Free Linux Software Blocks Hackers

WASHINGTON (04/21/2000) - Certain electronic intruders will have to find a new way to wreak havoc thanks to free Linux software released Thursday by Lucent Technologies Inc.'s Bell Labs.

The software blocks hackers who use the common technique of overflowing an application's buffer memory to gain access to a computer.

Buffer overflows were the most common form of computer vulnerability exploited over the past 10 years, according to a recent report funded by the Defense Advanced Research Projects Agency and published by the Oregon Graduate Institute of Science and Technology.

Lucent's new Libsafe software was designed specifically to prevent those attacks.

A buffer is a region of computer memory that application programs use to temporarily store information. A problem occurs when programs write information to buffers without properly checking the buffer size, which leaves them vulnerable to attacks that cause a large amount of data to be written, overwriting the memory immediately outside the buffer region. The overflow injects additional code into an application program and then hijacks control of the program to execute that code.

Linux, an open-source operating system, has been gaining momentum in the government for the past few months. It has become prevalent in high-end technical and network missions at agencies including NASA and Defense Department research laboratories.

Libsafe does not require access to the source code of the application programs and protects all such programs running on a system, said Lucent spokesman Dan Coulter. "It prevents this kind of attack even if the code is not written right," he said. "Libsafe still protects the information even if the [buffer] wasn't written to the right size."

Linux distributors including Red Hat Inc., Linux-Mandrake, TurboLinux Inc. and Debian GNU/Linux are working with Bell Labs to incorporate Libsafe into their software releases, according to representatives from each company.

Join the newsletter!

Error: Please check your email address.

More about Bell LabsDebianDefense Advanced Research Projects AgencyLucentLucent TechnologiesMandrakeNASARed HatTurbolinux

Show Comments