4 ms·

Hum .... Porting C to js... Are you serious? Where are your pointers, ASM registers in js? The claim you could inject arbitrary code from JS into your memory a

Hum .... Porting C to js... Are you serious? Where are your pointers, ASM registers in js? The claim you could inject arbitrary code from JS into your memory and make it executable from user space (not talking of the cross platform issue (BSD,linux, windows, MACOSX) would just be the end of JS. How can you even accept the claim that it can be doable. Be real. This news is like an april's fool in july. Use your brain.

drewcrawford 14y ago
Arguments from incredulity and personal insults have no place in reasoned discussion. > The claim you could inject arbitrary code from JS into your memory and make it executable from user space One of the dozens of ways that you would go about this is documented in some detail here: http://stackoverflow.com/questions/381171/help-me-understand-this-javascript-exploit http://stackoverflow.com/questions/381171/help-me-understand...
- duskwuff 14y ago
  As Raymond Chen would put it, though, "that would involve being on the other side of this airtight hatchway"[1]. While it's occasionally possible to execute native code from Javascript due to browser bugs, such bugs are uncommon, and are in any case quite separate from the CPU bug that this exploit claims to target. [1]: http://blogs.msdn.com/b/oldnewthing/archive/2010/12/08/10101773.aspx http://blogs.msdn.com/b/oldnewthing/archive/2010/12/08/10101...
- ObnoxiousJul 14y ago
  well, figure that if it were true, Java, python, Perl, c# are useless tools for delivering cross x86 OS code. (I just develop a side effect of the claim one can inject some code in memory bypassing all the HW/OS control). Why God these stupid Larry Wall, GvR, MS, Sun, Google, linus torvalds lost their time trying to achieve what a JS code can do in less than 1000 lines? How can I believe a code I can read and that is obviously a fraud would through the sheer power of obfuscated unused strings become such a revolution in the world of CS? Plus, I have no demonstration nor readable documents to back up the claims of this so called genius. Science is accepting what you can understand and reproduce. Not being impressed by obfuscated crap. I have no doubt this is a mystification, and I don't trust blindly what is written on the internet. I still have a brain.
- ObnoxiousJul 14y ago
  @drewcrawford, you can't even read x86 ASM? O_o The exploit described in stackoverflow, works only for IE and a version of windows where the memory addresses are not randomized (which most modern OS do have (http://en.wikipedia.org/wiki/Address_space_layout_randomization http://en.wikipedia.org/wiki/Address_space_layout_randomizat...) , and where calc.exe is installed (so windows + IE probably). Hint MOV + JMP are made @ fixed address. If the code showed is not an hoax (which I highly doubt) it would imply : 1) a specific browser (to break the gate of OS control on memory/permission by using a buffer overflow) and I don't see at first glance a buffer overflow (but let's imagine it exists), 2) a specific old OS (windows 98 or XP maybe) (for having a predictable address to which to inject the shell code)(I can't imagine an ASM code doing base of registry scanning in less than 4k to get an address of a peculiar exec/lib); 3) since it is based on specific 64bits alignment problem and since there are 32bits legacy application) it would target only the 64bits version This makes the threat looks more like ripples in a glass of water than the tsunami that was announced. Basically this (if it is not the hoax I think it is) would be just an exploit of a specific browser in 64bits version on a specific OS. It is not a JS exploit, it is a very specific browser name on OS name exploit in 64bits. So to say ... the whole day life in the world of software.
0x0 14y ago
> The claim you could inject arbitrary code from JS into your memory and make it executable from user space (not talking of the cross platform issue (BSD,linux, windows, MACOSX) would just be the end of JS. > How can you even accept the claim that it can be doable. Isn't exactly this how most/all heap spray js exploits work? I wouldn't be so quick to dismiss the concept of this bug, even though the "poc" presented here is bogus.

drewcrawford 14y ago

Arguments from incredulity and personal insults have no place in reasoned discussion. > The claim you could inject arbitrary code from JS into your memory and make it executable from user space One of the dozens of ways that you would go about this is documented in some detail here: http://stackoverflow.com/questions/381171/help-me-understand-this-javascript-exploit http://stackoverflow.com/questions/381171/help-me-understand...

duskwuff 14y ago
As Raymond Chen would put it, though, "that would involve being on the other side of this airtight hatchway"[1]. While it's occasionally possible to execute native code from Javascript due to browser bugs, such bugs are uncommon, and are in any case quite separate from the CPU bug that this exploit claims to target. [1]: http://blogs.msdn.com/b/oldnewthing/archive/2010/12/08/10101773.aspx http://blogs.msdn.com/b/oldnewthing/archive/2010/12/08/10101...
ObnoxiousJul 14y ago
well, figure that if it were true, Java, python, Perl, c# are useless tools for delivering cross x86 OS code. (I just develop a side effect of the claim one can inject some code in memory bypassing all the HW/OS control). Why God these stupid Larry Wall, GvR, MS, Sun, Google, linus torvalds lost their time trying to achieve what a JS code can do in less than 1000 lines? How can I believe a code I can read and that is obviously a fraud would through the sheer power of obfuscated unused strings become such a revolution in the world of CS? Plus, I have no demonstration nor readable documents to back up the claims of this so called genius. Science is accepting what you can understand and reproduce. Not being impressed by obfuscated crap. I have no doubt this is a mystification, and I don't trust blindly what is written on the internet. I still have a brain.
ObnoxiousJul 14y ago
@drewcrawford, you can't even read x86 ASM? O_o The exploit described in stackoverflow, works only for IE and a version of windows where the memory addresses are not randomized (which most modern OS do have (http://en.wikipedia.org/wiki/Address_space_layout_randomization http://en.wikipedia.org/wiki/Address_space_layout_randomizat...) , and where calc.exe is installed (so windows + IE probably). Hint MOV + JMP are made @ fixed address. If the code showed is not an hoax (which I highly doubt) it would imply : 1) a specific browser (to break the gate of OS control on memory/permission by using a buffer overflow) and I don't see at first glance a buffer overflow (but let's imagine it exists), 2) a specific old OS (windows 98 or XP maybe) (for having a predictable address to which to inject the shell code)(I can't imagine an ASM code doing base of registry scanning in less than 4k to get an address of a peculiar exec/lib); 3) since it is based on specific 64bits alignment problem and since there are 32bits legacy application) it would target only the 64bits version This makes the threat looks more like ripples in a glass of water than the tsunami that was announced. Basically this (if it is not the hoax I think it is) would be just an exploit of a specific browser in 64bits version on a specific OS. It is not a JS exploit, it is a very specific browser name on OS name exploit in 64bits. So to say ... the whole day life in the world of software.

0x0 14y ago

> The claim you could inject arbitrary code from JS into your memory and make it executable from user space (not talking of the cross platform issue (BSD,linux, windows, MACOSX) would just be the end of JS. > How can you even accept the claim that it can be doable. Isn't exactly this how most/all heap spray js exploits work? I wouldn't be so quick to dismiss the concept of this bug, even though the "poc" presented here is bogus.