Four bytes are used by programmers to terminate string operations. They can also check these bytes when a function returns to see if an attempt has been made to overwite them, if so, an alert can be generated and a message sent to syslog. These are called the "Canary Bytes".
If a message does show up in syslog indicating a problem, what happened?
A) An overflow has been attempted
B) A overflow was succesful
C) The stack has crashed
D) The host based IDS caught the event

Question

Quizplus · Accepted Answer

The idea is to be able to halt the operation of a program and tell the programmer why. This is a tricky question because the attack was certainly attempted, and succesful in the sense that the canary bytes were overwritten, but that is not the objective of the attacker. Hopefully, the program halted before the shellcode was able to launch.

Four Bytes Are Used by Programmers to Terminate String Operations