lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAM2Hf5kfkKOwmngExDwFzhK74uk54FhRHSnYJLRBJd7A8FJFxA@mail.gmail.com> Date: Sat, 24 Dec 2011 17:21:02 -0800 From: Gage Bystrom <themadichib0d@...il.com> To: "Forristal, Jeff" <jeff.forristal@...el.com>, full-disclosure@...ts.grok.org.uk Subject: Re: Using hardware to attack software While it was slightly interested to read, and I do not doubt the intention of the whitepaper, I believe it to be nearly useless. All it is, as they say, is a 'call-to-arms' to add additional classification of vulnerabilities. Almost all of those attacks described are really driver attacks. The ones that were not driver attacks was malicious hardware.(wow I was really fighting myself on the grammar/word choice on that sentence, but I think it makes sense so screw it). I do believe that kernel/driver related vulnerabilities should have better classification in order to identify, exploit, and fix them better(much in the vein that classifying some code segment as an integer overflow aids working with memory corruption bugs); however, because almost all of those are driver bugs, a software issue, I believe they can hardly be considered 'hardware attacks'. One slight pet peeve is that 'hardware reflected injection' sounds just like a lame attempt to create a new buzzword. Saying that failure for hardware/drivers to sanitize malicious data that can lead to defects higher up, is like calling the failure to sanitize return values from nested functions leading to a buffer overflow a 'function reflected injection' vulnerability. I do not believe that 'function reflected injection' warrants a classification of it's own just as I believe that hardware blah blah deserves to be a classification of it's own. I still respect their intent, I just think this whitepaper is completely doing it wrong. On Fri, Dec 23, 2011 at 2:27 PM, Forristal, Jeff <jeff.forristal@...el.com> wrote: > Folks on this list may be interested in a recent whitepaper talking about > types of attacks that leverage PC hardware to attack local software. > Hardware reflected injection, anyone? > > > > Paper is available at > http://www.forristal.com/material/Forristal_Hardware_Involved_Software_Attacks.pdf > > > > Thanks, and happy holidays! > > - Jeff > > > > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists