lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAM2Hf5kfkKOwmngExDwFzhK74uk54FhRHSnYJLRBJd7A8FJFxA@mail.gmail.com>
Date: Sat, 24 Dec 2011 17:21:02 -0800
From: Gage Bystrom <themadichib0d@...il.com>
To: "Forristal, Jeff" <jeff.forristal@...el.com>,
	full-disclosure@...ts.grok.org.uk
Subject: Re: Using hardware to attack software

While it was slightly interested to read, and I do not doubt the
intention of the whitepaper, I believe it to be nearly useless. All it
is, as they say, is a 'call-to-arms' to add additional classification
of vulnerabilities. Almost all of those attacks described are really
driver attacks. The ones that were not driver attacks was malicious
hardware.(wow I was really fighting myself on the grammar/word choice
on that sentence, but I think it makes sense so screw it).

I do believe that kernel/driver related vulnerabilities should have
better classification in order to identify, exploit, and fix them
better(much in the vein that classifying some code segment as an
integer overflow aids working with memory corruption bugs); however,
because almost all of those are driver bugs, a software issue, I
believe they can hardly be considered 'hardware attacks'.

One slight pet peeve is that 'hardware reflected injection' sounds
just like a lame attempt to create a new buzzword. Saying that failure
for hardware/drivers to sanitize malicious data that can lead to
defects higher up, is like calling the failure to sanitize return
values from nested functions leading to a buffer overflow a 'function
reflected injection' vulnerability. I do not believe that 'function
reflected injection' warrants a classification of it's own just as I
believe that hardware blah blah deserves to be a classification of
it's own.

I still respect their intent, I just think this whitepaper is
completely doing it wrong.


On Fri, Dec 23, 2011 at 2:27 PM, Forristal, Jeff
<jeff.forristal@...el.com> wrote:
> Folks on this list may be interested in a recent whitepaper talking about
> types of attacks that leverage PC hardware to attack local software.
> Hardware reflected injection, anyone?
>
>
>
> Paper is available at
> http://www.forristal.com/material/Forristal_Hardware_Involved_Software_Attacks.pdf
>
>
>
> Thanks, and happy holidays!
>
> - Jeff
>
>
>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ