Tim Newsham
More info
- Affiliation
- Secure Networks, Guardent
- Known for
- IDS evasion, format string attacks
Co-author of the 1998 paper showing that an intrusion detection system can be shown a different reality from the one the target sees.
Newsham wrote "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection" with Thomas Ptacek at Secure Networks. A network IDS has to guess how each receiver reassembles the stream, and with overlapping fragments and carefully chosen TTL values it guesses wrong. The paper is the reason modern sensors normalise traffic before they go looking for signatures.
In 2000, at Guardent, he wrote one of the first comprehensive treatments of format string attacks: when user input ends up as the format argument to printf, %n lets an attacker write to arbitrary memory. The bug class had existed for decades; nobody had read the man page closely enough.