4 ms·

Theres nothing wrong with presenting work at an intermediate stage. For instance, Chris Valasek and Charlie Miller presented their automotive research a year be

Theres nothing wrong with presenting work at an intermediate stage. For instance, Chris Valasek and Charlie Miller presented their automotive research a year before they could control cars remotely[0]. They cobbled together the primitives you'd need to build an exploit, thus proving it to be exploitable. That seems like a reasonable time to share your work to me. The title is provocative, but not to the extent which makes it clickbait. [0] https://www.youtube.com/watch?v=tnYO4U0h_wY https://www.youtube.com/watch?v=tnYO4U0h_wY

_Codemonkeyism 11y ago
Then I didn't made myself understandable. I didn't say that it is. The title of Chris talk is modestly worded as "A Survey of Remote Automotive Attack Surfaces" not "A root exploit of the car bus system and engine management?". I wanted to express that the title of the talk suggests that there exists something that is called Rowhammer.js that gives root access through the browser. And there isn't.
- fabulist 11y ago
  It takes more than an attention-grabbing headline to make something clickbait. There is no real financial incentive here; they gave their talk a provocative title so people would show up. There are not misrepresenting the facts; you can get root from JavaScript using Rowhammer, and they'll tell you how. Additionally, there is something called Rowhammer.js: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs
  - _Codemonkeyism 11y ago
    Again, I feel the need to represent the facts from the video for people stumbling over this thread (as of 2016/01): 1.) Rowhammer.js does not (yet) give root access through JS on a website, this is work in progress. The current Rowhammer JS script can create bit flips in DRAM lines. 2.) They do not show how to get root access with Rowhammer.js, they describe a scenario they are working on and that might work in the future, which involves getting access to memory pages with memory cached versions of scripts that someone might execute as root.

_Codemonkeyism 11y ago

Then I didn't made myself understandable. I didn't say that it is. The title of Chris talk is modestly worded as "A Survey of Remote Automotive Attack Surfaces" not "A root exploit of the car bus system and engine management?". I wanted to express that the title of the talk suggests that there exists something that is called Rowhammer.js that gives root access through the browser. And there isn't.

fabulist 11y ago
It takes more than an attention-grabbing headline to make something clickbait. There is no real financial incentive here; they gave their talk a provocative title so people would show up. There are not misrepresenting the facts; you can get root from JavaScript using Rowhammer, and they'll tell you how. Additionally, there is something called Rowhammer.js: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs
- _Codemonkeyism 11y ago
  Again, I feel the need to represent the facts from the video for people stumbling over this thread (as of 2016/01): 1.) Rowhammer.js does not (yet) give root access through JS on a website, this is work in progress. The current Rowhammer JS script can create bit flips in DRAM lines. 2.) They do not show how to get root access with Rowhammer.js, they describe a scenario they are working on and that might work in the future, which involves getting access to memory pages with memory cached versions of scripts that someone might execute as root.