If we are checking every pointer at runtime how isn't this dog slow?
[deleted]
Memory Integrity Enforcement
21–30 of 259 posts
Re: Memory Integrity Enforcement
#22This is really impressive. It’s my understanding that this won’t protect you in the case where the attacker has a chance to try multiple times. The approach would be something like: go out of bounds far enough to skip the directly adjacent object, or do a use after free with a lot of grooming, so that you get a a chance of getting a matching tag. The probability of getting a matching tag is 1/16. But this post doesn’…
Even with Android MTE, one of the workarounds was probabilistic attacks on the small tag size, which imply multiple tries. One of the big distinctions here is uniform synchronous enforcement, so writes trap immediately and not on the next context switch.
Re: Memory Integrity Enforcement
#23I think hackers are not ready for the idea that unhackable hardware might actually be here. Hardware that will never have an exploit found someday, never be jailbroken, never have piracy, outside of maybe nation-state attacks. Xbox One, 2012? Never hacked. Nintendo Switch 2, 2025? According to reverse engineers... flawlessly secure microkernel and secure monitor built over the Switch 1 generation. Meanwhile NVIDIA's…
Saying "never" is too bold. But it's definitely getting immensely difficult. There are still plenty of other flaws besides memory unsafety to exploit. I doubt that we'll see like a formally proven mainstream OS for a long time.
Those flaws get harder the more restricted devices are.
Re: Memory Integrity Enforcement
#24This is really impressive. It’s my understanding that this won’t protect you in the case where the attacker has a chance to try multiple times. The approach would be something like: go out of bounds far enough to skip the directly adjacent object, or do a use after free with a lot of grooming, so that you get a a chance of getting a matching tag. The probability of getting a matching tag is 1/16. But this post doesn’…
Even with Android MTE, one of the workarounds was probabilistic attacks on the small tag size, which imply multiple tries. One of the big distinctions here is uniform synchronous enforcement, so writes trap immediately and not on the next context switch.
Yeah that’s really good.
That makes the probability work against the attacker really well. But it’s not a guarantee
Re: Memory Integrity Enforcement
#25If we are checking every pointer at runtime how isn't this dog slow?
The chip does it by itself, in parallel to its other operations.
Re: Memory Integrity Enforcement
#26This is by far the best selling point of the new series of devices.
Re: Memory Integrity Enforcement
#27I think hackers are not ready for the idea that unhackable hardware might actually be here. Hardware that will never have an exploit found someday, never be jailbroken, never have piracy, outside of maybe nation-state attacks. Xbox One, 2012? Never hacked. Nintendo Switch 2, 2025? According to reverse engineers... flawlessly secure microkernel and secure monitor built over the Switch 1 generation. Meanwhile NVIDIA's…
>Xbox One, 2012? Never hacked.
Not publicly :)
Re: Memory Integrity Enforcement
#28I think hackers are not ready for the idea that unhackable hardware might actually be here. Hardware that will never have an exploit found someday, never be jailbroken, never have piracy, outside of maybe nation-state attacks. Xbox One, 2012? Never hacked. Nintendo Switch 2, 2025? According to reverse engineers... flawlessly secure microkernel and secure monitor built over the Switch 1 generation. Meanwhile NVIDIA's…
I would deeply, strongly caution against using public exploit availability as any evidence of security. It’s a bad idea, because hundreds of market factors and random blind luck affect public exploitability more than the difficulty of developing an exploit chain.
Apple are definitely doing the best job that any firm ever has when it comes to mitigation, by a wide margin. Yet, we still see CVEs drop that are marked as used in the wild in exploit chains, so we know someone is still at it and still succeeding.
When it comes to the Xbox One, it’s an admirable job, in no small part because many of the brightest exploit developers from the Xbox 360 scene were employed to design and build the Xbox One security model. But even still, it’s still got little rips at the seams even in public: https://xboxoneresearch.github.io/games/2024/05/15/xbox-dump...
Re: Memory Integrity Enforcement
#291988 called and wants it memory tagging back https://www.devever.net/~hl/ppcas !
But yeah this was support for a the longest time by IBM basically. It's nice to see it's getting more widespread.
Re: Memory Integrity Enforcement
#30This is the opposite of fun computing. This is commercial computing who's only use case it making sure that people can send/receive money through their computers securely. I love being able to peek/poke inside and look at my processes ram, or patch the memory of an executable. All this sounds pretty impossible on Apple's locked down systems.
They're not so much general purpose computers anymore as they are locked down bank terminals.