Justin N. Ferguson's guest appearances

Justin N. Ferguson

Black Hat Briefings, USA 2007 [Video] Presentations from the security conference.

Black Hat Briefings, USA 2007 [Audio] Presentations from the security conference.

Krishna Kurapati

Chris Palmer

Keith Jones

Mark Ryan

Bruce Schneier

Tony Sager

Mark Dowd

David Byrne

Rob King

Jennifer Granick

Robert Graham

John McDonald

Mike Perry

Robert Hansen

Jamie Butler

OwlTail

Traditional exploitation techniques of overwriting heap metadata has been discussed ad-nauseum, however due to this common perspective the flexibility in abuse of the heap is commonly overlooked. This presentation examines a flaw that was found in several popular open-source applications including mod_auth_kerb (Apache Kerberos Authentication), Samba, Heimdal, OpenBSDs kerberos implementation (not exploitable), and so on, as a method for exploring 	heap structure exploitation and hopefully providing a gateway to understanding the true beauty of data structure exploitation.  	This focuses on the dynamic memory management implementation provided by the GNU C library, particularly ptmalloc2 and presents methods for evading certain sanity checks in the library along with previously unpublished methods for obtaining control.

Traditional exploitation techniques of overwriting heap metadata has been discussed ad-nauseum, however due to this common perspective the flexibility in abuse of the heap is commonly overlooked. This presentation examines a flaw that was found in several popular open-source applications including mod_auth_kerb (Apache Kerberos Authentication), Samba, Heimdal, OpenBSDs kerberos implementation (not exploitable), and so on, as a method for exploring<br/> 	heap structure exploitation and hopefully providing a gateway to understanding the true beauty of data structure exploitation.<br/> <br/> 	This focuses on the dynamic memory management implementation provided by the GNU C library, particularly ptmalloc2 and presents methods for evading certain sanity checks in the library along with previously unpublished methods for obtaining control.

Justin N. Ferguson: Understanding the Heap by Breaking It: A Case Study of the Heap as a Persistent Data Structure Through Non-traditional Exploitation Techniques