5 ms·

I wouldn't say it backfired, but after releasing we did discover that some Flash obfuscators used on games behave almost identically to a JIT spray attack. This

I wouldn't say it backfired, but after releasing we did discover that some Flash obfuscators used on games behave almost identically to a JIT spray attack. This is a shame because their obfuscation technique doesn't really add any value, but it does hurt performance, consume very large amounts of memory, and negatively impact stability. We've adjusted the detection to accommodate, and will make further adjustments as necessary.

ootachi 15y ago
If causing crashes isn't backfiring, then I don't know what is.
kevingadd 15y ago
In the future you should consider not adding code like this to your browser, since it doesn't really add any value either.
- othermaciej 15y ago
  Based on what Justin said, it sounds like what they tried to add is a defense against JIT spray attacks, not just a detector, which, if effective, would actually be pretty valuable. JIT spray attacks are pretty dangerous, because they defeat many of the usual protections against exploiting buffer overflows for code execution (e.g. DEP and ASLR on Windows). So it certainly would be valuable to try to defend against these kind of attacks, if that is what the Chrome folks were doing. Apparently it was not effective in the end, but we may never know, since VUPEN doesn't plan to disclose how they escaped the Chrome sandbox.
  - justinschuh 15y ago
    Yeah Maciej, that's the gist. The VUPEN guys told us it was effective at preventing the JIT spray, so they used an information leak to bypass ASLR/DEP.
daeken 15y ago
I'm curious as to how you're doing JIT spray detection. Do you have any info on this?
- js2 15y ago
  See the links from http://news.ycombinator.com/item?id=3689491 http://news.ycombinator.com/item?id=3689491 - the bug in particular has some helpful commit comments, then read through http://src.chromium.org/viewvc/chrome/trunk/src/webkit/plugins/npapi/webplugin_delegate_impl_win.cc?view=markup http://src.chromium.org/viewvc/chrome/trunk/src/webkit/plugi...

ootachi 15y ago

If causing crashes isn't backfiring, then I don't know what is.

kevingadd 15y ago

In the future you should consider not adding code like this to your browser, since it doesn't really add any value either.

othermaciej 15y ago
Based on what Justin said, it sounds like what they tried to add is a defense against JIT spray attacks, not just a detector, which, if effective, would actually be pretty valuable. JIT spray attacks are pretty dangerous, because they defeat many of the usual protections against exploiting buffer overflows for code execution (e.g. DEP and ASLR on Windows). So it certainly would be valuable to try to defend against these kind of attacks, if that is what the Chrome folks were doing. Apparently it was not effective in the end, but we may never know, since VUPEN doesn't plan to disclose how they escaped the Chrome sandbox.
- justinschuh 15y ago
  Yeah Maciej, that's the gist. The VUPEN guys told us it was effective at preventing the JIT spray, so they used an information leak to bypass ASLR/DEP.

daeken 15y ago

I'm curious as to how you're doing JIT spray detection. Do you have any info on this?

js2 15y ago
See the links from http://news.ycombinator.com/item?id=3689491 http://news.ycombinator.com/item?id=3689491 - the bug in particular has some helpful commit comments, then read through http://src.chromium.org/viewvc/chrome/trunk/src/webkit/plugins/npapi/webplugin_delegate_impl_win.cc?view=markup http://src.chromium.org/viewvc/chrome/trunk/src/webkit/plugi...