full-disclosure - Re: Using hardware to attack software

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJVRA1RHr89QtKHrbEHRM0=_9Er_SfeDj6yaGvRM-1XfHhR4_Q@mail.gmail.com>
Date: Tue, 27 Dec 2011 15:28:50 -0800
From: coderman <coderman@...il.com>
To: Gage Bystrom <themadichib0d@...il.com>
Cc: "Forristal, Jeff" <jeff.forristal@...el.com>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Using hardware to attack software

On Tue, Dec 27, 2011 at 2:30 PM, Gage Bystrom <themadichib0d@...il.com> wrote:
> ... My main criticisms
> involved presentation of your work that I believed could wind up coining
> useless buzz words, proliferation of bad terminology, and enforcing
> incorrect paradigms.

in infosec they call this "putting your mark on the world"

for those who play the game this is a feature, not a bug!

> ...
> Perhaps refocusing the paper around some sort of 'driver vulnerability
> taxonomy', or as you said was intended 'overlooked/poorly understood driver
> attacks'...

*yawn* when was the last time physical or emissions security was interesting?

even side channels are second tier these days. the microcomputer is a
microcosm of distributed systems, with rich attack surfaces at every
layer from bios to firmware to embedded components and offload systems
(themselves a fractal iteration of general purpose computing, within
general purpose computing, within...)

all before you even get to the software interfacing with this
malleable hardishsoftyware or the applications running top side.

turtles all the way down!
 with vuln crumbs or exploit feasts spanning decades, depending on
specialization and isolation of the technologies at hand.

> I hope that is clear as I sometimes have a bad habit of rambling.

your analysis is succinct and sane!
   this, however, is a negative sign given the subject at hand...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/