3 ms·
Are these meta programs (running on virutal turing machines made of symbolic circuits within programs) effectively able to only arrange the base program's heap,
by motohagiography 4y ago
Are these meta programs (running on virutal turing machines made of symbolic circuits within programs) effectively able to only arrange the base program's heap, and still need an overflow somewhere in the base program to break out of the base program's sandbox?
I remember this technique being used in the wild and described by google's TAG group in a recent paper, but this part about how it goes from toy virtual machine within the base program to a sandbox escape didn't land for me.
- scatters 4y agoYes, but a weird machine program may be able to turn an extremely unlikely exploit into a guaranteed one; for example rowhammer, or heating up the hardware to induce bit flips, or simply making enough vulnerable objects that when a "cosmic ray" bit flip eventually occurs, it will immediately result in a breakout. Or purely in software, by arranging for hash collisions that would be prohibitively unlikely to occur in a normal execution. Even if it can't achieve breakout, a weird machine program may still be able to observe its host and leak information to an attacker-controlled server via timing attacks. I think the ExSpectre attack mentioned near the end is related to this.
- saagarjha 4y agoThe interesting part there was using the Turing machine to gain the ability to set up program stare reliably for the sandbox escape.