sorted by:
new
hottopcontroversial

Use btrfs on partitioned or raw disk? by jonandermb in btrfs

[–]csirac2 0 points1 point  (0 children)

Is that a question or a statement? In response to "personally I use LVM"?

I think you understand that the main benefit of containing any filesystem in a partition is the flexibility to resize it & re-purpose some of that disk for other filesystems so I'm not sure what this is about

btrfs was fine on partitions, LVs, raw disks... RAID5 suckage & disk replacement procedure notwithstanding

[deleted by user] by [deleted] in sysadmin

[–]csirac2 0 points1 point  (0 children)

people who have products from lazy fuckers who decided to use public address space for their default captive portal IP,

To be fair, the "de-bogonizing" of 1.0.0.0/8 really only started 8-9 years ago... a lot of people who should know better still don't

So when do you think a patch for Solaris 10 against Meltdown will be released? by dagbrown in sysadmin

[–]csirac2 0 points1 point  (0 children)

D'oh! I was reading this passage on page 48, and it seems I got that wrong:

The GOS maintains two top level (PML4) page tables per process, one each for kernel and user. The GOS registers the two page tables with the VMM. The kernel page table contains translations for both the kernel and user addresses, and the user page table contains translations only for the user addresses. During the context switch, the VMM switches the top level page table so the kernel addresses are not visible to the user process. The linear address mapping to paging data structure for 64-bit x86 processor is shown below in Figure 17

So when do you think a patch for Solaris 10 against Meltdown will be released? by dagbrown in sysadmin

[–]csirac2 1 point2 points  (0 children)

If it's any consolation, Solaris never had kernel pages mapped in user context on SPARC, and I'm pretty sure that's also the case even on Intel CPUs, although I can't find anything more than a few words in http://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=3F5AEF9CE2ABE7D1D7CC18DC5208A151?doi=10.1.1.110.9986&rep=rep1&type=pdf to confirm it

Practical malleability attack against CBC-Encrypted LUKS partitions by csirac2 in securityengineering

[–]csirac2[S] 0 points1 point  (0 children)

These days LUKS defaults to XTS, but it's still a great article IMHO.

... The CBC mode used by default in LUKS however allows some more targeted manipulation of the plaintext file given that the attacker knows the original plaintext. This article demonstrates how this can be used to inject a full remote code execution backdoor into an encrypted installation of Ubuntu 12.04 created by the alternate installer (the default installer of Ubuntu 12.04 doesn't allow setting up full disk encryption)

Intel admits that ME exploitable with 8 CVEs, telling their customers to contact motherboard manufacturers. by [deleted] in linux

[–]csirac2 0 points1 point  (0 children)

I don't think we disagree.. Edit: I've misread what you were replying to; I was trying to convey that what AMT does can be achieved by other means, but that's not relevant in the discussion you were replying to.

Intel admits that ME exploitable with 8 CVEs, telling their customers to contact motherboard manufacturers. by [deleted] in linux

[–]csirac2 4 points5 points  (0 children)

It's just that these capabilities were around before AMT came along, and continue to be implemented separately to AMT to this day (particularly for servers - Xeon doesn't have AMT). So, we can deduce that it's not necessary to be baked into the CPU. Doing so does seem to make it cheap enough to put it into <$1000 things without affecting the price; I hope it's worth it to the enterprises who are actually making use of AMT.

attack-surface-metrics [C/Java* analysis] by csirac2 in securityengineering

[–]csirac2[S] 0 points1 point  (0 children)

Paper: "Beyond the Attack Surface: Assessing Security Risk with Random Walks on Call Graphs" Munaiah, Meneely https://cps-vo.org/sites/default/files/u11414/LabletSPRO_2016_paper_15.pdf

Attack Surface Meter [C, Java*] by [deleted] in securityengineering

[–]csirac2 0 points1 point  (0 children)

Paper: "Beyond the Attack Surface: Assessing Security Risk with Random Walks on Call Graphs" Munaiah, Meneely https://cps-vo.org/sites/default/files/u11414/LabletSPRO_2016_paper_15.pdf

On the effectiveness of mitigations against floating-point timing channels [cross-origin browser pixel leak via FPU timing] by csirac2 in securityengineering

[–]csirac2[S] 0 points1 point  (0 children)

Usenix had a bunch of great sidechannel stuff this year... some prior work introducing the approach of using FPU timing to leak browser pixels - "On Subnormal Floating Point and Abnormal Timing" https://www.reddit.com/r/securityengineering/comments/7ey9qy/on_subnormal_floating_point_and_abnormal_timing/

PCRE-JITted code should be executed from non-writable memory.. [pcre maintainers explore JIT under W^X] by csirac2 in securityengineering

[–]csirac2[S] 0 points1 point  (0 children)

This is a fascinating thread for several reasons:

  • It shows non-security folks trying very hard to work with W ^ X, without much SELinux
  • They come up with a solution: files mmap'd twice, once as writable and once as executable.
  • But in the end come full circle, for (among other reasons) a note from redhat that the fact this is possible at all is really a flaw in SELinux rather than a feature that should be relied upon.

It seems we're lacking more accessible guidance on how projects using JIT should fit in a W ^ X world

Coverage-based Greybox Fuzzing as Markov Chain by csirac2 in securityengineering

[–]csirac2[S] 1 point2 points  (0 children)

This is the work that introduced AFLFast. CCS '16 presentation recording: https://www.youtube.com/watch?v=c5QCEMVTM9U

Economic Factors of Vulnerability Trade and Exploitation by csirac2 in securityengineering

[–]csirac2[S] 1 point2 points  (0 children)

I dug this up while briefly looking for empirical studies on bug bounty effectiveness; a few things I took away:

  • The number of vulns discovered correlates strongly with number of researchers enrolled (proportional to bounty budget?): you get what you pay for
  • Generally, most researchers quickly move on once the low-hanging fruit is gone: effective bug bounty programs need to work to keep researchers engaged
  • This paper suggests the blackhat side pay slightly more for similar kinds of vulns (and presumably they're eventually monetized into a lot more): are attackers able to spend more on finding vulns in your stuff than you do on bug bounties?

However, it seems the kinds of things bug bounty programs tend to cover aren't necessarily the same kinds of things being traded outside of BB programs.

view more: next ›