full-disclosure - Re: Using hardware to attack software

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 24 Dec 2011 17:21:02 -0800
From: Gage Bystrom <themadichib0d@...il.com>
To: "Forristal, Jeff" <jeff.forristal@...el.com>,
	full-disclosure@...ts.grok.org.uk
Subject: Re: Using hardware to attack software

While it was slightly interested to read, and I do not doubt the
intention of the whitepaper, I believe it to be nearly useless. All it
is, as they say, is a 'call-to-arms' to add additional classification
of vulnerabilities. Almost all of those attacks described are really
driver attacks. The ones that were not driver attacks was malicious
hardware.(wow I was really fighting myself on the grammar/word choice
on that sentence, but I think it makes sense so screw it).

I do believe that kernel/driver related vulnerabilities should have
better classification in order to identify, exploit, and fix them
better(much in the vein that classifying some code segment as an
integer overflow aids working with memory corruption bugs); however,
because almost all of those are driver bugs, a software issue, I
believe they can hardly be considered 'hardware attacks'.

One slight pet peeve is that 'hardware reflected injection' sounds
just like a lame attempt to create a new buzzword. Saying that failure
for hardware/drivers to sanitize malicious data that can lead to
defects higher up, is like calling the failure to sanitize return
values from nested functions leading to a buffer overflow a 'function
reflected injection' vulnerability. I do not believe that 'function
reflected injection' warrants a classification of it's own just as I
believe that hardware blah blah deserves to be a classification of
it's own.

I still respect their intent, I just think this whitepaper is
completely doing it wrong.

On Fri, Dec 23, 2011 at 2:27 PM, Forristal, Jeff
<jeff.forristal@...el.com> wrote:
> Folks on this list may be interested in a recent whitepaper talking about
> types of attacks that leverage PC hardware to attack local software.
> Hardware reflected injection, anyone?
>
>
>
> Paper is available at
> http://www.forristal.com/material/Forristal_Hardware_Involved_Software_Attacks.pdf
>
>
>
> Thanks, and happy holidays!
>
> - Jeff
>
>
>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/