Ghosts'n'Gadgets: Common Buffer Overflows That Still Haunt Our Networks

This talk revisits classic stack and heap buffer overflows and argues they still turn up in internet-facing networking and IoT equipment. The speaker examines two widely exposed devices: a wireless gateway used at remote sites and critical infrastructure, and a rack-mounted security appliance that runs its main operating system as a guest on a virtualized Linux host. Both are found in large numbers online, and the attack surface is the device's own web and captive portal services.

On the gateway, an open-source captive portal component did not check the length of a query string, causing a heap overflow. Without a debugger, the researcher got around non-executable memory and address randomization using return-oriented gadgets, and leaked a heap address through a debug logging routine. One crafted request could then run an operating system command. The appliance's web interface copied unbounded parameters onto the stack; a lucky local variable on an unauthenticated page let the chain survive cleanup, and an unsanitized command channel between guest and host led to a root shell on the host.

The takeaway is that a bug that looks severe on paper can be hard to exploit, yet small weaknesses can still be chained into full control. For defenders, the talk is a reminder to patch edge devices, limit internet exposure, and replace default passwords.