5 ms·

- Fuzzers are (most of the time) a great bug finder, - Random bugs that someone reported leading to something bigger, - You already know the software well eno

• Jyaif 9y ago
  Finding 6 vulnerabilities you can chain is about very hard work, not luck.
  • guessmyname 9y ago
    I am referring to "luck" on finding the "initial" bug, obviously the rest is hard work.
    • rodjun 9y ago
      Why would one be luck and all the others skill?
• arielb1 9y ago
  From the outside, it feels that most exploit chains on modern systems rely on 4 mostly-independent steps: 1. code execution in a worker process - typically a memory corruption 2. ACE in worker process to ACE in unsandboxed process 3. code execution in unsandboxed process to local root 4. local root to persistence Finding (1) (3) and (4) is old-school exploit development - a combination of looking at fuzzers, looking at code, looking at bug reports, and memory exploit development (which is a black art I'm not familiar with). So persistence and luck. Be lucky 3 times and you have 3 steps. If you were an organization I suppose you could have 3 separate groups or buy from 3 separate blackhats. I'm less familiar with the "worker process to user process" part, which tends to rely on combining a few vulnerabilities (in this exploit, 2 + 1 broken hardening), but it's probably similar.