4 ms·
Blows my mind that there’s people who figure this stuff out. Do they just spend their day to day time at work attempting all sorts of variations of this kind of
by eljimmy 8y ago
Blows my mind that there’s people who figure this stuff out. Do they just spend their day to day time at work attempting all sorts of variations of this kind of stuff? How often does discovery or research like this lead to a dead end?
- dekhn 8y agoThey tend to be really smart and motivated people. For example, http://lcamtuf.coredump.cx/gcnc/ http://lcamtuf.coredump.cx/gcnc/ is not just a good guide to CNC, it's an amazing guide where you realize he learned half the unwritten rules just by thinking about them. http://lcamtuf.coredump.cx/rstory/ http://lcamtuf.coredump.cx/rstory/ for the robots.
- amelius 8y agoThat seems like a good pointer, but what does CNC milling have to do with finding bugs in a virtual memory system?
- blinkingled 8y agoThe learning process. No one is teaching you how to find bugs in VM subsystem.
- dekhn 8y agoThe author lcamtuf is a well-known security engineer and I was explaining, indirectly, that he's just inherently super-smart and curious and spends a ton of time figuring things out.
- monocasa 8y ago> Do they just spend their day to day time at work attempting all sorts of variations of this kind of stuff? Yep. > How often does discovery or research like this lead to a dead end? Orders of magnitude more than the successful paths these days.
- onemoresoop 8y agoApple pays handsomely for bugs, they have a bug bounty program (1). At some point there are fewer and fewer exploits and the system becomes harder to crack. All companies who care about security should have security bounty programs. https://motherboard.vice.com/en_us/article/qvapxq/apple-iphone-bug-bounty-payments https://motherboard.vice.com/en_us/article/qvapxq/apple-ipho...
- giobox 8y agoSo long as it’s an iOS bug of course... the situation with macOS is pretty absurd.
- londons_explore 8y agoSince this is Project Zero, the author has a salary and isn't allowed to collect the rewards. I'm guessing the salary must be higher than the rewards or they wouldn't do it tho.
- hanklazard 8y agoIt's completely amazing to me too. As I understand it, one of the tools that the security research community uses is fuzzing (https://en.wikipedia.org/wiki/Fuzzing https://en.wikipedia.org/wiki/Fuzzing). I can at least understand how this sort of technique would help generate some leads. I'd recommend the Security Now podcast by Steve Gibson if you're interested in this sort of thing. He does a great job explaining many of the exploits out there.
- killjoywashere 8y agoSecurity Now ... woah ... didn't realize GRC was still around. I remember visiting ShieldsUP in the 90s. Site looks the same. More content, but the design has not changed. Those are some old gifs.
- jmeyer2k 8y agoThey know where to look.
- gok 8y agoPresumably they have a large catalog of exploits that they sit on until they have an interesting exploit chain.
- londons_explore 8y agoThey often need some exploits to get the unencrypted kernel in the first place for analysis. If they were to reveal those exploits, they wouldn't be able to find any more exploits in the future.
- gok 8y agoGenerally true, although the kernel is now unencrypted by default.
- baybal2 8y agoWhen all software was in C and C++, that was rather common. I'd say there are less people today in the industry that can find out simplest assembler level exploits than it was at the peak of malware scene 15 years ago.
- londons_explore 8y agoIf you leave Ian Beer for even 5 minutes at a bus stop, he'll start poking the internals of the XNU kernel...