4 ms·
Now, what kinds of V8 vulnerabilities can we exploit to get inside Google? Said every intelligence agency everywhere.
by hughw 11y ago
Now, what kinds of V8 vulnerabilities can we exploit to get inside Google? Said every intelligence agency everywhere.
- KMag 11y agoFrom 2006 to 2010, my primary role at Google was JavaScript execution in the indexing pipeline. I knew I was likely executing every known JavaScript engine exploit out there plus a good number of 0-days, and ran the javascript engine in a single-threaded subprocess with a greatly restricted set of allowed system calls. Certainly the right combination of kernel zero-days and JS interpreter exploits could be used to take over the machine, but it would be non-trivial.
- gwern 11y ago> ran the javascript engine in a single-threaded subprocess with a greatly restricted set of allowed system calls. You were trying to sandbox the JS engine rather than using disposable VMs?
- mikesaloxi 11y ago> Said every intelligence agency everywhere. Not everywhere. The ones in the USA already have free access to anything in Google. In fact, Google is a part of their network.