I am not sure you can explain a buffer overflow bug that easily to a layman. That's still a trivial bug for a developper. Most of the products involved in recent financial scandals are relatively simple to finance professionals. The problem was rather pretty much always a gross under estimation of the underlying risk combined with excessive leverage.
"Imagine if I told you to go to the file cabinet and remove the 8th folder in the Mason file. Well, it turns out that the Mason file only has five folders, and neither of us were careful to think about the boundaries. So you go and count off seven folders after the first Mason, but then end up grabbing a folder that's three into the Mitchell file.
"The data on a computer is organized into ordered bytes like the file cabinet, and telling a program to go to some byte's location plus some offset can result in it accessing data that it shouldn't touch, if other safeguards aren't in place."
"Ok, so say I need you to go and put this note of death at the end of the Mason file; that would be the 20th folder. You go to the drawer, count up to 19 from the first Mason folder and put the note there. You just ended up declaring Mr. Moriarty dead. Mr. Łeldon here will be processing credit card applications later in the afternoon; I'm pretty sure that Mr. Moriarty isn't going to get his now.
This is the way one uses the 'buffer overflow' problem in computers to manipulate data. With a little skill you can use it to do serious damage. Consider, for instance, what would happen if we were at an engineering company and slipped in a new blueprint for a machine instead of a personell note. Later someone else would pick up the design and the factory, none the wiser, would proceed to build our machine, instead of the one they wanted.
I don't buy the "you wouldn't understand" either. Here are simple explanations of a buffer overflow:
- We agree I'll give you max 1L of water, so you prepare a 1L bucket. Then I pour 2L of water into your bucket - you end up with a mess. (exploit version: We agree that if any water hits the ground, I can force you to do anything.)
- I give you card with typical form to fill in (squares for every letter). First 5 squares are for first name, next 5 are for last name. You fill in "Michael" as your first name overflowing into last name space.
- etc...
Sure, it doesn't capture all intricacies of the mechanism, implementation, side effects of the overflow, etc. But don't tell anyone they wouldn't understand the concept.
