[55196] in North American Network Operators' Group
worm design (Re: Level3 routing issues?)
daemon@ATHENA.MIT.EDU (E.B. Dreger)
Sat Jan 25 18:21:13 2003
Date: Sat, 25 Jan 2003 21:09:26 +0000 (GMT)
From: "E.B. Dreger" <eddy+public+spam@noc.everquick.net>
To: "nanog@merit.edu" <nanog@merit.edu>
In-Reply-To: <Pine.NEB.4.51.0301250958320.9914@rhombus.znep.com>
Errors-To: owner-nanog-outgoing@merit.edu
MS> Date: Sat, 25 Jan 2003 10:17:01 -0800 (PST)
MS> From: Marc Slemko
MS> It is interesting to note that one inadvertent advantage of open
MS> source (when it requires people to compile from source, and pick
MS> and choose options at compile time... popular distributions with
MS> precompiled packages obviously break this to a certain degree) is
MS> that it leads to a much more heterogenous set of software WRT
MS> attacks like buffer overflows.
1. Position-relative opcodes used in shellcode
2. Syscalls triggered via a software trap, not subroutine call
3. Dynamic linking involves fixups stored in the binary
4. Activate a syscall, then check the stack to find %eip
Eddy
--
Brotsman & Dreger, Inc. - EverQuick Internet Division
Bandwidth, consulting, e-commerce, hosting, and network building
Phone: +1 (785) 865-5885 Lawrence and [inter]national
Phone: +1 (316) 794-8922 Wichita
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Date: Mon, 21 May 2001 11:23:58 +0000 (GMT)
From: A Trap <blacklist@brics.com>
To: blacklist@brics.com
Subject: Please ignore this portion of my mail signature.
These last few lines are a trap for address-harvesting spambots.
Do NOT send mail to <blacklist@brics.com>, or you are likely to
be blocked.
