9 ms·
I hacked macOS
- _chu1 3y ago[flagged]
- _rend 3y agoThis wasn't obvious to me from the appearance of the page (I guess my screen is large enough that I didn't see the arrows in the bottom-right corner), but this site is actually a presentation. So, a heads-up in case anyone else has the same experience: the page is interactive, and you can navigate with arrow keys.
- broodbucket 3y agoit's reveal.js for those unfamiliar https://revealjs.com/ https://revealjs.com/
- deleted 3y ago[deleted]
- zaxomi 3y agoOh, I didn't see it.
- tyingq 3y agoThe CVE description for some context (I re-ordered the sentences) "An app may be able to execute arbitrary code with kernel privileges. The issue was addressed with improved memory handling. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1."
- deleted 3y ago[deleted]
- Angostura 3y agoHugged to death?
- nullifidian 3y agohttps://youtu.be/hDek2cp0dmI?t=499 https://youtu.be/hDek2cp0dmI?t=499 the presentation with narration of the author.
- tjroer84 3y ago[flagged]
- saagarjha 3y agoNo. Number of CVEs has approximately no correlation with quality.
- ttt3ts 3y agoYea, internet is dumb sometimes. Here is some context on the often dumb world of CVE https://www.youtube.com/watch?v=2Mfgjp_aK3I https://www.youtube.com/watch?v=2Mfgjp_aK3I
- sushiburps 3y agoApple doesn't have "way fewer CVEs for macOS/iOS". Apple ranks 5th overall, and 4th so far in 2023, by vendor. In 2015 they were #1. CVEs track closely with the number of users a platform has, and the incentives to comprise that platform. https://www.cvedetails.com/top-50-vendors.php https://www.cvedetails.com/top-50-vendors.php
- howinteresting 3y agoYou got downvoted because you didn't consider for even a second the game theoretic result of judging products based on the number of CVEs they've had.
- d3w4s9 3y ago[flagged]
- irundebian 3y ago[flagged]
- quitit 3y ago[flagged]
- euiq 3y agothe whole vtuber thing is not really for me, but i appreciate the effort that went into this presentation—did you make it all the way to <https://asahilina.net/agx-exploit/#/demoslide https://asahilina.net/agx-exploit/#/demoslide>?
- deleted 3y ago[deleted]
- zamalek 3y ago[flagged]
- loeg 3y agoI mean, I disagree. It is gimmicky and poor communication, whether by choice or accident.
- quitit 3y agoIt is indeed poor communication - why? Because: 1. The message is secondary to the medium. 2. The communication requires numerous unnecessary click throughs to obtain the relevant information. 3. The division of the information into various panels and mediums does not enhance the communication, rather the messages are divided in a way that doesn't match a hierarchal introduction of detail. It often serves no purpose whatsoever. Also this is not some personal attack on identity "who she wants to be", it's a commentary on poor communication - don't attempt to equate the two, it's incredibly poor taste, and flame baiting.
- GhostWhisperer 3y ago[flagged]
- quitit 3y ago
- lexicality 3y agoI genuinely don't understand when I should be pressing down or right. Is there a linear way to view this?
- cassianoleal 3y agoPress space.
- codetrotter 3y agoRIP mobile users :'(
- phreack 3y agoYeah, I dislike comments on format but on mobile the site was just unusable for me. I couldn't figure out which slide was the "correct one" to move forward, and even the zooming gesture would move me to another slide. I think the video presentation would be a better link than the slides.
- deleted 3y ago[deleted]
- eviks 3y agoright for sections, down for subsections within a section, but 2d nav isn't great without a map :)
- dagmx 3y agoIt’s why I hate reveal.js It’s the most unintuitive mechanism unless you’ve already internalized what deck structures should be. It seems like it’s optimized for the presenter but it’s often used for after the fact sharing with everyone else who won’t know the order. It really needs a linear mode, with the option to see presenter notes.
- cassepipe 3y agoI clicked various times to the right, didn't make much sense. I came back, started clicking it down, now it made sense, until couldn't, so I clicked right. Then it clicked, took me something like ten seconds to figure it out, and I am not known to be quickest knife in the shed.
- jmull 3y ago[flagged]
- GhostWhisperer 3y agothe post title has a cve number you can search for here: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32947 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3294...
- saagarjha 3y agoIf you’re not willing to go through the slides that’s really your loss isn’t it?
- boxed 3y agoIt's clearly a slide deck for a conference presentation or something. So yea, it's terrible for a web page.
- donatj 3y agoI don’t think it’s a presentation. It’s multi dimensional. No one’s navigating multiple dimensions while presenting.
- dagmx 3y agoWhen presenting the reveal.js interaction model is to hit space or some other navigation key. I’m not defending it, because I legitimately think their multidimensional view is horrible for post facto sharing, especially on mobile. But it does mean that you can quickly navigate between chunks of the deck if you need to backtrack as a presenter.
- fh9302 3y agoLina received a $150k bounty for this exploit.
- jamesmunns 3y agoHell yeah, good for her!
- Razengan 3y agoHow does this work anyway? I reported a password bug that went unfixed for months and didn't hear back from Apple. Do you need to be the first/only person to have reported something, or what?
- dagmx 3y agoMost bug bounty payouts go to the first person or group that report it, and only if the bug in question is novel to the company in question. I.e if you report after someone else or report after it’s already been identified internally , you’re not likely to get a payout unless you have novel details
- sirodoht 3y agoSounds extremely low for this kind of vulnerability of a $2.7T company that prides itself for its privacy accomplishments.
- arghwhat 3y agoOn the other hand, that's a years salary for many people. Seems like a quite fair payment, and a payout to envy. Lower, easier to get payouts are arguably better than rare jackpot payouts you have to fight over...
- nicoburns 3y ago> On the other hand, that's a years salary for many people. It's several years salary for many people.
- voat 3y agoHonestly I loved the slide deck. I have little background in this, and I feel the author did a great job of breaking everything down. It clearly took aot of work. Bravo.
- m0d0nne11 3y ago[flagged]
- sMarsIntruder 3y agoAnd what about the YouTube video?
- loeg 3y ago[flagged]
- outloudvi 3y agoThe reveal.js slide itself probably isn't the best way for readers. The reveal.js project actually provides a PDF export feature which can be more helpful. Anyway, it's an asahilina.net page, not a cve.mitre.org page. That domain is for the Virtual YouTuber Lina-chan, so I would not expect it to be the most friendly for developers. As a VTuber follower, I do really like the style :D
- porbelm 3y agoI would classify Lina as excellent hacker and engineer first, VTuber second (but it is really just marcan's alter ego, innit?)
- deleted 3y ago[deleted]
- dang 3y agoAll: please don't post comments about the formatting of the presentation. It makes for tedious and off-topic discussion, and the HN guidelines specifically ask you not to: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
- yellow_lead 3y agoThe HN rules say > Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. Given that many are praising the formatting, I don't see how the rule applies. I'd like to point out that the slides have source available and use the reveal js slides framework, but I'm not sure if this would be considered as breaking the rules? Source for slides: https://github.com/asahilina/agx-exploit/tree/main/slides https://github.com/asahilina/agx-exploit/tree/main/slides
- deleted 3y ago[deleted]
- kubb 3y agoQuality content, highly recommended.
- 29athrowaway 3y agoFrom code comments, what I understood (most likely in an incorrect way) is: - Use Metal shader code to make process page table accessible to shaders via page protection layer bug exploited using return oriented programming (ROP) - Use Metal shader code to acquire read/write access to physical memory - Use Metal shaders to access the kernel page table - Deals with ASLR to find the kernel base address - Obtains process user credentials data structure via the process data structure (from the kernel memory) - Sets uid and gid to 0 (root) to the user credentials data structure, giving root privileges to the user
- dagmx 3y agoYou’re pretty much correct. GPUs are a very interesting attack vector. Especially as more computation is being pushed to GPUs, and they’re not always well isolated.
- zamalek 3y agoI'm genuinely concerned about the WebGPU attack vector. The possibilities are exciting, but we (everyone) has virtually no experience with securing them (compared to decades of securing x86 - which we still can't pull off). My biggest concern is fingerprinting.
- mmis1000 3y agoFingerprinting is probably inevitable if it is enabled by default. Given game code themselves relies on exact device model to workaround gpu implementation bugs. Gpu compatibility is always a shit show history that relies on all sort of device specific workarounds. You may spoof it. But don't assume it would work perfectly for any moderate to big sized programs.
- dagmx 3y agoI feel like fingerprinting is inevitable with any hardware access, including WebGL or WebGPU. It’s one of my big concerns about Chrome exposing more and more of the hardware it runs on in the goal of being a Web based OS. That said, fingerprinting is not as big a risk as what I was thinking of, which is one process being able to peer into another’s on the GPU. There are various takes on isolation on the GPU but they tend to have strong caveats attached.
- Topfi 3y agoOnce again, my respect for the work of the Asahi team and especially Linas GPU related efforts grows further. Great to see that she was officially recognized[0] and received a bounty for her efforts. [0] https://support.apple.com/en-md/HT213488 https://support.apple.com/en-md/HT213488
- deleted 3y ago[deleted]
- throwaway423342 3y agoAny suggestions for how I can get to anywhere close to Lina's skills? It's just mad skills.. I don't believe simply putting in huge amount of time in front of the machine is adequate. Neither is simply being smart. Is it just a combination of being smart, sinking in a lot of time, interests etc?
- Scarbutt 3y agoRead computer architecture and computer systems books.
- Toolbox1337 3y agoAny suggestions? I'll start with something that might be a good beginner friendly way to get familiar with some of the concepts: 'The Soul of a New Machine' by Tracy Kidder.
- armitron 3y agoYou'd be wasting your time with that. Go read the bible (Computer Organization and Design by Patterson) instead.
- mistyvales 3y agoDo you recommend any specific one? I guess there are multiple for ARM, RISC-V, etc. Thanks
- Scarbutt 3y agoHow can she do all this using kate and not vim? /s
- pxc 3y agoKate does have a pretty good vi mode!
- mika69 3y agoIs this page archived yet? I cannot access the page..
- evgpbfhnr 3y agoJust a note this isn't new: fixed in macOS last year (october 2022), and the japanese stream with the same slides is half a year old. (The english content is new, so I guess this is still worth the front page as long as people are interested)
- shim332 3y agoLina is not a random emerging VTuber who randomly stumbled upon the bug and found an exploit technique that can be applied to exploit the bug; she is actually highly skilled at exploit things...
- H8crilA 3y agoCool, but this is a technology discussion website, not a personality discussion website.
- PrayagBhakar 3y agoI don’t think that’s entirely true. When reading technical articles who the author is matters. For example, this is the same person who’s working on Asahi Linux for ARM macs. This means that they probably know what their talking about and this is gonna be a good article.