Thirty years ago, on November 8, 1996, a hacker called Aleph One published “Smashing the Stack for Fun and Profit,” the recipe for exploiting a bug the US government had warned about in 1972. Host Sarina Gandy had never heard of memory safety before this project. In this episode, she learns what the bug is, how it got loose, and what it has cost us, from hospitals locked out by WannaCry to an activist targeted through his iPhone. Along the way, she finally tracks down Aleph One. On micRob Joyce, former NSA cybersecurity directorDave Weston, Corporate Vice President for AI Security, MicrosoftBob Lord, Chief Strategy Officer, Software Safety InstituteLauren Zabierek, co-founder and CEO, Software Safety InstituteTarah Wheeler, security executive and Oxford doctoral candidatePavlina PavlovaNicole Perlroth, journalist and author of This Is How They Tell Me the World EndsYael Grauer, author of Consumer Reports’ report on the future of memory safetyAdam Shostack, threat modeling expertElias Levy, a.k.a. Aleph OneCrispin Cowan, creator of StackGuard Chapters0:00 Governments switch off their own websites2:07 Meet Sarina, and why she’d never heard of this bug4:30 Why it’s your problem7:42 WannaCry and the NHS9:24 Audrey’s story10:40 The invisible ankle bracelet: Ahmed Mansoor12:20 What can an ordinary person do?13:23 How the bug works16:31 A warning from 1972, and decades of secrecy19:00 Aleph One and Smashing the Stack23:11 StackGuard and the Spartans24:18 Thirty years of defenses29:34 NotPetya31:36 AI changes the map33:40 Why the bug survives Referenced in this episode James P. Anderson, Computer Security Technology Planning Study, Volume II (October 1972), the volume with the description quoted in the episodehttps://seclab.cs.ucdavis.edu/projects/history/papers/ande72.pdf Aleph One, “Smashing the Stack for Fun and Profit,” Phrack 49 (1996)https://phrack.org/issues/49/14.html CISA and partners, The Case for Memory Safe Roadmaps (December 2023)https://www.cisa.gov/resources-tools/resources/case-memory-safe-roadmaps Yael Grauer, Future of Memory Safety: Challenges and Recommendations, Consumer Reports (January 2023)https://innovation.consumerreports.org/Memory-Safety-Convening-Report-.pdf Nicole Perlroth, This Is How They Tell Me the World Ends (Bloomsbury, 2021)https://en.wikipedia.org/wiki/This_Is_How_They_Tell_Me_the_World_Ends CreditsThe Bug We Let Live is a production of the Software Safety Institute, with generous support from Cyber Florida. Produced by Sarina Gandy. Co-produced by Rex Wilson. Learn more at softwaresafety.org.
