5 ms·
A better link is the research paper: https://arxiv.org/abs/2105.02124 https://arxiv.org/abs/2105.02124 > The universal Turing machine is generally considered
by segfaultbuserr 5y ago
A better link is the research paper:
https://arxiv.org/abs/2105.02124 https://arxiv.org/abs/2105.02124
> The universal Turing machine is generally considered to be the simplest, most abstract model of a computer. This paper reports on the discovery of an accidental arbitrary code execution vulnerability in Marvin Minsky's 1967 implementation of the universal Turing machine. By submitting crafted data, the machine may be coerced into executing user-provided code. The article presents the discovered vulnerability in detail and discusses its potential implications. To the best of our knowledge, an arbitrary code execution vulnerability has not previously been reported for such a simple system.
> A common strategy for understanding a problem is to reduce it to its minimal form. In the field of computer security,we may ask the question: "What is the simplest system exploitable to arbitrary code execution?" In this article, we pro-pose an answer to that question by reporting on the discovery that a well-established implementation of the universal Turing machine is vulnerable to a both unintentional and non-trivial form of arbitrary code execution.
- Igorvelky 5y agoLIES > A common strategy for understanding a problem is to reduce it to its minimal form. In the field of computer security,we may ask the question: "What is the simplest system exploitable to arbitrary code execution?" means that i will remove all security abstractions which were generated in past 40 years and i find that it is more vulnerable this is not research, this is plain and simple trolling, BS feeding
- OskarS 5y agoHaven't looked into this paper deeply, but this reads very strange to me: > This paper reports on the discovery of an accidental arbitrary code execution vulnerability in Marvin Minsky's 1967 implementation of the universal Turing machine. By submitting crafted data, the machine may be coerced into executing user-provided code. It's a universal Turing machine. Its whole purpose is running "user-provided code". That's what a Universal Turing machine does, it runs arbitrary Turing machines. This is a little bit like saying "we found a weakness in the Python interpreter whereby you can feed it specially crafted input that allows you to run arbitrary Python programs". Like... yeah... that's what it's supposed to do.
- qsort 5y agoYes, that's the joke.
- mycall 5y agoWait until they try unicode, then the joke will be on them.
- AreYouSirius 5y agoreddit is saying that macos is build on turing complete emojis ! we should investigate XD
- jradd 5y agoI cannot fathom how complicated arbitrary code execution could get with multi byte characters that could use shift registers, null bytes and byte order marks with determinism in a NOP slide on a heap spray. Filtering only printable user input helps but even bit map images can expose a heap to a sensitive registers that will execute some target specific generated shell code. https://en.m.wikipedia.org/wiki/NOP_slide https://en.m.wikipedia.org/wiki/NOP_slide. https://en.m.wikipedia.org/wiki/Heap_spraying https://en.m.wikipedia.org/wiki/Heap_spraying
- OskarS 5y agoI get that the CVE is a joke, but are you saying the paper is as well?
- AreYouSirius 5y agoi dont know if he says exactly that by i do say exactly that paper is essentially saying that by using simplest machine possible we prove it does not provide layers of security abstractions which were invented and deployed in last 40+ years to computers so thats like getting CVE for turning off ASLR, AppARMOR SElinux etc in linux kernel.
- qsort 5y ago