4 ms·
TL;DR - the ending of the post is all you need: “JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to
by ttul 5y ago
TL;DR - the ending of the post is all you need:
“JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent.
The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying.”
- EvanAnderson 5y agoThis one will be another talking point right beside the "arbitrary code execution in SNES games via controller inputs" as a rebuke to arguments about even small systems (like an image decompressor) being "made secure". I also keep thinking "The Cylons would totally write an exploit like this."
- throw0101a 5y ago> I also keep thinking "The Cylons would totally write an exploit like this." Reminder that the Cylon attack was an insider job in the rebooted series (from a model Number Six).
- NikolaeVarius 5y agoDo we know for a fact the NSO group are in fact NOT Cylons?
- johndoughy 5y agoThey must have spent tons of engineering effort to create this virtual computer to act as their foundation for further exploits. They don't deserve any sympathy of course, but it must really suck that their foundation disappears immediately with the fixed vulnerability.
- MutableLambda 5y agoI suspect once written it can be adapted to a wide range of Turing complete instruction sets.
- markus_zhang 5y agoI actually think you can write and test a NAND gate solution in any external environment that is much easier for development and testing (say plain C on Linux),and then transpile it into any other turing complete arch. Actually this could be a really interesting project to work on: 1) Write a VM in C and 2) Write a transpile program for another turing complete arch.
- saagarjha 5y agoYou should read the entire post.