Federico Bento @uid1000

Joined November 2016

Tweets

540
Followers

940
Following

64
Likes

598

Federico Bento @uid1000

5 years ago

Today I learned that a memory corruption vulnerability may not be considered a memory corruption vulnerability

1 0 0 0 0

View Details

Federico Bento @uid1000

5 years ago

@osxreverser @Balgan @lgrangeia you can give your two cents on this :P

1 0 0 0 0

View Details

Federico Bento @uid1000

5 years ago

@Balgan @osxreverser sure, in that case i guess you shouldn't be doing it :)

1 0 0 0 0

View Details

@buherator @pwntester Exceptions usually log info for e.g., debugging purposes, which can potentially be vulnerable to log4shell. You should attempt triggering exceptions to hopefully hit the vulnerable code path.

0 0 0 0 0

View Details

Federico Bento @uid1000

5 years ago

@osxreverser @qrs what's the anti-debugging trick?

0 0 0 0 0

View Details

Federico Bento @uid1000

6 years ago

@osxreverser Considering the qualys post detailed exploitation steps, it still took several days

0 0 0 0 0

View Details

Federico Bento @uid1000

6 years ago

Looking at a private version of PaX/grsec from the 2nd half of this year, there's no probabilistic xor cookie retaddr protection for the 'iret' insn case. I'm not saying it can't be done & I'm also not saying it isn't implemented in some later or exotic commercial version.

0 0 1 0 0

View Details

Federico Bento @uid1000

6 years ago

x.com/spendergrsec/s… It is an issue. I was specifically told that CAP_SYS_ADMIN -> kernel code exec via code ptr overwrites was within RAP's threat model. "It's less useful" doesn't really stand since otherwise RAP is just as useless in the presence of data-only attacks.

0 0 0 0 0

View Details

Federico Bento @uid1000

6 years ago

x.com/spendergrsec/s… RAP_XOR was added, apparently, on March 11 2020. My work was published on September 2019, so my case still stands. The attack worked at the time, it's that simple.

1 0 0 0 0

View Details

Federico Bento @uid1000

6 years ago

Because I'm blocked and can't answer brad's tweets directly in the thread, here it goes:

1 0 1 0 0

View Details

Federico Bento @uid1000

6 years ago

Refs: x.com/grsecurity/sta… x.com/paxteam/status…

PaX Team @paxteam

7 years ago

@uid1000 section 3.3 is even worse. it shows an 'exploit' by changing memory directly from gdb. it only shows you couldn't even find a real bug or create one yourself to do it for real. second, you missed the fact that the xor cookie defense applies to all return addresses, iret included.

1 0 0 0 0

0 0 0 0 0

View Details

Federico Bento @uid1000

6 years ago

Alternatively, there's also no probabilistic xor cookie retaddr protection in any of the versions for either 'ret' or 'iret' insns as claimed.

2 0 1 0 0

View Details

Federico Bento @uid1000

6 years ago

Not trying to add fuel to the fire here, but I just got a hold of the private versions of PaX/grsec (one version is a few months before & the other a few months after my work). In the later version the executable .rodata issue is fixed. I was told it was a 'known' 'non-issue'.

4 0 6 0 0

View Details

Federico Bento @uid1000

6 years ago

@osxreverser Nah, there might be someone else out there who needs it more than I do :P

0 0 0 0 0

View Details

Federico Bento @uid1000

6 years ago

Talking about bruised egos, apparently a certain someone decided to throw a tantrum and block me because he just got nominated for the Lamest Vendor Response award... Isn't it ironic? Good riddance!

2 0 3 0 0

View Details

Federico Bento @uid1000

6 years ago

@osxreverser But did you drink the martini and wodka?

0 0 0 0 0

View Details

Federico Bento @uid1000

6 years ago

@jvanegue @gannimo @robertgraham Security by obscurity means the security of a system relies on its implementation details being secret, no more no less. ASLR is not security by obscurity, nor is modern crypto.