Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Splitting atoms in XNU

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

31–37 of 37 posts

Re: Splitting atoms in XNU

#31

Post by blinkingled »

amelius wrote: post #30
dekhn wrote: post #12

Earlier quoted context omitted.

They tend to be really smart and motivated people. For example, http://lcamtuf.coredump.cx/gcnc/ is not just a good guide to CNC, it's an amazing guide where you realize he learned half the unwritten rules just by thinking about them. http://lcamtuf.coredump.cx/rstory/ for the robots.

That seems like a good pointer, but what does CNC milling have to do with finding bugs in a virtual memory system?

The learning process. No one is teaching you how to find bugs in VM subsystem.

Re: Splitting atoms in XNU

#32

Post by dekhn »

amelius wrote: post #30
dekhn wrote: post #12

Earlier quoted context omitted.

They tend to be really smart and motivated people. For example, http://lcamtuf.coredump.cx/gcnc/ is not just a good guide to CNC, it's an amazing guide where you realize he learned half the unwritten rules just by thinking about them. http://lcamtuf.coredump.cx/rstory/ for the robots.

That seems like a good pointer, but what does CNC milling have to do with finding bugs in a virtual memory system?

The author lcamtuf is a well-known security engineer and I was explaining, indirectly, that he's just inherently super-smart and curious and spends a ton of time figuring things out.

Re: Splitting atoms in XNU

#33

Post by londons_explore »

eljimmy wrote: post #3

Blows my mind that there’s people who figure this stuff out. Do they just spend their day to day time at work attempting all sorts of variations of this kind of stuff? How often does discovery or research like this lead to a dead end?

If you leave Ian Beer for even 5 minutes at a bus stop, he'll start poking the internals of the XNU kernel...

Re: Splitting atoms in XNU

#34

Post by londons_explore »

onemoresoop wrote: post #6
eljimmy wrote: post #3

Blows my mind that there’s people who figure this stuff out. Do they just spend their day to day time at work attempting all sorts of variations of this kind of stuff? How often does discovery or research like this lead to a dead end?

Apple pays handsomely for bugs, they have a bug bounty program (1). At some point there are fewer and fewer exploits and the system becomes harder to crack. All companies who care about security should have security bounty programs. https://motherboard.vice.com/en_us/article/qvapxq/apple-ipho...

Since this is Project Zero, the author has a salary and isn't allowed to collect the rewards.

I'm guessing the salary must be higher than the rewards or they wouldn't do it tho.

Re: Splitting atoms in XNU

#35

Post by londons_explore »

gok wrote: post #21
eljimmy wrote: post #3

Blows my mind that there’s people who figure this stuff out. Do they just spend their day to day time at work attempting all sorts of variations of this kind of stuff? How often does discovery or research like this lead to a dead end?

Presumably they have a large catalog of exploits that they sit on until they have an interesting exploit chain.

They often need some exploits to get the unencrypted kernel in the first place for analysis. If they were to reveal those exploits, they wouldn't be able to find any more exploits in the future.

Re: Splitting atoms in XNU

#36

Post by londons_explore »

Someone wrote: post #20

”Quickly dropping a very important lock and retaking it is a common anti-pattern I've observed across the XNU codebase […] This is trying to detect whether another thread acquired and dropped the lock while this thread dropped it then reacquired it. If so, the code checks whether there's still a vm_map_entry covering the current address its trying to copy and then bails out and looks up the entry again.” I find that…

Any sufficiently complex software will at some point require dropping and reacquiring a lock.

The trick is you have to assume everything changed under you when you dropped the lock, and recheck everything

Re: Splitting atoms in XNU

#37

Post by gok »

londons_explore wrote: post #35
gok wrote: post #21

Earlier quoted context omitted.

Presumably they have a large catalog of exploits that they sit on until they have an interesting exploit chain.

They often need some exploits to get the unencrypted kernel in the first place for analysis. If they were to reveal those exploits, they wouldn't be able to find any more exploits in the future.

Generally true, although the kernel is now unencrypted by default.
Post reply on HN