3 ms·
Wow. I think Dowd just lost his spot as the king of insane, Rube Goldberg-esque exploits. I'd love to hear not just how the exploit works, but how all of this
by daeken 15y ago
Wow. I think Dowd just lost his spot as the king of insane, Rube Goldberg-esque exploits. I'd love to hear not just how the exploit works, but how all of this was discovered.
- tptacek 15y agoI think Travis Goodspeed nailed this on Twitter: any time you're emulating or even just retrofitting one complex system into another, you can catalog the security assumptions made by both systems and look for clashes. I found the underlying exploit here to be uncannily similar, designwise, to the Android jailbreak exploits in the INFILTRATE Android security slides that Immunity gave. "Oops, we allowed Dalvik processes to map read-write memory shared by init and the property database!" (Understanding how Soeder could have discovered the flaw doesn't mean I think I stood a chance of putting this together). I also think there's a fair bit of research done on the hypervisor/guest comms in VMWare. Also, Soeder appears to have taken up permanent residence in NTVDM. They should call it Soeder mode.