lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAJVRA1RHr89QtKHrbEHRM0=_9Er_SfeDj6yaGvRM-1XfHhR4_Q@mail.gmail.com> Date: Tue, 27 Dec 2011 15:28:50 -0800 From: coderman <coderman@...il.com> To: Gage Bystrom <themadichib0d@...il.com> Cc: "Forristal, Jeff" <jeff.forristal@...el.com>, "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk> Subject: Re: Using hardware to attack software On Tue, Dec 27, 2011 at 2:30 PM, Gage Bystrom <themadichib0d@...il.com> wrote: > ... My main criticisms > involved presentation of your work that I believed could wind up coining > useless buzz words, proliferation of bad terminology, and enforcing > incorrect paradigms. in infosec they call this "putting your mark on the world" for those who play the game this is a feature, not a bug! > ... > Perhaps refocusing the paper around some sort of 'driver vulnerability > taxonomy', or as you said was intended 'overlooked/poorly understood driver > attacks'... *yawn* when was the last time physical or emissions security was interesting? even side channels are second tier these days. the microcomputer is a microcosm of distributed systems, with rich attack surfaces at every layer from bios to firmware to embedded components and offload systems (themselves a fractal iteration of general purpose computing, within general purpose computing, within...) all before you even get to the software interfacing with this malleable hardishsoftyware or the applications running top side. turtles all the way down! with vuln crumbs or exploit feasts spanning decades, depending on specialization and isolation of the technologies at hand. > I hope that is clear as I sometimes have a bad habit of rambling. your analysis is succinct and sane! this, however, is a negative sign given the subject at hand... _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists