scarybeast

8 ms·

31.
Proving Box.com fixed ASLR via ImageMagick uninitialized zlib stream buffer(scarybeastsecurity.blogspot.com)
2 points by scarybeast 9y ago|0 comments
32.
Proving missing ASLR on dropbox.com and box.com over the web for a $343 bounty(scarybeastsecurity.blogspot.com)
6 points by scarybeast 9y ago|0 comments
33.
by scarybeast 9y ago
No. It's exploitable by a normal unprivileged user on modern Ubuntu. From the article, "Let’s see how we can exploit this vulnerability. I’m going to be targeting x86-64 Ubuntu 16.04.2 with 4.8.0-41-generic kernel version with KAS
34.
by scarybeast 9y ago
No. It's exploitable by a normal unprivileged user on modern Ubuntu. From the article, "Let’s see how we can exploit this vulnerability. I’m going to be targeting x86-64 Ubuntu 16.04.2 with 4.8.0-41-generic kernel version with KAS
35.
by scarybeast 9y ago
Props on the fast fix; anti-props on running an unsandboxed JavaScript engine at SYSTEM privileges and feeding it files from remote.
36.
Ode to the use-after-free: one vulnerable function, a thousand possibilities(scarybeastsecurity.blogspot.com)
2 points by scarybeast 9y ago|0 comments
37.
by scarybeast 9y ago
Wow. A _remotely_ exploitable Intel firmware vulnerability? You don't see one of those every day. My instinctive reaction is that this is ridiculously serious, although I'd need to see the full technical details. It's worth n
38.
by scarybeast 9y ago
FWIW, I'll note that Google has a 7 day policy for issues that are believed to be under active exploitation.
39.
by scarybeast 9y ago
And _this_, ladies and gentlemen, is why we have disclosure deadlines for security vulnerabilities. For example, Project Zero expects vendors to fix security vulnerabilities within 90 days of notification. Looking at this story, it's p
40.
by scarybeast 10y ago
This is one of the most serious and instructive pieces of technical security work we're likely to see this year. In case it hasn't sunk it: - This vulnerability affects tons of smart phones (iPhone, Nexus, Samsung S*). - The attac
41.
Black box discovery of memory corruption RCE on box.com(scarybeastsecurity.blogspot.com)
2 points by scarybeast 10y ago|0 comments
42.
by scarybeast 10y ago
There is always an additional 14-day period on offer, but the vendor has to choose to use it, and has to actually land the patch within the 14 extra days. So, a deadline miss is often really a 104 (!!) day deadline miss. As an industry that
43.
by scarybeast 10y ago
"CVE counting" is not necessarily a good proxy for "security". The practice of drawing conclusions from various CVE statistics has been variously debunked over the years. I strongly recommend reading this 6-year old(!) r
44.
Redux: compromising Linux using SNES Ricoh 5A22 processor opcodes?(scarybeastsecurity.blogspot.com)
5 points by scarybeast 10y ago|0 comments
45.
by scarybeast 10y ago
I'm not sure that "sheesh" is an appropriate response. It's perfectly valid for an app to reply on the security of its own storage space, and isolation from other apps, and drive encryption services of the platform. Thes
46.
Advancing exploitation: a scriptless 0day exploit against Linux desktops(scarybeastsecurity.blogspot.com)
40 points by scarybeast 10y ago|0 comments
47.
by scarybeast 10y ago
I more often say "oh-day", and less often, "zero day". This could be a generational thing. "oh-day" is preferred by many of the hackers I talk to who have been in the industry for a while.
48.
by scarybeast 10y ago
It will likely only open a calculator if you run it against the exact version of everything listed in the blog post, which is Ubuntu 12.04.5 without any further patches. Any different version of Ubuntu (such as 14.04.anything), will have a
49.
by scarybeast 10y ago
You are clairvoyant :) I'm working on this area. Some distros have this problem with their default Gnome-based desktops too.
50.
by scarybeast 10y ago
Thanks for posting this quote! It's super awesome and is very close to my own thoughts on the matter :) I'll be sure to cite this link in any future blog posts on the topic.
51.
Compromising a Linux desktop using 6502 opcodes on the NES(scarybeastsecurity.blogspot.com)
355 points by scarybeast 10y ago|95 comments
52.
One Perfect Bug: Exploiting Type Confusion in Flash(googleprojectzero.blogspot.com)
11 points by scarybeast 11y ago|0 comments
53.
Significant Flash exploit mitigations are live in v18.0.0.209(googleprojectzero.blogspot.com)
90 points by scarybeast 11y ago|25 comments
54.
From inter to intra: gaining reliability(googleprojectzero.blogspot.com)
8 points by scarybeast 11y ago|0 comments
55.
What is a “good” memory corruption vulnerability?(googleprojectzero.blogspot.com)
81 points by scarybeast 11y ago|4 comments