WEBVTT
Kind: captions
Language: en

1
00:00:00.000 --> 00:00:03.900
Buffer exploits are one of the basic bugs of modern computer science.

2
00:00:03.900 --> 00:00:10.000
They are responsible for glitches in games. They are responsible for all sorts of viruses and exploits,

3
00:00:10.000 --> 00:00:14.500
and they're also responsible for some major technical disasters.

4
00:00:14.500 --> 00:00:19.500
In the last 48 hours, as I record this, we've had one of those major disasters, we've had Heartbleed,

5
00:00:19.500 --> 00:00:23.060
which is, well, at its heart, it's a buffer exploit.

6
00:00:23.420 --> 00:00:27.600
So let me try to explain what that is, and the technical folks in the audience will perhaps cringe

7
00:00:27.600 --> 00:00:32.400
at how much I'm oversimplifying this, but, for the non-techy folks out there, for the folks who are

8
00:00:32.400 --> 00:00:38.000
just starting programming, or interested in computers, this is how it works - and first of all don't worry if

9
00:00:38.000 --> 00:00:41.400
you're using a high level language like JavaScript, or something like that,

10
00:00:41.400 --> 00:00:46.800
you don't need to handle buffer overflows, it's all taken care of for you in the compiler.

11
00:00:46.800 --> 00:00:52.800
But if you work in C, in Fortran even - in something down at the metal, as it were - well, buffer overflows

12
00:00:52.800 --> 00:00:55.080
are something you have to watch for.

13
00:00:55.080 --> 00:01:01.000
So, let's imagine that we have a program – let's just put a box here – some sort of program,

14
00:01:01.000 --> 00:01:06.700
and that program is expecting input. Now, this might be a massive file from the hard disk,

15
00:01:06.700 --> 00:01:12.400
it might any kind of data coming in, but let's just say it's a string - just some text coming in -

16
00:01:12.400 --> 00:01:18.600
and that string is meant to be a certain length, so that program has set aside a certain amount of memory for it

17
00:01:18.600 --> 00:01:24.600
– just here, inside it – only what comes in is not what it expects.

18
00:01:24.600 --> 00:01:31.400
What comes in is a much longer, or even maybe just slightly longer, bit of text than is being expected.

19
00:01:31.400 --> 00:01:35.700
So instead of this – we have this – little bit more.

20
00:01:35.700 --> 00:01:41.000
And what happens is that, rather like a train ploughing through its buffers at the end of a platform,

21
00:01:41.000 --> 00:01:44.800
and screaming into the station, it's going to do some damage.

22
00:01:44.800 --> 00:01:50.800
It will continue writing that string into memory past the end of that reserved buffer space.

23
00:01:50.800 --> 00:01:54.000
And that's going to cause crashes, generally that's going to cause

24
00:01:54.000 --> 00:01:57.800
a malfunction in the program when it looks for data and finds nothin-

25
00:01:57.800 --> 00:01:59.200
n-n-n-n-n-n-n-n-

26
00:01:59.200 --> 00:02:00.900
but whatever just got typed in.

27
00:02:00.900 --> 00:02:05.400
But if you're a clever attacker, if you know what you're doing, if you know what your target is,

28
00:02:05.400 --> 00:02:12.400
then you can craft a much longer string - just here - that contains all sorts of instructions, all sorts of code,

29
00:02:12.400 --> 00:02:18.100
if you know what that program is going to look for next, you can just keep on writing into that program and

30
00:02:18.100 --> 00:02:21.000
put your own instructions over what's in there.

31
00:02:21.000 --> 00:02:24.400
That's a basic buffer overflow attack.

32
00:02:24.860 --> 00:02:31.000
Now in the last 48 hours or so we've had Heartbleed, and that is a vulnerability in OpenSSL.

33
00:02:31.000 --> 00:02:37.400
OpenSSL is the open source code that handles about...let's say about half, two thirds,

34
00:02:37.400 --> 00:02:41.220
certainly a very large proportion of the world's secured web traffic,

35
00:02:41.220 --> 00:02:46.200
the stuff that goes between you and online banks, or you and your private email account.

36
00:02:46.200 --> 00:02:48.840
All of that goes through OpenSSL.

37
00:02:48.840 --> 00:02:52.800
It's basically responsible for making sure there's that little padlock icon in your browser,

38
00:02:52.800 --> 00:02:57.000
making sure that can pop up and say "yes, this is definitely a secure link",

39
00:02:57.000 --> 00:03:03.700
so a bug in that is a really big deal, and it's interesting because it's basically a buffer UNDERflow attack.

40
00:03:03.700 --> 00:03:08.300
And to explain it, I need to explain about something called Heartbeat.

41
00:03:08.300 --> 00:03:13.800
See, if I've got my computer – just here, my laptop – and it's talking to a server over here

42
00:03:13.800 --> 00:03:18.000
with OpenSSL on it, it can send something called a heartbeat command.

43
00:03:18.000 --> 00:03:22.600
And the heartbeat command is essentially "Is this connection alive? Is it working."

44
00:03:22.600 --> 00:03:26.700
It's basically a [HEARTBEAT NOISE] that goes back and forth between the two.

45
00:03:26.700 --> 00:03:31.800
And the heartbeat command works like this: I send some data, and the server sends it back to me.

46
00:03:31.800 --> 00:03:36.500
So I say "here is the word 'HEART', please send that back to me," and the server does.

47
00:03:36.500 --> 00:03:38.800
Except that's not quite out how it works.

48
00:03:38.800 --> 00:03:47.000
What I send is "Here is the word 'HEART', it is 5 bytes long, please send those 5 bytes back to me."

49
00:03:47.000 --> 00:03:52.000
And the server does that. It receives them and it sends them straight back.

50
00:03:52.000 --> 00:03:55.500
But the trouble is, with this particular version of OpenSSL,

51
00:03:55.500 --> 00:04:02.000
if you said "here is the word 'HEART', it is 64,000 characters long"

52
00:04:02.000 --> 00:04:06.000
Well...OpenSSL isn't going to check that that makes sense.

53
00:04:06.000 --> 00:04:10.400
Instead, it's going to open up a little buffer, put the word 'heart' in there,

54
00:04:10.400 --> 00:04:14.200
and then it's going to send me back whatever else it can find.

55
00:04:14.200 --> 00:04:17.700
It's just going to just keep reading from that buffer, despite the fact that buffer has ended.

56
00:04:17.700 --> 00:04:25.000
It is going to read 64k of whatever it is thinking at that moment, and it's going to send it back to me.

57
00:04:25.000 --> 00:04:30.800
And that's dangerous, because that 64k could include some very private data indeed.

58
00:04:30.800 --> 00:04:35.700
It could include session tokens, which let you impersonate other users on the website,

59
00:04:35.700 --> 00:04:43.000
or it could include private keys – the big cryptographic numbers that say this server is who it claims to be.

60
00:04:43.000 --> 00:04:46.500
If you get their private keys you can impersonate them.

61
00:04:46.500 --> 00:04:51.000
You can impersonate whoever this server happens to be: Google, government, online bank

62
00:04:51.000 --> 00:04:56.800
– get those numbers, pull them out of memory by luck, by chance, or by being very clever

63
00:04:56.800 --> 00:05:00.000
and, well, you can claim to be them.

64
00:05:00.200 --> 00:05:06.800
And that is a crippling security bug for the internet, so over the past 48 hours a lot of system administrators

65
00:05:06.800 --> 00:05:12.500
have been desperately patching, trying to make sure that their version is the new, up-to-date one.

66
00:05:13.240 --> 00:05:18.800
So there you go, that's a buffer overflow, or a buffer underflow in this case, and that's Heartbleed.

67
00:05:18.800 --> 00:05:24.000
But one final thought. If you want to be paranoid, and I want to stress I'm not paranoid about this,

68
00:05:24.000 --> 00:05:29.500
I'm a firm believer in "cock-up before conspiracy", but, if you want to be paranoid, just have a think:

69
00:05:29.500 --> 00:05:36.600
that bug went unfixed for about two years. Did anyone else notice it and just not tell the world?

70
00:05:36.600 --> 00:05:40.200
And has been quietly extracting information ever since?

71
00:05:40.200 --> 00:05:46.440
Or if you want to get really paranoid, and again, I stress I don't, but if you want to get really paranoid...

72
00:05:47.620 --> 00:05:50.320
who put that bug there in the first place?

73
00:05:51.740 --> 00:05:53.740
[Translating these subtitles? Add your name here!]