So we have talked about buffer overflows and how programs that have
this vulnerability can get exploited, in particular letting attackers or giving
them the ability to execute arbitrary code with the host services privileges.
It's not a good thing.
We shouldn't write code that has those vulnerabilities, but
if such code is out there deployed on systems, we need to find ways to
defend against attacks that are going to exploit these kind of vulnerabilities.
So we're going to talk about a number of defenses
that help us counter attacks that rely on these buffer overflows.
The first one we're going to talk about is your choice of programming language.
What language are you writing your program in?
There are actually going to be languages where this kind of problem goes away,
you don't have buffer overflows.
And these languages are languages that are strongly typed, that do lot
of memory management they do automatic automatically, so they do bounds check.
Remember one of the problems that we had was that we declared a string variable
of size 12 and we said you can read any amount into it.
There is no way unless I explicitly inserted a check,
the language didn't do that, unless I explicitly inserted a check that said
giving it more than 12 bites, that's not good.
The language didn't stop me from clobbering
whatever was next to the password string that we had.
Not all languages do that.
There are languages that say you have an object of size this,
this is how much it could be, it can't be any more.
So what type of variable it is, how much memory is required for
it or is allocated to it, and how much memory you can access when you access
that variable, this bounds check that we're talking about.
And if you manage this memory automatically,
the problem of memory overflow,
or abusing memory the way we did when we have buffer overflows, that goes away.
So, languages that do are called safe languages,
because you can rely on type safety and you don't make these kind of mistakes.
So there are several examples of these languages, Java, C++, and others.
So if you write code in these kind of languages that have type safety and
that do the kind of things that we're talking about,
buffer overflow would not be a problem.
The buffer overflow typically comes because we don't do
either strong type checking or this bounds checks that I was talking about,
which is what low level kind of languages are notorious for that.
But these object oriented strongly typed languages make that problem go away.