Splitting atoms in XNU
googleprojectzero.blogspot.com
Splitting atoms in XNU
1–10 of 37 posts
Re: Splitting atoms in XNU
#2That is one contrived exploit.
Re: Splitting atoms in XNU
#3Blows my mind that there’s people who figure this stuff out. Do they just spend their day to day time at work attempting all sorts of variations of this kind of stuff? How often does discovery or research like this lead to a dead end?
Re: Splitting atoms in XNU
#4Blows my mind that there’s people who figure this stuff out. Do they just spend their day to day time at work attempting all sorts of variations of this kind of stuff? How often does discovery or research like this lead to a dead end?
> Do they just spend their day to day time at work attempting all sorts of variations of this kind of stuff?
Yep.
> How often does discovery or research like this lead to a dead end?
Orders of magnitude more than the successful paths these days.
Re: Splitting atoms in XNU
#5That first paragraph is a ride and a half.
Props to Project Zero. There's some seriously talented people on than crew.
Re: Splitting atoms in XNU
#6Blows my mind that there’s people who figure this stuff out. Do they just spend their day to day time at work attempting all sorts of variations of this kind of stuff? How often does discovery or research like this lead to a dead end?
Apple pays handsomely for bugs, they have a bug bounty program (1). At some point there are fewer and fewer exploits and the system becomes harder to crack. All companies who care about security should have security bounty programs.
https://motherboard.vice.com/en_us/article/qvapxq/apple-ipho...
Re: Splitting atoms in XNU
#7I just noticed that they renamed Project Fi to just Google Fi. When I first saw this post, due to Project in the name I thought it was Google Fi. Good on them for changing the name. Maybe it's a sign that Google will be more consistent in their naming in the future.
Re: Splitting atoms in XNU
#8I just noticed that they renamed Project Fi to just Google Fi. When I first saw this post, due to Project in the name I thought it was Google Fi. Good on them for changing the name. Maybe it's a sign that Google will be more consistent in their naming in the future.
I'm surprised they're still using a blogspot subdomain . Something like zero.google or projectzero.google would work (with redirects for existing links)
Re: Splitting atoms in XNU
#9That first paragraph is a ride and a half. Props to Project Zero. There's some seriously talented people on than crew.
Indeed, the most impressive part of this is that it's actually half a dozen different exploits carefully chained together to produce the final result. I can't even imagine the amount of perseverance required for each single sub-exploit. Mad props.
Re: Splitting atoms in XNU
#10It would be interesting to see how many of these bugs would be possible if an operating system written in Rust would be used.
I would treat any code allocating / deallocating / moving / locking memory by hand instead of using higher level constructs unsafe now that we know that it's possible to automate checking safety of the operations.