3 ms·

I'd guess it's not restricted to the /etc/shadow file and could leak the contents of "any" memory in the system - that is just used as an example that can be (r

by kimixa 3y ago

I'd guess it's not restricted to the /etc/shadow file and could leak the contents of "any" memory in the system - that is just used as an example that can be (relatively) easily searched for in memory due to having a rather unique pattern. I'm a little confused about the presentation of this - I think a fair bit of work has been put into the presentation and make it look "hacker" rather than actually required for the exploit, which doesn't fill me with confidence, but I guess we'll see when the actual description gets released. Like why is the shell loop re-building the exploit code? The output seems strangely character rate-limited but extremely even when if it was being rate-limited by the exploit itself I'd expect more noise if it relies on some probability to read the memory contents, and absolutely no description of the technique itself.

K0nserv 3y ago
> I'm a little confused about the presentation of this - I think a fair bit of work has been put into the presentation and make it look "hacker" rather than actually required for the exploit, which doesn't fill me with confidence, but I guess we'll see when the actual description gets released. > Like why is the shell loop re-building the exploit code? The output seems strangely character rate-limited but extremely even when if it was being rate-limited by the exploit itself I'd expect more noise if it relies on some probability to read the memory contents, and absolutely no description of the technique itself. This team has done stuff like this before, they were behind Retbleed[0], for which they released a similar style video[1], last year. I expect more details will follow after the USENIX Security Symposium. 0: https://comsec.ethz.ch/research/microarch/retbleed/ https://comsec.ethz.ch/research/microarch/retbleed/ 1: https://www.youtube.com/watch?v=dmSPvJxPm80 https://www.youtube.com/watch?v=dmSPvJxPm80

by kimixa 3y ago

K0nserv 3y ago

> I'm a little confused about the presentation of this - I think a fair bit of work has been put into the presentation and make it look "hacker" rather than actually required for the exploit, which doesn't fill me with confidence, but I guess we'll see when the actual description gets released. > Like why is the shell loop re-building the exploit code? The output seems strangely character rate-limited but extremely even when if it was being rate-limited by the exploit itself I'd expect more noise if it relies on some probability to read the memory contents, and absolutely no description of the technique itself. This team has done stuff like this before, they were behind Retbleed[0], for which they released a similar style video[1], last year. I expect more details will follow after the USENIX Security Symposium. 0: https://comsec.ethz.ch/research/microarch/retbleed/ https://comsec.ethz.ch/research/microarch/retbleed/ 1: https://www.youtube.com/watch?v=dmSPvJxPm80 https://www.youtube.com/watch?v=dmSPvJxPm80