Presentation by Haroon Meer and Charl van der Walt at ISSA in 2006. The presentation begins with an explanation of a stack overflow attack and format string vulnerability, both with example code. Dangerous integers are also explained. The presentation ends with a discussion on ActiveX control.

1. WHEN GOOD CODE GOES BAD! A SHOWCASE OF MODERN PROGRAMMING MISHAPS (SensePost 2006)

5. Super Simple Explanation.. void foo(int a, int b) { char buf1[8]; char buf2[8]; gets(buf2); } int main(void) { foo(1,2); printf(“All done!”) }

6. Typical Attack.. void foo(int a, int b) { char buf1[8]; char buf2[8]; gets(buf2); } int main(void) { foo(1,2); printf(“All done!”) }

9. Then what’s a format string bug? printf(“%s”, buff); printf(buff);

10. Then what’s a format string bug? printf(“%s”, buff); buff = “%s”; printf(buff); C:gt; issa_format.exe

11. What’s a dangerous Integer?