Federico Bento retweeted
I liked the blog but this tweet is pretty dramatic. kASLR was vulnerable to timing attacks prior to Meltdown and we explicitly documented that our Meltdown mitigation does not attempt to solve kASLR. kASLR was never safe from timing attacks nor should anyone have expected it was.
Federico Bento retweeted
Cool writeup exploiting FreeBSD bhyve. Nice to see the same points from other platforms repeat here:
- CFI makes more exploits leak the stack && do ROP (it's easy)
- RFG/SafeStack/whatever in software is weak, many ways to leak the shadow stack address
phrack.org/papers/escaping_f…
Federico Bento retweeted
Interesting facts about 'exec_id' - almost all Linux kernels insufficiently restrict exit signals (except 2.0.39 and 2.0.40 ;-))
blog.pi3.com.pl/?p=697
Federico Bento retweeted
Let's try kernel stack base offset randomization again! :) lore.kernel.org/lkml/2020032…
Federico Bento retweeted
New blog post on Hardware-enforced Stack Protection in Windows 10 from the Windows kernel team (@TheRealHariP & @mamyun)
Support is in WIP fast ring builds if/when you have a CPU that supports CET :)
techcommunity.microsoft.com/…
Federico Bento retweeted
Free knowledge! 🔥 We have a new blog post ready, which discloses an unfixed Linux UserLAnd ASLR bypass. Read here: bit.ly/2ULoj97
--
#cybersecurity #informationsecurity #linux #ASLR #alwayskeeplearning #wildfire #goblaze
Federico Bento retweeted
ICYMI RAP bypass for root -> kernel exploits on grsec. I did find the angry grsec/PaX replies entertaining too. Remember when grsec had to pay out a quarter mil because he couldn't handle critique?
H/T @silviocesare
nitter.gq/uid1000/status/1172487…
theregister.co.uk/2018/06/11…
"Control-Flow Integrity for the Linux kernel: A Security Evaluation" is the work I've done for my Masters thesis where I analyze how the PaX Team's (public) RAP holds up to stop ROP when applied to the Linux kernel. You may want to check out chapter 3.
alunos.dcc.fc.up.pt/~up20140…
Federico Bento retweeted
Just read/skimmed your thesis on Linux CFI. Wow. This is great. Many new techniques that have opened up my eyes to the possibilities.
Federico Bento retweeted
A Linux kernel CTF task that relies on a double-fetch/data-race introduced by the compiler for exploitation: rpis.ec/blog/tokyowesterns-2…
Federico Bento retweeted
Paged Out! #1 is out! (and it's free to download!)
pagedout.institute/?page=iss…
There are 57 articles in 12 categories:
Electronics
Programming
Assembly
Reverse Engineering
Sec/Hack
Retro
File Formats
Algorithmics
SysAdmin
Radio
Phreaking
OS Internals
Enjoy! #PagedOut!
Federico Bento retweeted
[BLOG] CVE-2018-6924: FreeBSD ELF Header Parsing Kernel Memory Disclosure by @fdfalcon blog.quarkslab.com/cve-2018-…
Federico Bento retweeted
From our 4.4 port, one of the many security fixes the upstream kernel is missing (see: seclists.org/oss-sec/2019/q2…) Note no stable cc for the silent vuln fix from Linus, silent enough that it wasn't backported to upstream 4.4. #grsecurity unaffected yet again
Federico Bento retweeted
Well, while *ASLR* was first publicly implemented by PaX, memory layout randomization was also discussed before ASLR. Even though their not the same, one might think that was a step towards PaX ASLR.
Federico Bento retweeted
Long thread time: So most of you know me (Brad) from my grsecurity/Linux work, which had previously been done in my free time. Only a few people (other than those that followed a particular github account) know of my non-free-time work for the past 14 years.
Federico Bento retweeted
Want a full support from me in a talk submission on exploit writing?@BlackHatEvents #BHUSA : A practical demonstration against a real life (and relevant) software running in a properly hardened grsec/PaX system @grsecurity @paxteam (guaranteed slot @h2hconference as well).
Federico Bento retweeted
Not sure what it says about the state of Linux kernel security that nobody followed up about a potentially critical vuln in 2 weeks, only to repeat what I said two weeks ago already that there was none: seclists.org/oss-sec/2019/q1… nitter.gq/grsecurity/status/1088…
Not seeing the vuln here: seclists.org/oss-sec/2019/q1… as the commit even mentions, the copy_from_user will have performed the access_ok() over the same range. Regardless, for grsecurity customers (who now are all running with UDEREF), these kinds of vulns are unexploitable
Federico Bento retweeted
Abertas as inscrições para a 3ª edição do Prémio de Mérito AP2SI ap2si.org/2019/02/01/abertas…
Federico Bento retweeted
I suspect this screenshot I found in the Snowden docs a while back will end up being NSA's GHIDRA: nitter.gq/rsesek/status/55664828…
Interesting thread about a reverse engineering IDA-like tool the NSA are apparently planning to open source soon. Fingers crossed this shakes up the RE ecosystem 🤞🏻reddit.com/r/ReverseEngineer…