171–180 of 184 posts
Earlier quoted context omitted.
The biggest issue here is that this image parsing was done by such a high-privileged process. What happened to all the sandboxes and stuff?
From the original article [0], last line: "In a future post (currently being finished), we'll take a look at exactly how they escape the IMTranscoderAgent sandbox." [0]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
Earlier quoted context omitted.
If a hack can be called beautiful, this fits the bill. How do people come up with these?
Being trained in Israeli intelligence corps, moving to civilian life, retaining your spook skills and being funded by Saudi billionaire prince who hates human right activism and criticism.
Earlier quoted context omitted.
https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability Long story short: Windows library routines for handling an obscure, obsolete image format had a parser flaw. Simply rendering an appropriately crafted image via the standard Windows APIs -- whether in a web browser, file explorer, file preview, word processor, anywhere -- resulted in kernel-level arbitrary code execution. Now, we've gotten a bit smarter abo…
> There could be a parser bug somewhere in your web browser for example that allows a properly crafted input to hijack the browser process. Bit of a caveat: Chromium and Firefox are probably some of the most hardened software programs in the world (for other browsers, all bets are off). Chromium distributes its logic over multiple processes per tab, so that even if you eg find a zero-day in V8, you still can't use it…
There is a certain irony in the idea that people should rely on a Google product to avoid having their privacy compromised.
Earlier quoted context omitted.
There's been buffer overflows/RCE exploits in all sorts of software that can parse images since, well, forever . I remember more than 20 years ago seeing a notice about the embedded Internet Explorer rendering engine in Microsoft Outlook Express having an RCE zero day which could be exploited by simply loading an image in the body of an email. Rich multimedia parsing display systems in messaging apps are a very tempt…
Why a messenger app needs a picture viewer?
A picture is worth a thousand words.
https://en.wikipedia.org/wiki/Loujain_al-Hathloul
Her husband is another exceptionally courageous person and it is inspiring to see their cheer and steadfast courage despite all the hardship they face. It is sad to see Saudi Arabia continuing to harass this couple.
Earlier quoted context omitted.
That's not a solution. You're just piping the outside data into your sandbox; it can have bugs too.
There's no such thing as a perfect solution, only solutions that improve a bad situation.
Earlier quoted context omitted.
Wow, so basically: 1. iMessage has a feature to send and receive GIFs 2. These GIFs are copied to a specific path early in the message processing pipeline (even before the message is displayed) 3. But the copy code doesn't just copy the GIF. It uses the CoreGraphics APIs _renders_ the image to a new GIF file at the destination path. 4. The code uses the ImageIO lib to guess the image format, ignoring the .gif file ex…
I think the most critical part in the flow is the integer overflow bug, and it is totally avoidable. I am a software engine at Microsoft. Half of my time was spent on security and compliance. We have the right tool, right policy to avoid such things happen. However, I'm not saying Microsoft software is free of integer overflow bugs. I don't intend to advertise Microsoft C/C++ development tools here, but they are the…
If you think GC performance is not good enough, see that proof of concept: https://github.com/Const-me/Vrmac/tree/master/VrmacVideo/Con... That C# code implements parser for Mpeg4 format. That format is way more complicated than GIF or even PDF, yet that code runs fine even on very slow computers (Raspberry Pi 4). There’s another similar one in that project for MKV format.
Earlier quoted context omitted.
Formal correctness proofs are both unattainable and insufficient. We don't know how to do it at the required scale, and it doesn't save us from flawed formal specifications, we'll have the bugs in the formal requirements instead of in the code. There are more cost efficient and proven ways to effectively address these kinds of vulnerabilities, like limiting complexity, using programming language features to eliminate…
Limiting complexity is often not an option, because the complexity is of the subject area. Things like image format decoders are easiest to produce formal analysis and proofs for. It's sadly still too expensive and slow to produce. Fuzzing as a mandatory testing step could be useful in some cases. I agree about bugs in specifications though :(
Earlier quoted context omitted.
That's not a solution. You're just piping the outside data into your sandbox; it can have bugs too.
It depends on which sandbox you are using. In Qubes OS on desktop, you rely on hardware virtualization, which is virtually unbreakable.
Earlier quoted context omitted.
It depends on which sandbox you are using. In Qubes OS on desktop, you rely on hardware virtualization, which is virtually unbreakable.
I thought Spectre and Meltdown also allowed host data leakage from a compromised guest?