61–70 of 140 posts
Lina received a $150k bounty for this exploit.
Sounds extremely low for this kind of vulnerability of a $2.7T company that prides itself for its privacy accomplishments.
Lower, easier to get payouts are arguably better than rare jackpot payouts you have to fight over...
Earlier quoted context omitted.
It is indeed poor communication - why? Because: 1. The message is secondary to the medium. 2. The communication requires numerous unnecessary click throughs to obtain the relevant information. 3. The division of the information into various panels and mediums does not enhance the communication, rather the messages are divided in a way that doesn't match a hierarchal introduction of detail. It often serves no purpose…
[flagged]
I find that disgusting.
Earlier quoted context omitted.
It is indeed poor communication - why? Because: 1. The message is secondary to the medium. 2. The communication requires numerous unnecessary click throughs to obtain the relevant information. 3. The division of the information into various panels and mediums does not enhance the communication, rather the messages are divided in a way that doesn't match a hierarchal introduction of detail. It often serves no purpose…
[flagged]
I genuinely don't understand when I should be pressing down or right. Is there a linear way to view this?
It’s why I hate reveal.js It’s the most unintuitive mechanism unless you’ve already internalized what deck structures should be. It seems like it’s optimized for the presenter but it’s often used for after the fact sharing with everyone else who won’t know the order. It really needs a linear mode, with the option to see presenter notes.
- Use Metal shader code to make process page table accessible to shaders via page protection layer bug exploited using return oriented programming (ROP)
- Use Metal shader code to acquire read/write access to physical memory
- Use Metal shaders to access the kernel page table
- Deals with ASLR to find the kernel base address
- Obtains process user credentials data structure via the process data structure (from the kernel memory)
- Sets uid and gid to 0 (root) to the user credentials data structure, giving root privileges to the user
Lina received a $150k bounty for this exploit.
How does this work anyway? I reported a password bug that went unfixed for months and didn't hear back from Apple. Do you need to be the first/only person to have reported something, or what?
I.e if you report after someone else or report after it’s already been identified internally , you’re not likely to get a payout unless you have novel details
From code comments, what I understood (most likely in an incorrect way) is: - Use Metal shader code to make process page table accessible to shaders via page protection layer bug exploited using return oriented programming (ROP) - Use Metal shader code to acquire read/write access to physical memory - Use Metal shaders to access the kernel page table - Deals with ASLR to find the kernel base address - Obtains process…
GPUs are a very interesting attack vector. Especially as more computation is being pushed to GPUs, and they’re not always well isolated.
From code comments, what I understood (most likely in an incorrect way) is: - Use Metal shader code to make process page table accessible to shaders via page protection layer bug exploited using return oriented programming (ROP) - Use Metal shader code to acquire read/write access to physical memory - Use Metal shaders to access the kernel page table - Deals with ASLR to find the kernel base address - Obtains process…
I genuinely don't understand when I should be pressing down or right. Is there a linear way to view this?
Space key