

Thomas Matthews wrote:

Rolf Magnus wrote:

JKop wrote:

First, what do hackers do? They access computers and networks via the
Internet and do things that you don't want them to do.

Actually, they don't. That's what the media made out of the word
"hacker". A hacker is actually just a programmer who is good at
programming and who likes it.

My understanding (or definition) of hacker is one who attempts
a task without reading or finding out how to do it first.

When I was growing up, hackers would figure out how to log into
other computers and browse. No malicious intent, just bragging
rights. Other hackers would attempt to write editors starting
from the bottom up without any pre-design.

Yes, something like that. For doing that, you would need to be very good
at programming and also like it, so it's more or less consistent with
my definition. I just couldn't put it in words as good as you could.
At some point in time, hacker was designated with a negative
conontation (sp!). This was due to the few who were malicious.
Now, the malicious ones are hired by "The Dark Side" for
"evil purposes".
And now, most people only know those malicious ones, because they are in
the media, and movies and novels are written about them.
Only few people would realize that the "Linux Kernel Hacker's Guide" is
not about breaking into linux systems.
So much for being able to play "Global Thermonuclear War"
on the "Wombat" computer. "Want to play a game?"

--
"computer games don't affect kids. I mean if pac man affected us as
kids, we'd all run around in a darkened room munching pills"

[Mark A. Gibbs]

My understanding (or definition) of hacker is one who attempts
a task without reading or finding out how to do it first.
the definition of hacker i've always known is someone who does something
unorthodox and/or inelegant, just to get something done. bypassing
passwords to enter a secure area is a little unorthodox, so the
definition extends to cover that group.
When I was growing up, hackers would figure out how to log into
other computers and browse. No malicious intent, just bragging
rights. Other hackers would attempt to write editors starting
from the bottom up without any pre-design.

Yes, something like that. For doing that, you would need to be very good
at programming and also like it, so it's more or less consistent with
my definition. I just couldn't put it in words as good as you could.

i agree except that you don't necessarily *need* to be good at
programming (or even fond of it) to hack a working program together. it
would probably be a mess, and an embarrasment to any professional
programmer with dignity, but it would work.

that said, the best hackers would tend to be ones who are very good,
because they would be the ones thinking outside the box.

to me, a hacker is someone who "just gets it done, and damn the
torpedos". that doesn't necessarily imply competence or enjoyment,
although there will be a high degree of correlation. hacker is a kind of
play derogatory, too. both a hacker and a very good programmer may get a
job done, but only the good programmer should be proud of his work.

At some point in time, hacker was designated with a negative
conontation (sp!). This was due to the few who were malicious.
Now, the malicious ones are hired by "The Dark Side" for
"evil purposes".

And now, most people only know those malicious ones, because they are in
the media, and movies and novels are written about them.
Only few people would realize that the "Linux Kernel Hacker's Guide" is
not about breaking into linux systems.

there's a whole subculture with it's own parlance and jargon that
differentiates between hacker, crackers, phreakers, sneakers and so on.
i don't know all the subtleties of it, but i believe that the kind of
person who breaks into things is a cracker. they may or may not have
hacked their way in, depending on the elegance of the method, but in the
end, the result is that they've cracked the system - not "hacked" the
system.

So much for being able to play "Global Thermonuclear War"
on the "Wombat" computer. "Want to play a game?"

bonus points for obscure pop culture reference ^_^

for the record, i have never heard of any instance when a dangling
pointer caused a security issue - and i have no idea how one could be
(except by a monumental fluke, and even then, it would likely not be a
deterministical ly reproducable problem). crashes, yes. odd behaviour,
yes. buffer overruns on the other hand....

mark

[Steven T. Hatton]

Thomas Matthews wrote:

Rolf Magnus wrote:

JKop wrote:

First, what do hackers do? They access computers and networks via the
Internet and do things that you don't want them to do.

Actually, they don't. That's what the media made out of the word
"hacker". A hacker is actually just a programmer who is good at
programming and who likes it.

My understanding (or definition) of hacker is one who attempts
a task without reading or finding out how to do it first.

http://www.xemacs.org/Documentation/...ls_1.html#SEC1

1. A History of Emacs

XEmacs is a powerful, customizable text editor and development environment.
It began as Lucid Emacs, which was in turn derived from GNU Emacs, a
program written by Richard Stallman of the Free Software Foundation. GNU
Emacs dates back to the 1970's, and was modelled after a package called
"Emacs", written in 1976, that was a set of macros on top of TECO, an old,
old text editor written at MIT on the DEC PDP 10 under one of the earliest
time-sharing operating systems, ITS (Incompatible Timesharing System). (ITS
dates back well before Unix.) ITS, TECO, and Emacs were products of a group
of people at MIT who called themselves "hackers", who shared an idealistic
belief system about the free exchange of information and were fanatical in
their devotion to and time spent with computers. (The hacker subculture
dates back to the late 1950's at MIT and is described in detail in Steven
Levy's book Hackers. This book also includes a lot of information about
Stallman himself and the development of Lisp, a programming language
developed at MIT that underlies Emacs.)
--
STH
Hatton's Law: "There is only One inviolable Law"
KDevelop: http://www.kdevelop.org SuSE: http://www.suse.com
Mozilla: http://www.mozilla.org

[Julie]

Aravind wrote:

I would like to know in what manner dangling pointers affect the
security of a application developed using C++.What are the loopholes
that are created by dangling pointers and how they could be exploited
by hackers?.

Aravind

Dangling pointer:
http://catb.org/~esr/jargon/html/D/d...g-pointer.html

In a language such as C++, a dangling pointer isn't particularly a problem, in
and of itself. In languages where pointers are abstracted away (e.g. Java),
there can be all sorts of negative consequences because of the implied notion
that a pointer only points to something valid (or possibly null).

Common code practices indicate that a pointer should either: point to something
valid, or be set to null. Under this practice, usage of a valid pointer will
result in defined behavior, usage of a null pointer will result in an exception
or program termination. However, using a dangling pointer is completely
undefined, and there is where a potential problem can be exploited, but it is
going to be very system specific behavior.

So, suppose that there is a system & application where it is known that there
is some sequence of steps that results in (internally) a dangling pointer.
Additionally, occasionally that dangling pointer may eventually point to a
portion of memory that contains security (access-control) related information.
That dangling pointer, could then conceivable be exploited to be used to write
to (what is presumed) secure parts of memory, changing access control, and
possibly granting additional (unintended) access to the user.

Note that this is only one scenario, there is no single or unified answer to
your question.

[JKop]

Julie posted:

So, suppose that there is a system & application where it is known that
there is some sequence of steps that results in (internally) a dangling
pointer.
int* pBozo = new int;

delete pBozo;

//AHHH!!!! Dangling pointer!
Additionally, occasionally that dangling pointer may
eventually point to a portion of memory that contains security
(access-control) related information.

pBozo = GenerateSuperDu perRandomMemory Address();

That dangling pointer, could then
conceivable be exploited to be used to write to (what is presumed)
secure parts of memory, changing access control, and possibly granting
additional (unintended) access to the user.

BULL

SHIT

BULL

SHIT

Note that this is only one scenario, there is no single or unified
answer to your question.

Dangling pointers are not a problem at all whatsoever.
-JKop