3 ms·

> when was the last time you heard of a modern application backend being exploited through memory corruption, in any language? It happens all the time, but it’

by amluto 1y ago

> when was the last time you heard of a modern application backend being exploited through memory corruption, in any language? It happens all the time, but it’s a bit hard to find because “modern application backend[s]” are usually written in Go or Python or Rust. Even so, you’ll find plenty of exploits based on getting a C or C++ library on the backend to parse a malformed file.

comex 1y ago
Are these exploits publicly documented?
- amluto 1y ago
  Some exploit authors love writing up their work. For example: https://googleprojectzero.blogspot.com/2016/12/chrome-os-exploit-one-byte-overflow-and.html?m=1 https://googleprojectzero.blogspot.com/2016/12/chrome-os-exp...
  - comex 1y ago
    Not backend.
    - amluto 1y ago
      There is absolutely nothing special about backends in this regard except that it’s more likely that the attacker doesn’t have access to the code or binary.