Bypassing HIDS - Stack Protection Stackguard –A 'canary' is placed next to return address –Program halts and logs if canary is altered –Canary can be random or terminating –Bypass: overwrite return address without touching canary –Fix: XOR the return address and the canary –Point: Yet another example of an arms race
{}