3 ms·
Based on what Justin said, it sounds like what they tried to add is a defense against JIT spray attacks, not just a detector, which, if effective, would actuall
by othermaciej 15y ago
Based on what Justin said, it sounds like what they tried to add is a defense against JIT spray attacks, not just a detector, which, if effective, would actually be pretty valuable. JIT spray attacks are pretty dangerous, because they defeat many of the usual protections against exploiting buffer overflows for code execution (e.g. DEP and ASLR on Windows). So it certainly would be valuable to try to defend against these kind of attacks, if that is what the Chrome folks were doing.
Apparently it was not effective in the end, but we may never know, since VUPEN doesn't plan to disclose how they escaped the Chrome sandbox.
- justinschuh 15y agoYeah Maciej, that's the gist. The VUPEN guys told us it was effective at preventing the JIT spray, so they used an information leak to bypass ASLR/DEP.