2 ms·
I'm always impressed by Google's Project Zero team, but I'm also impressed by abilities of the implementer(s). What's interesting is that (for most of these ca
by iandinwoodie 7y ago
I'm always impressed by Google's Project Zero team, but I'm also impressed by abilities of the implementer(s).
What's interesting is that (for most of these cases) I find that I can understand the process of the reverse engineering, but I am completely stupefied as to the process of the initial implementation. I understand finding relatively superficial vulnerabilities (e.g., an SQL injection attack [1]), but I don't understand how these vulnerabilities are found when they are so many layers deep.
If anyone has an insight I would really appreciate it.
1. https://xkcd.com/327/ https://xkcd.com/327/
- htfu 7y agoI mean that's the thing, they're layers deep but those layers can largely be approached individually, and swapped as needed. You don't have to wait until you find a JS exploit to start work on a payload achieving further privilege escalation, you use existing development tools and privileges. And what's really so different in concert between SQL injection and the lack of proper checks on the binary data header field in the beginning of the first post? One of the latter posts in the linked series goes through how the initial stage stuff is in one case taken verbatim from the JS test case in the webkit commit fixing the bug (and only reaching users months later). (Not at all saying it's not incredibly impressive or that I could do any of it, haha)