2 ms·
What is missing from these two representations is the ability for something to become trivially bypassable once you know the trick to it. AnC is roughly that fo
by ryao 2y ago
What is missing from these two representations is the ability for something to become trivially bypassable once you know the trick to it. AnC is roughly that for ASLR.
- fc417fc802 2y agoI'd argue that AnC is a side channel attack. If I can obtain key material via a side channel that doesn't (at least in the general case) suddenly change the category of the corresponding algorithm. Also IIUC to perform AnC you need to already have arbitrary code execution. That's a pretty big caveat for an attacker.
- ryao 2y agoYou are not wrong, but how big of a caveat it is varies. On a client system, it is an incredibly low bar given client side scripting in web browsers (and end users’ tendency to execute random binaries they find on the internet). On a server system, it is incredibly unlikely. I think the middle ground is to call the effectiveness of ASLR questionable. It is no longer the gold standard of mitigations that it was 10 years ago.