3 ms·
Vulnerabilities once you have access to the machine are not really worth spending time on because servers should rely on shell hardening and clients should not
by bullen 5y ago
Vulnerabilities once you have access to the machine are not really worth spending time on because servers should rely on shell hardening and clients should not be trusted anyway.
What we need is ways to avoid the kernel for networking memory, I figured Oracle would have realized this for Java by now but they are dragging their feet!
- fulafel 5y agoWhat do you mean by "shell hardening"? In general the shell is not really a security critical component that would give big payoffs to harden.
- rocqua 5y agoI presume he meant "defend the perimteter, and they never get execution, so there is no need to defend the inside against privilege escalation". The opposing line of thought is defense in depth. The idea being that "a hard shell but soft and mushy on the inside" is a fragile setup and only needs one thing to go wrong.
- AlexAltea 5y ago> Vulnerabilities once you have access to the machine are not really worth spending time on That's absolute nonsense. There's so many platforms, Android/iOS, where applications are compartmentalized: local privilege escalation (LPE) vulnerabilities is what enables a rogue application (or remote code execution into one, such as a browser/chat), into full control of the device and its data. Sometimes LPEs are needed to achieve some level of persistence. In VMs, a guest LPE is frequently needed to interface (and exploit) directly the emulated/paravirtualized devices and VM-escape into the host OS. Yes, it is a big deal.