The buffer overflow is yet one more
common attack that's used against us, because sometimes,
older applications and older hardware wasn't really
built to handle too much data at once.
So what we're going to do in this particular Nugget
is just draw at the whiteboard and talk
for a second about how the buffer overflow works
and what type of data or information
the hackers trying to take from us.
Let's get going.
The buffer overflow attack.
Another oldie but goodie, but in this one,
there's no real way that I could demonstrate how it works,
because this could actually jeopardize the system WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because this could actually jeopardize the system
when you perform this attack.
You see, the idea is that the hacker--
instead of a smiley face, I'm going
to put a bad face, because they're hackers.
The hacker is going to try and send in data into a website,
maybe they're using a JavaScript injection or SQL injection,
or maybe they're just doing something
as simple as sending in too big of a ping, something like that.
The idea is they're trying to overflow the applications RAM
buffer.
You're trying to send in more data than the actual device. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
You're trying to send in more data than the actual device.
The actual application has been allotted to handle.
So let's make up a number here.
Let's say this particular server.
We sent in just a huge amount of information,
and this particular server was set to handle something
like 60,000 bytes of data at once,
but we've just sent in 80,000 bytes.
The idea here is that additional or excess 20,000 bytes now
has to overflow into other sections of the application
or the server itself.
And once we've got our 20,000 bytes within there, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And once we've got our 20,000 bytes within there,
we could then create these 20,000 bytes to execute
JavaScript code or SQL code or C# or .NET code,
whatever the case is.
And we could use it to delete or destroy information,
or we could use it to retrieve or pull information out.
Now, application developers and servers themselves
are getting better at defending against this on their own,
but this is another one that's present in the OWASP top 10
threats, and you should really spend some time digging
through the buffer overflow, because there's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
through the buffer overflow, because there's
a bunch of different ways they can send data in and then
exploit once they've got into the overflowed section
the different languages they want to use.
So quite simply put, our mitigation steps
are just to not accept any more data beyond that
and not let it overflow.
This requires some back end code work here
to prevent that from happening.
The application server itself, not the web browser
and not the database, but the application
server itself is what's going to have to stop
that overflow from happening. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that overflow from happening.
You could simply send a response back to the web browser
and say, look, we've had a buffer overflow.
Here's your error that says buffer overflow,
and we're stopping the transmission at this point.
So the key takeaway with the buffer overflow attack
is that we're just trying to overwhelm
the server with commands or processes,
and by doing so, injecting or leaking
our own commands into other aspects of the application
or server itself.
So that's been the quick overview of the buffer overflow
attack.
I hope this has been informative for you, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I hope this has been informative for you,
and I'd like to thank you for viewing.