5 ms·

This is cool, can someone do the same for Python? (And other languages?)

• Deestan 15y ago
  Yes. This is a trivial exploit of a designed weakness in hashtables. I shall, arrogant as I am, scoff at people who are surprised when this happens. I mean, honestly, what kind of developer doesn't know the basic properties of their data structures?
  • mdwrigh2 15y ago
    Well, this isn't exploitable if you use a randomized hash function like Ruby 1.9 does. See http://www.ocert.org/advisories/ocert-2011-003.html http://www.ocert.org/advisories/ocert-2011-003.html for a listing of vulnerable languages (and yes, Python is on the list).
    • chc 15y ago
      You make it sound like you're somehow disagreeing with him, but what he says is true even of Ruby's hash algorithm. Introducing randomness into the hash function is really just a band-aid on this vulnerability. The inherent vulnerability is there either way; you just need a bit of runtime information to do the attack when runtime information is introduced into the hash function.
  • zerothehero 15y ago
    I meant actually give code for the exploit.