Much of transient execution research over the years has been invalidated or was complete bogus to begin with. It was extremely easy to get a paper into a conference for a while (and frankly still is) just by throwing in…
It's not that simple. The problem is not just branches but often the intersection of memory and branches. For example, a really powerful technique for amplification is this: ldr x2, [x2] cbnz x2, skip /* bunch of slow…
This is an idea many have had before but it doesn't quite work. When you do this, you tend to lose all the performance gained from speculative execution. It's essentially data-independent-timing as applied to loads and…
Modeling programs as circuits also makes them significantly easier to formally verify too! These sorts of synthesis tools are really cool, though writing traditional software in them is extremely painful.
My favorite is when the codebase is so deeply buried in macros and headers that send you on a wild goose chase to find any actual code that it becomes much easier to just dump the binary in ida/binja. The source code…
My sad related factoid to this is that suicide overtook car accidents as the leading cause of death of teenagers in Colorado. This is because although suicide is a worsening problem, crash safety and driver education…
RISC is not about the number of instructions but rather what the instructions do. The famous example of CISC gone to its logical extreme is the VAX's polynomial multiply instruction, which ended up being almost a full…
It is fairly different from a systems programming perspective. The base instructions (I) are essentially everything you'd expect when writing any kind of regular program and it feels very normal and natural for anyone…
For all those learning (or even those who've learned :P), my favorite cheatsheet that I always pull up while writing ARMv8-A assembly is this one [1] from the University of Washington. ARMv8-A has a lot of fairly…
Have you actually benchmarked a context switch on modern hardware? A full switch (including register spilling and page table swap) can be had in <150 cycles on even cheap, older Arm A-series cores like the Cortex A72.…
> There's a video on YouTube where a hobby scientist takes a cup of water and doses it with an incredibly potent poison Cody'sLab Drinking Cyanide <https://www.youtube.com/watch?v=i6hOVhQQ9h>. Apparently it was removed…
Do you know what they did on holidays? Did they just never close for any reason whatsoever?
It is still mortifying to have a photo of you sitting on the toilet with your shorts down even if your face is blurred out. Yes, the damage has already done and this made the article even more compelling, but I don't…
Especially seeing as you can outright have a full, tiny VPS 24/7 for $2.50/mo or $30/yr from Vultr. I suppose there's a value add in terms of not necessarily needing to setup your own install, but if that's something…
Take your choice of other random SBCs off Aliexpress for $30-40. They all run Linux well enough for headless, short cronjobs.
remind me of a couple of different crumby """anti-cross-site-scripting""" filters you used to be able to find. They claimed that they'd remove dangerous input so that it would never hit your backend. They did this by…
One of the key points he makes is that this is now an entrenched problem. SoC designers looked to Linux and asked "hey, can you drive the power management stuff?" and got no real help and so instead just built it out of…
I don't know, I've heard so many stories of people that, after 90+ years, are just bored of life. It's unimaginable to me now but I've only been an adult for a small fraction of the time they've been and so maybe you…
Would this change though if they were out of reach of the apple App Store? The "ask app not to track" feature is a component of the OS. The only difference is then that Facebook would be allowed to violate the user's…
You would hope but to a large extent SMMUs are still not meaningfully deployed in consumer smartphones. Even when they do exist, the bounding enforced upon them are so expansive that it's essentially pointless. For…
I don't believe these mitigations are fixable, they are based on a fundamental misunderstanding of how people actually write exploits and what attackers are capable of. The issue is that it is extremely hard to try and…
The question we have to ask ourselves is whether OpenBSDs mitigations are taking away enough attack surface (or in this case, exploitation tools) to make it worth the engineering and user cost. I'd argue that things…
So just ROP to the syscall you want in libc. Instead of targeting the syscall instruction, directly call mmap. System call randomization is a feature designed to discourage legitimate software from hardcoding syscall…
If you've managed to map shellcode at all, you necessarily already know where a valid syscall instruction is since otherwise you would not have been able to trigger the mmap syscall to map the shellcode. In any event,…
I believe I should have couched that statement with a "for most everyone else" :) The PPL is a strong mitigation, I agree, but it is definitely one that is really only supported through their ability to ship custom…
Much of transient execution research over the years has been invalidated or was complete bogus to begin with. It was extremely easy to get a paper into a conference for a while (and frankly still is) just by throwing in…
It's not that simple. The problem is not just branches but often the intersection of memory and branches. For example, a really powerful technique for amplification is this: ldr x2, [x2] cbnz x2, skip /* bunch of slow…
This is an idea many have had before but it doesn't quite work. When you do this, you tend to lose all the performance gained from speculative execution. It's essentially data-independent-timing as applied to loads and…
Modeling programs as circuits also makes them significantly easier to formally verify too! These sorts of synthesis tools are really cool, though writing traditional software in them is extremely painful.
My favorite is when the codebase is so deeply buried in macros and headers that send you on a wild goose chase to find any actual code that it becomes much easier to just dump the binary in ida/binja. The source code…
My sad related factoid to this is that suicide overtook car accidents as the leading cause of death of teenagers in Colorado. This is because although suicide is a worsening problem, crash safety and driver education…
RISC is not about the number of instructions but rather what the instructions do. The famous example of CISC gone to its logical extreme is the VAX's polynomial multiply instruction, which ended up being almost a full…
It is fairly different from a systems programming perspective. The base instructions (I) are essentially everything you'd expect when writing any kind of regular program and it feels very normal and natural for anyone…
For all those learning (or even those who've learned :P), my favorite cheatsheet that I always pull up while writing ARMv8-A assembly is this one [1] from the University of Washington. ARMv8-A has a lot of fairly…
Have you actually benchmarked a context switch on modern hardware? A full switch (including register spilling and page table swap) can be had in <150 cycles on even cheap, older Arm A-series cores like the Cortex A72.…
> There's a video on YouTube where a hobby scientist takes a cup of water and doses it with an incredibly potent poison Cody'sLab Drinking Cyanide <https://www.youtube.com/watch?v=i6hOVhQQ9h>. Apparently it was removed…
Do you know what they did on holidays? Did they just never close for any reason whatsoever?
It is still mortifying to have a photo of you sitting on the toilet with your shorts down even if your face is blurred out. Yes, the damage has already done and this made the article even more compelling, but I don't…
Especially seeing as you can outright have a full, tiny VPS 24/7 for $2.50/mo or $30/yr from Vultr. I suppose there's a value add in terms of not necessarily needing to setup your own install, but if that's something…
Take your choice of other random SBCs off Aliexpress for $30-40. They all run Linux well enough for headless, short cronjobs.
remind me of a couple of different crumby """anti-cross-site-scripting""" filters you used to be able to find. They claimed that they'd remove dangerous input so that it would never hit your backend. They did this by…
One of the key points he makes is that this is now an entrenched problem. SoC designers looked to Linux and asked "hey, can you drive the power management stuff?" and got no real help and so instead just built it out of…
I don't know, I've heard so many stories of people that, after 90+ years, are just bored of life. It's unimaginable to me now but I've only been an adult for a small fraction of the time they've been and so maybe you…
Would this change though if they were out of reach of the apple App Store? The "ask app not to track" feature is a component of the OS. The only difference is then that Facebook would be allowed to violate the user's…
You would hope but to a large extent SMMUs are still not meaningfully deployed in consumer smartphones. Even when they do exist, the bounding enforced upon them are so expansive that it's essentially pointless. For…
I don't believe these mitigations are fixable, they are based on a fundamental misunderstanding of how people actually write exploits and what attackers are capable of. The issue is that it is extremely hard to try and…
The question we have to ask ourselves is whether OpenBSDs mitigations are taking away enough attack surface (or in this case, exploitation tools) to make it worth the engineering and user cost. I'd argue that things…
So just ROP to the syscall you want in libc. Instead of targeting the syscall instruction, directly call mmap. System call randomization is a feature designed to discourage legitimate software from hardcoding syscall…
If you've managed to map shellcode at all, you necessarily already know where a valid syscall instruction is since otherwise you would not have been able to trigger the mmap syscall to map the shellcode. In any event,…
I believe I should have couched that statement with a "for most everyone else" :) The PPL is a strong mitigation, I agree, but it is definitely one that is really only supported through their ability to ship custom…