31–40 of 42 posts
I found https://blogs.windows.com/windowsexperience/2020/06/16/whats...:
> Windows 10, version 20H2 is, therefore, “20H2” because it will be released in the second half of the 2020 calendar year.
So 20H1 is 2020 1st half then. And Windows now has biannual rolling release? Nice.
Earlier quoted context omitted.
It's not totally true that attackers have found ways bypass mitigations. In many cases the attackers require entirely new capabilities, or separate vulnerabilities, to get around a mitigation. And in some cases it makes an attack statistically unlikely, even if it may succeed. Lots of mitigations do suck, and are a huge waste of time and effort, but quite a few are very significant. It's very rare that a bypass is a…
It's kind of easy to say "ASLR is not resistant to infoleaks" but it's really quite another thing if the infoleak ends up coming from something like a microarchitectural sidechannel or even an undocumented proprietary processor extension, rather than "hurr durr here is a slid pointer, we hand out these out like candy".
For example, ASLR for a process that executes Javascript is probably not going to be as useful as ASLR for a process that receives network requests.
Earlier quoted context omitted.
It's kind of easy to say "ASLR is not resistant to infoleaks" but it's really quite another thing if the infoleak ends up coming from something like a microarchitectural sidechannel or even an undocumented proprietary processor extension, rather than "hurr durr here is a slid pointer, we hand out these out like candy".
My point is that ASLR makes assumptions about the attackers capabilities. All good mitigations do. If the attacker has "I can run nearly arbitrary computations on within the processes memory space", that is outside of the model that ASLR attempts to deal with. For example, ASLR for a process that executes Javascript is probably not going to be as useful as ASLR for a process that receives network requests.
Does anyone know when AMD will have equivalent support?
We've been through several generations of exploit mitigations starting with non-executable stacks, and, impressively, exploit developers found workarounds for each of them (although often the particular workarounds have requirements that might not be met in a particular vulnerability environment). In many cases I had the impression that the workarounds were surprising to the mitigation developers because the latter h…
Not that other languages don't have logical errors that might lead to security exploits, but in what concerns memory corruption exploits, the mitigation list just keeps pilling up.
Looking forward to how long ARM hardware memory tagging will hold on, after Intel's MPX failure.
At least so far Solaris SPARC ADI seems to hold on.
We've been through several generations of exploit mitigations starting with non-executable stacks, and, impressively, exploit developers found workarounds for each of them (although often the particular workarounds have requirements that might not be met in a particular vulnerability environment). In many cases I had the impression that the workarounds were surprising to the mitigation developers because the latter h…
grsec seems to think CET won't be effective: https://grsecurity.net/effectiveness_of_intel_cet_against_co...
We've been through several generations of exploit mitigations starting with non-executable stacks, and, impressively, exploit developers found workarounds for each of them (although often the particular workarounds have requirements that might not be met in a particular vulnerability environment). In many cases I had the impression that the workarounds were surprising to the mitigation developers because the latter h…
Incredible how C and C++ have managed to keep the security industry busy. Not that other languages don't have logical errors that might lead to security exploits, but in what concerns memory corruption exploits, the mitigation list just keeps pilling up. Looking forward to how long ARM hardware memory tagging will hold on, after Intel's MPX failure. At least so far Solaris SPARC ADI seems to hold on.
Earlier quoted context omitted.
Incredible how C and C++ have managed to keep the security industry busy. Not that other languages don't have logical errors that might lead to security exploits, but in what concerns memory corruption exploits, the mitigation list just keeps pilling up. Looking forward to how long ARM hardware memory tagging will hold on, after Intel's MPX failure. At least so far Solaris SPARC ADI seems to hold on.
MPX was totally slow and cumbersome, ARM tagging should be much nicer as will be CHERI when it actually comes out.