Buffer exploits are one of the basic bugs of modern computer science.
They are responsible for glitches in games. They are responsible for all sorts of viruses and exploits,
and they're also responsible for some major technical disasters.
In the last 48 hours, as I record this, we've had one of those major disasters, we've had Heartbleed,
which is, well, at its heart, it's a buffer exploit.
So let me try to explain what that is, and the technical folks in the audience will perhaps cringe
at how much I'm oversimplifying this, but, for the non-techy folks out there, for the folks who are
just starting programming, or interested in computers, this is how it works - and first of all don't worry if
you're using a high level language like JavaScript, or something like that,
you don't need to handle buffer overflows, it's all taken care of for you in the compiler.
But if you work in C, in Fortran even - in something down at the metal, as it were - well, buffer overflows
are something you have to watch for.
So, let's imagine that we have a program – let's just put a box here – some sort of program,
and that program is expecting input. Now, this might be a massive file from the hard disk,
it might any kind of data coming in, but let's just say it's a string - just some text coming in -
and that string is meant to be a certain length, so that program has set aside a certain amount of memory for it
– just here, inside it – only what comes in is not what it expects.
What comes in is a much longer, or even maybe just slightly longer, bit of text than is being expected.
So instead of this – we have this – little bit more.
And what happens is that, rather like a train ploughing through its buffers at the end of a platform,
and screaming into the station, it's going to do some damage.
It will continue writing that string into memory past the end of that reserved buffer space.
And that's going to cause crashes, generally that's going to cause
a malfunction in the program when it looks for data and finds nothin-
n-n-n-n-n-n-n-n-
but whatever just got typed in.
But if you're a clever attacker, if you know what you're doing, if you know what your target is,
then you can craft a much longer string - just here - that contains all sorts of instructions, all sorts of code,
if you know what that program is going to look for next, you can just keep on writing into that program and
put your own instructions over what's in there.
That's a basic buffer overflow attack.
Now in the last 48 hours or so we've had Heartbleed, and that is a vulnerability in OpenSSL.
OpenSSL is the open source code that handles about...let's say about half, two thirds,
certainly a very large proportion of the world's secured web traffic,
the stuff that goes between you and online banks, or you and your private email account.
All of that goes through OpenSSL.
It's basically responsible for making sure there's that little padlock icon in your browser,
making sure that can pop up and say "yes, this is definitely a secure link",
so a bug in that is a really big deal, and it's interesting because it's basically a buffer UNDERflow attack.
And to explain it, I need to explain about something called Heartbeat.
See, if I've got my computer – just here, my laptop – and it's talking to a server over here
with OpenSSL on it, it can send something called a heartbeat command.
And the heartbeat command is essentially "Is this connection alive? Is it working."
It's basically a [HEARTBEAT NOISE] that goes back and forth between the two.
And the heartbeat command works like this: I send some data, and the server sends it back to me.
So I say "here is the word 'HEART', please send that back to me," and the server does.
Except that's not quite out how it works.
What I send is "Here is the word 'HEART', it is 5 bytes long, please send those 5 bytes back to me."
And the server does that. It receives them and it sends them straight back.
But the trouble is, with this particular version of OpenSSL,
if you said "here is the word 'HEART', it is 64,000 characters long"
Well...OpenSSL isn't going to check that that makes sense.
Instead, it's going to open up a little buffer, put the word 'heart' in there,
and then it's going to send me back whatever else it can find.
It's just going to just keep reading from that buffer, despite the fact that buffer has ended.
It is going to read 64k of whatever it is thinking at that moment, and it's going to send it back to me.
And that's dangerous, because that 64k could include some very private data indeed.
It could include session tokens, which let you impersonate other users on the website,
or it could include private keys – the big cryptographic numbers that say this server is who it claims to be.
If you get their private keys you can impersonate them.
You can impersonate whoever this server happens to be: Google, government, online bank
– get those numbers, pull them out of memory by luck, by chance, or by being very clever
and, well, you can claim to be them.
And that is a crippling security bug for the internet, so over the past 48 hours a lot of system administrators
have been desperately patching, trying to make sure that their version is the new, up-to-date one.
So there you go, that's a buffer overflow, or a buffer underflow in this case, and that's Heartbleed.
But one final thought. If you want to be paranoid, and I want to stress I'm not paranoid about this,
I'm a firm believer in "cock-up before conspiracy", but, if you want to be paranoid, just have a think:
that bug went unfixed for about two years. Did anyone else notice it and just not tell the world?
And has been quietly extracting information ever since?
Or if you want to get really paranoid, and again, I stress I don't, but if you want to get really paranoid...
who put that bug there in the first place?
[Translating these subtitles? Add your name here!]