201–209 of 209 posts
Earlier quoted context omitted.
They are a security boundary. The fact that you need a vulnerability to escape them is proof of that. They just don't have a particularly high cost of escape because reachable kernel vulnerabilities are so common.
Some people clearly do use containers as deployment mechanism, with security not in mind.
That's not meant to be snide, just true, I think.
Earlier quoted context omitted.
That's right. Docker still runs without user namespaces by default, which means that root is the same user inside and outside of the container. This does open up attack surface and configuration footguns. Confinement still leverages dropping some root caps, seccomp, various other namespaces, etc.
I don't think this is true, otherwise you could just load a kernel module into the host kernel from a container.
Has anyone in infosec ever seen the term "use after free" before LLMs? Or is this basically an acronym claude invented? I say this because I see claude use this term all the time like its common knowledge but in 15+ years in tech never seen it myself. I've seen all kinds of terms used to describe memory errors: memory corruption, heap corruption, stack corruption, whatever, just never this acronym.
Earlier quoted context omitted.
How is it a wide impact? It requires being able to execute arbitrary code on the machine in userspace. If you have that, most of the time you don't even care about kernel level exploits.
It's a browser to kernel full chain exploit, from url click to root your device.
https://nebusec.ai/research/v8-maglev-incorrect-phis-untaggi...
This is the browser part.
Earlier quoted context omitted.
How is it a wide impact? It requires being able to execute arbitrary code on the machine in userspace. If you have that, most of the time you don't even care about kernel level exploits.
https://rootme.nebusec.io/
Please tell me you are trolling me and not this stupid.
Earlier quoted context omitted.
Wonder if it were possible to use this to (finally) jailbreak DJIs original RC that came with the Mini 3 Pro. It doesn't have a web browser or, virtually, anything of use... but I think it supports enough of a web browser to log in into wifi captive portals.
What can you do with a jailbroken drone rc?
Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older). Two boot looped, I had to enter recovery and the other just powered off [0]. The demo modifies the wallpaper on supported Pixel devices. [0] IonStack https://rootme.nebusec.ai ____ Tip: Install a Chromium flavor browser (Chromite) separate from the main browser. Disable Javascript and hardware acce…
It takes a few seconds, and redirects to about:blank
Android 13, last update 3 years ago, firefox 140
Maybe prevented by the JShelter extension?
https://addons.mozilla.org/en-US/firefox/addon/javascript-re...