a blog about IT security and other geek interests
I want to say a few words about my current adventure. I joined the Fuchsia project at its inception and worked on the daunting task of building and shipping a brand new open-source operating system. As my colleague Chris noted , pointing to this comparison of a device running a Linux-based OS vs Fuchsia, making Fuchsia invisible was not an easy feat. Of course, under the hood, a lot is different.…
Starting with Chrome 23.0.1255.0, recently released to the Dev Channel , you will see Chrome making use of our next-generation sandbox on Linux and ChromeOS for renderers. We are using a new facility, introduced in Linux 3.5 and developed by Will Drewry called Seccomp-BPF . Seccomp-BPF builds on the ability to send small BPF (for BSD Packet Filter ) programs that can be interpreted by the kernel.…
EDIT: Following its full disclosure Sun fixed Tavis' Java deployment toolkit bug (CVE-2010-0886 and CVE-2010-0887) in a matter of days, wow! No doubts this will be used in the future as an argument for full disclosure. However, this does not bring much security! An attacker can still automatically downgrade your version of Java ( using installJRE ) and exploit this bug or any other he likes!…
Tavis and I have just come back from CanSecWest . The title of our talk was "There's a party at Ring0, and you're invited". We went through some of the bugs that we have worked on this past year and mentioned some of our thoughts on kernel security in general: We see an increasing attack surface, both locally and remotely (@font-face, webgl ...) The recent focus on sandboxes ( Chrome , Office )…
Two days ago, Tavis Ormandy has published one of the most interesting vulnerabilities I've seen so far. It's one of those rare, but fascinating design-level errors dealing with low-level system internals. Its exploitation requires skills and ingenuity. The vulnerability lies in Windows' support for Intel's hardware 8086 emulation support (virtual-8086, or VM86) and is believed to have been there…
Earlier this month, Tavis and I spoke at PacSec 2009 in Tokyo about virtualisation security on Intel architectures, with a focus on CPU virtualisation. During this talk, we briefly explained various techniques used for CPU virtualisation such as dynamic translation (QEmu), VMware-style binary translation or paravirtualisation (Xen) and we went through bugs found by us and others: - We released…
Tavis Ormandy and myself have recently released an advisory for CVE-2009-2267. This is a vulnerability in VMware's virtual CPU which can lead to privilege escalation in a guest. All VMware virtualisation products were affected, including in hardware virtualisation mode. In a VMware guest, in the general case, unprivileged (Ring 3) code runs without VMM intervention until an exception or interrupt…
Chris Evans and myself have presented last week at Hack In The Box Malaysia about " Security in Depth for Linux software ". You can find the slides here . The talk was focused on writing good code and sandboxing . The writing goode code part was using vsftpd as an example, since Chris has got this right for ten years now. In the second part, we defined sandboxing , which we also call discretionary…
A few months ago, Tavis Ormandy and myself have used the fact that iret can fail with a General Protection (#GP) exception before the processor "commits" to user-mode (switches privileges by setting CS) on multiple occasions (more on this at upcoming PacSec) It's not necessarily obvious that an inter-privilege iret (typically from kernel mode to user mode) can fail before the privilege switch…
EDIT: p0c73n1 has posted an exploit for this to milw0rm as did andi@void.at , and spender wrote "the rebel" Tavis Ormandy and myself have recently reported CVE-2009-2698 which has been disclosed at the beginning of the week. This flaw affects at least Linux 2.6 with a version < 2.6.19. When we ran into this, we realized the newest kernel versions were not affected by the PoC code we had. The…
EDIT2: Here is RedHat's official mitigation recommendation EDIT3: Brad Spengler also wrote an exploit for this and published it . The bug triggering is based on our exploit which leaked to Brad though the private vendor-sec mailing list. He implements the personality trick Tavis and I published in June to bypass mmap_min_addr and also makes use of a feature that allows any unconfined user to gain…
Today was chosen as disclosure day for CVE-2009-1894. Tavis Ormandy and myself have recently used the fact that pulseaudio was set-uid root to bypass Linux' NULL pointer dereference prevention . This technique is relying on a limitation in the Linux kernel and not on a bug in pulseaudio. But we also found one unrelated bug in pulseaudio. Since it's set-uid root, we thought we would give pulseaudio…
EDIT3: Slashdot , the SANS Institute , Threatpost and others have a story about an exploit by Bradley Spengler which uses our technique to exploit a null pointer dereference in the Linux kernel. EDIT2: As of July 13th 2009, the Linux kernel integrates our patch (2.6.31-rc3). Our patch also made it into -stable. EDIT1: This is now referenced as a vulnerability and tracked as CVE-2009-1895 NULL…
The time-stamp counter (TSC) is part of the performance monitoring facilities provided on Intel processors. It's stored in a 64-bits MSR. Except for 64-bit wraparound (and of course reset), the TSC is guaranteed to be monotonically increasing by Intel, but not necessarily at a constant rate. Historically, the TSC increased with every internal processor clock cycle, but now the rate is usually…
EDIT3: This vulnerability has been nominated for a Pwnie Award for "best client-side bug"! EDIT 2: On June 15th 2009, Apple has updated Java on MacOS X with a version that fixes this issue. EDIT 1: this has been featured on Slashdot , Ars Technica , ZDNet , OSnews and many others. The focus was on the fact that this is still not fixed on MacOS X. However, keep in mind that you may still be at risk…
EDIT2: Thanks to the efforts of Jake Edge who noticed our presentation, /proc/pid/stat information leak is now at least partially patched in mainline kernel , since 2.6.27.23 EDIT1: This is featured in an LWN article by Jake Edge Tavis Ormandy and myself talked about locally bypassing address space layout randomization (ASLR) in Linux in a lightning talk at CanSecWest. From Linux 2.6.12 to Linux…
I used to love exploiting memory corruption vulnerabilities. It usually requires some reverse engineering, good knowledge of the underlaying operating system and some ingenuity to write reliable exploits. And if you try to circumvent clever protections such as PaX, it can get very tricky. But besides kernel vulnerabilities, exploitable memory corruption vulnerabilities these days are mostly buffer…
Yesterday, a friend of mine turned 26. I know what you're thinking, this is very exciting. Indeed, not every year your age is between a square (5^2) and a cube (3^3)! How often does this happen? Well actually, Wikipedia states that 26 is the only number between a square and a cube (which is not exactly true, but read on). I thought this was cool, let my friend know in a creepy happy birthday…
EDIT: While most realized this was an April fool's joke, only a few figured out that it was also a genuine smiley shellcode encoder. However, the security implications are of course non existent. And we have been slashdoted ! Yoann Guillot and myself have been assessing the security of instant communication applications for a couple of years. For quite some time now, we have both suspected that it…
I am back from CanSecWest . Like every year, it was interesting and great fun. And for the first year, presentation material has been put online in a matter of days! I would definitely recommend to check out the following talks: Immunity's talk about exploiting bugs smoothly , without unwanted side effects. Interesting, but this talk could have used a few real-world examples. Loic Duflot's talk…
I have finally decided to open a blog. I am not exactly an early adopter, it took me a long time to feel the need of having one. IT security is a long-time interest for me. I've usually been sharing thoughts, ideas and opinions in bars, restaurants and conferences or on IRC. I'll use this blog to reach a broader audience. To publish new tools, I hope it will be more user-friendly than raw updates…