I don't think I will ever reach the point where I can read a paper that assigns most credit for ROP to the 2007 Shacham paper, and that harps on at length about "Turing-completeness", without my blood pressure rising.
-
Show this thread
-
"Turing-completeness" is a misnomer in this context to begin with. Sending Javascript to a Browser is Turing-complete, and rendering Postscript is. "Can achieve any memory layout" is not as snazzy to say, I get it, but that doesn't make "Turing complete" any more correct.
4 replies 4 retweets 16 likesShow this thread -
Replying to @halvarflake
I think "can achieve any memory layout" isn't enough to describe privilege escalation (absent something application-specific), but might be sufficient to describe privilege abuse
1 reply 0 retweets 0 likes -
-
Replying to @halvarflake
It's a hold-over from thinking that the be-all end-all of exploitation is turing completeness (doesn't account for syscalls, immutable page protections, inability to introduce new machine code, etc) -- does your FSM-view take it into account?
1 reply 0 retweets 1 like -
Replying to @grsecurity
It does, to the extent that syscalls etc. represent communication from one machine to the next. While I think you can guarantee next to nothing about the corrupt process (especially in multi-thread situations), you *can* guarantee some things about how it communicates.
1 reply 0 retweets 0 likes -
Replying to @halvarflake @grsecurity
End-all-and-be-all of exploitation is violating a security boundary. If they are in-process, and data-driven, defending them in presence of memory corruption is a losing game. Out-of-process is a very different animal.
1 reply 0 retweets 0 likes -
Replying to @halvarflake @grsecurity
So if you ask me: Do multiple small processes communicating over a very restricted interface seem saner than the current model? Hell yeah.
1 reply 0 retweets 0 likes -
Replying to @halvarflake @grsecurity
I will be the first one to say that seccomp strict mode is a tremendously useful and powerful primitive :-)
2 replies 0 retweets 2 likes
... which nobody uses :P
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.