Live data from Hacker News

A Tale of Two Pwnies (Part 1)

blog.chromium.org

11–20 of 82 posts

Re: A Tale of Two Pwnies (Part 1)

#11
post #9

Earlier quoted context omitted.

The other thing I wonder about is that in 2040, will we be still worrying about buffer overflows?

I really doubt that we'll be using programming environments where memory corruption is possible in 2040.

someone's gotta write the kernels though, I can't think of any way to write kernels or compilers where memory corruption is impossible.

Re: A Tale of Two Pwnies (Part 1)

#12
post #4

What's amazing about this bug is that at every step you learn something that makes Pinkie Pie more terrifying while simultaneously making the Chrome security model sound more and more forbidding.

And the worst is yet to come....

---

In an upcoming post, we’ll explain the details of Sergey Glazunov’s exploit, which relied on roughly 10 distinct bugs. While these issues are already fixed in Chrome, some of them impact a much broader array of products from a range of companies. So, we won’t be posting that part until we’re comfortable that all affected products have had an adequate time to push fixes to their users.

Re: A Tale of Two Pwnies (Part 1)

#13
post #11
post #9

Earlier quoted context omitted.

I really doubt that we'll be using programming environments where memory corruption is possible in 2040.

someone's gotta write the kernels though, I can't think of any way to write kernels or compilers where memory corruption is impossible.

Didn't Microsoft make an experimental kernel with managed code?

Re: A Tale of Two Pwnies (Part 1)

#14
post #9

Earlier quoted context omitted.

The other thing I wonder about is that in 2040, will we be still worrying about buffer overflows?

I really doubt that we'll be using programming environments where memory corruption is possible in 2040.

Here's a paper describing how to escape from a VM using memory errors. They're causing memory errors by putting a lit light bulb close to the memory chips:

http://sip.cs.princeton.edu/pub/memerr.pdf

Neat hack :)

Re: A Tale of Two Pwnies (Part 1)

#15
post #3

So crazy. I wonder how long it took to come up with that attack? There must have been a ton of dead ends along the way.

> A teenage hacker who identified himself only as PinkiePie said he spent the past week and a half working on the attack.

Source: http://arstechnica.com/business/2012/03/googles-chrome-brows...

Re: A Tale of Two Pwnies (Part 1)

#17
post #10

This really takes you into the mind of a hacker(the malicious kind). Judging from what I saw it seems they combine a ton of small exploits to produce a major security breach. The amount of understanding of the underlying system you need to have in order to put these exploits together is mind boggling. What do we do against people like this?

Pay them to find the bugs!

Just don't let them run out of bugs to find, or get bored :P

Re: A Tale of Two Pwnies (Part 1)

#18
post #11
post #9

Earlier quoted context omitted.

I really doubt that we'll be using programming environments where memory corruption is possible in 2040.

someone's gotta write the kernels though, I can't think of any way to write kernels or compilers where memory corruption is impossible.

In theory, it's possible to use a formally verified approach to ensure this can't happen, and there is a lot of research into that.

There is a version of the L4 microkernel that has been formally verified which should prevent memory corruption in kernel space, but I don't know the exact details.

This of course won't prevent corruption due to physical sources, such as radiation, but with physical access to a machine you will always be able to gain access.

Re: A Tale of Two Pwnies (Part 1)

#19
post #16

If you don't have a young girl you might not appreciate the link between "Pinkie Pie" and "Pwnie": http://mlp.wikia.com/wiki/Pinkie_Pie

Somewhat OT, but the show has a fairly sizable periphery demographic (males 13-35), which I would guess the hacker considers himself a part of. More information: http://knowyourmeme.com/memes/subcultures/my-little-pony-fri...

Re: A Tale of Two Pwnies (Part 1)

#20
post #16

If you don't have a young girl you might not appreciate the link between "Pinkie Pie" and "Pwnie": http://mlp.wikia.com/wiki/Pinkie_Pie

Or perhaps not: https://secure.wikimedia.org/wikipedia/en/wiki/My_Little_Pon... :)

Considering that he is a teenage hacker, it's likely that he is a Brony himself.

Post reply on HN