Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

First public macOS kernel memory corruption exploit on Apple M5

blog.calif.io

Post reply on HN
Print view View original

31–40 of 140 posts

Re: First public macOS kernel memory corruption exploit on Apple M5

#31

Post by steve_adams_86 »

nvr219 wrote: post #25
iqihs wrote: post #22

Earlier quoted context omitted.

you're assuming that blue teams and engineers are sitting around twiddling their thumbs

Most companies in the world do not have “blue teams”. They barely have any kind of security employee.

They've got a guy (who they're considering laying off)

Re: First public macOS kernel memory corruption exploit on Apple M5

#32

Post by UqWBcuFx6NV4r »

steve_adams_86 wrote: post #31
nvr219 wrote: post #25

Earlier quoted context omitted.

Most companies in the world do not have “blue teams”. They barely have any kind of security employee.

They've got a guy (who they're considering laying off)

no they don’t.

Re: First public macOS kernel memory corruption exploit on Apple M5

#33

Post by jermaustin1 »

steve_adams_86 wrote: post #31
nvr219 wrote: post #25

Earlier quoted context omitted.

Most companies in the world do not have “blue teams”. They barely have any kind of security employee.

They've got a guy (who they're considering laying off)

Don't worry the LLMs that are replacing him, are also replacing the hackers too. Pretty soon (if not already), it will just be LLMs fighting LLMs.

Re: First public macOS kernel memory corruption exploit on Apple M5

#34

Post by vsgherzi »

commandersaki wrote: post #28
vsgherzi wrote: post #15

Earlier quoted context omitted.

You shouldn’t, MTE blocks a large chunk of vulnerabilities and makes things like rop and jop very difficult if not impossible now.

I should've added /s.

It’s unironically a good question :)

Re: First public macOS kernel memory corruption exploit on Apple M5

#36

Post by micromacrofoot »

steve_adams_86 wrote: post #31
nvr219 wrote: post #25

Earlier quoted context omitted.

Most companies in the world do not have “blue teams”. They barely have any kind of security employee.

They've got a guy (who they're considering laying off)

in my experience they have a person who does it sometimes when they have time, at best

Re: First public macOS kernel memory corruption exploit on Apple M5

#37

Post by vsgherzi »

aiscoming wrote: post #27
vsgherzi wrote: post #4

Earlier quoted context omitted.

Upon further reading on data only attacks ( https://www.usenix.org/publications/loginonline/data-only-at... ) This makes more sense. You don't trigger MTE since you're not doing anything for force MTE to take action the program isn't actually changing. My other question would be, why didn't apple use fbounds checking here? They've been doing it aggressively everywhere else. MTE plus fbounds checking everywhere should…

could be a different type of data only attack, which doesnt override the boundaries

Well it’s memory corruption so I think it’s pretty safe to assume it’s a bounds issue. I’m not sure if it’s possible to get this with something like type confusion tho I could be wrong here.
Post reply on HN