Hacking everything, by Chris Evans / scarybeasts
There are many good, modern solutions for reading data off old floppy discs and drives. Perhaps the best is the Greaseweazle : it's capable, open source, open hardware, inexpensive and has a vibrant and friendly community behind it. It connects directly to a floppy drive, replacing the floppy disc controller, and reads the disc in great detail. It can handle regular discs or any known copy…
Introduction I've been on a bit of a floppy disc protection odyssey recently. This will probably be the last floppy disc related post for some time, so how better to end things than describe a stroke of genius I came across during my research of BBC Micro disc protection? In my previous posts, we've already covered (directly or tangentially) some interesting floppy disc protection schemes: Weak…
" As I recall, those two chips were fairly large. And fairly late -- to the marketplace. We had lots of issues with them. [...] Sometimes the elegant solution isn't the best solution. " -- Dave House, digressing to the 8271 during "Oral History Panel on the Development and Promotion of the Intel 8080 Microprocessor" [ link ], April 26th 2007, Computer History Museum, Mountain View, California.…
Introduction One of the most iconic floppy disc protection stories is Dungeon Master . Released in December 1987, Dungeon Master combined an advanced physical disc format (fuzzy bits) with sneaky protection checks embedded into the gameplay itself. I strongly recommend this article which gives an excellent overview of floppy discs before launching into a very thorough overview of the fuzzy bits…
Floppy disc copy protection schemes are varied and interesting. It's an interesting intellectual challenge: what schemes can be created whereby home computers could reliably read a given disc, but not be able to easily (or at all) write that data back in the same format? When talking about floppy disc copy protection code, I find it useful to split into two separate pieces: The on-disc bits that…
If you must suffer data loss then at least make sure you collect a good story from the experience! I believe I have such a story. Recently, I've been enjoying keeping my inner engineer sharp by playing around with retro software and hardware. I've taken a particular interest in floppy disc drives and old-school floppy disc protection on the BBC Micro. The BBC Micro had a couple of different…
In the early 1980s, the Texas Instruments SN76489 sound chip was found in a variety of personal computers, consoles and arcade cabinets. The legend, the chip itself It is a fairly simple chip, consisting of 3 "tone channels", and one "noise channel", typically mapped to 3 note channels and one drum channel. The tone channels play square waves and the noise channel can emit either white noise or…
6-5-0-who? The 6502 is an iconic processor that dominated home computing in the late 70s and early to mid 80s. It was used in machines ranging from the Apple II to the Atari 2600 to the Commodore 64 to the Nintendo Entertainment System. In pop culture, it powered Bender , not to mention the Terminator ! It often clocked at a modest 1MHz, with faster variants available. In the UK, a 2MHz variant…
I’m excited to announce that I’ve joined Dropbox as their new Head of Security. Truth be told, I ’ve been here a little while and I’ve been enjoying on-boarding too much to make the announcement. If you were wondering why my blog has been quiet for a while, now you know why! I exited a fun period of semi-retirement to take up this challenge. What attracted me to Dropbox enough to make the switch?…
Google's Project Zero team was announced in July 2014 . Since then, it has become very well known for publishing offensive security research of exceptional quality. This is especially welcome to defenders at a time where top quality offensive security research is drying up. For most important software targets, it's getting harder to find and exploit bugs. And for those individuals who remain in…
Overview In my previous post on Yahoobleed #1 (YB1) , we saw how an uninitialized memory vulnerability could lead to disclosure of private images belonging to other users. The resulting leaked memory bytes were subject to JPEG compression, which is not a problem for image theft, but is somewhat lacking if we wanted to steal memory content other than images. In this post, we explore an alternative…
Overview *bleed attacks are hot right now. Most notably, there's been Heartbleed and Cloudbleed . In both cases, out-of-bounds reads in server side code resulted in private server memory content being returned to clients. This leaked sensitive secrets from the server process' memory space, such as keys, tokens, cookies, etc. There was also a recent client-side bleed in Microsoft's image libraries…
Introduction Back in 2014, while at Project Zero, I exploited a buffer overflow of a single NUL byte in glibc . Tavis Ormandy had found the interesting glibc vulnerability but there was skepticism in the Linux community that this was exploitable. The only thing to do was to write an exploit. (Was this really 3 years ago? How time flies!) As part of warming up to write the exploit, I created a few…
Introduction Before we get into it, let's start by stating that the progression of memory corruption mitigations over the years has been intensely valuable. The progression of mitigations continues to make exploiting bugs harder and more time consuming. The pool of people who have both the skill and commitment to exploit any given bug (either reliably or at all) is shrinking. The list of…
Overview In my previous post, we explored using an ImageMagick 0day (now a 1day) in the RLE decoder to to determine missing ASLR in both box.com and dropbox.com . In response, both Box and DropBox sensibly limited the available decoders. Both dropped RLE support and lots more. As you may recall from a different but related post , I had challenges working with Box to accurately determine the status…
Overview Cloud file storage providers such as Box and DropBox will typically thumbnail uploaded images for purposes of showing icons and previews. Predictably, both providers appear to use ImageMagick for thumbnailing. So what happens if we come knocking with the ImageMagick 1-day CESA-2017-0002? CESA-2017-0002 is a vulnerability in the RLE image decoder, where the allocated render canvas memory…
Overview This post explores an old but wonderful vulnerability that enables us to really showcase the (oft underestimated) power of the use-after-free vulnerability class. We’re going to take a step back and consider the wider class of “use-after-invalidation”, of which use-after-free is one type of use of invalidated state. We will see one single area of vulnerable code that has it all:…
Overview Robust evidence existed for the presence of a memory corruption based RCE (remote code execution) on box.com servers. The most likely explanation for the evidence presented is the usage of an old ImageMagick which has known vulnerabilities, combined with lack of configuration lockdown. It's hard to be sure, though: see the section on the Box response below. This blog post explores a…
Overview TL;DR: full reliable 0day drive-by exploit against Fedora 25 + Google Chrome, by breaking out of Super Nintendo Entertainment System emulation via cascading side effects from a subtle and interesting emulation error. Very full details follow . [ UPDATE 13 Dec 2016 -- a couple of competent readers inform me that I've named the wrong processor! The actual emulated processor where the fault…
Overview A part of any intellectually honest full disclosure experiment is to disclose the less interesting findings alongside the more serious issues and exploits. Accordingly, if you were looking for spectacular 0day exploits, this is not the post you are looking for. If you’re generally interested in software failure conditions, though, here’s a bunch. While looking at the gstreamer FLIC and…
Overview In a previous blog post, I disclosed CESA-2016-0002 , an 0day vulnerability (without exploit) in the vmnc decoder of the gstreamer media subsystem, which is installed by default in Fedora. Because a Fedora fix was somewhat slow in coming, I decided to attempt to exploit this vulnerability. This would have to be another scriptless vulnerability. My previous scriptless exploit against the…
Overview Recently (Nov 21st, 2016), I published an 0day exploit against the gstreamer FLIC decoder, here on my blog . The response time from gstreamer upstream was impressive: a patch in 1 day or so that fixed not only the immediate issue but also some similar bugs in other functions in the decoder. More on those other bugs in another post. Here is the git commit . The response from Ubuntu, one of…
Overview A powerful heap corruption vulnerability exists in the gstreamer decoder for the FLIC file format . Presented here is an 0day exploit for this vulnerability. This decoder is generally present in the default install of modern Linux desktops, including Ubuntu 16.04 and Fedora 24. Gstreamer classifies its decoders as “good”, “bad” or “ugly”. Despite being quite buggy, and not being a format…
Overview A confluence of two risky design choices, combined with various implementation issues, makes drive-by downloads possible with Google Chrome on Fedora. In total, with the risky design choices first, the issues are: Chrome will auto download files to a user’s desktop with no confirmation. Fedora’s “tracker” software will auto crawl downloaded files to index them, including media files. The…
Overview A vulnerability and a separate logic error exist in the gstreamer 0.10.x player for NSF music files. Combined, they allow for very reliable exploitation and the bypass of 64-bit ASLR, DEP, etc. The reliability is provided by the presence of a turing complete “scripting” inside a music player. NSF files are music files from the Nintendo Entertainment System. Curious? Read on...…