firer

6 ms·

1.
by firer 1mo ago
Exactly! Hopefully going to get around to it next weekend :) Also, although you can't trivially cross wires, you can create a wire crossing using a few XOR gates [1] [1] https://cs.stanford.edu/people/eroberts&#x2F
2.
Video2NAND – Abusing video codecs for great computational power(sharedobject.blog)
90 points by firer 2mo ago|21 comments
3.
by firer 2mo ago
Hah, not trying to pass off as human. Just communicating with my fellow men in black ;) To be as explicit as possible: whether disclosing this publicly actually did more good then harm is not that clear cut. Even if accounting for all the s
4.
by firer 2mo ago
All too common... It's sad yet understandable how a company would not prioritize security. At the same time, it's also understandable how a security start-up, upon (rightly) getting fed up waiting, decide to publicly disclose, as
5.
by firer 4mo ago
From what I understand, the copy fail bug was found by researcher who noticed something weird and then using AI to scan the codebase for instances where that becomes a problem. I bet that with a slightly looser prompt/harness, the LLM
6.
by firer 4mo ago
There are two vulnerabilities here. The RxRPC one is definitely a different root cause (although caused by a very similar mistake). For the ESP one it's a bit harder to tell. I don't think the wrong thing was fixed, just that ther
7.
by firer 4mo ago
SUID mitigations have nothing to do with the vulnerability itself - just the exploit. If there's a root cronjob that runs a world readable binary, you could modify it in the page cache and exploit it that way. Modifying the page cache
8.
by firer 4mo ago
My immediate reaction was the same. But this is very similar to Copy Fail, and I'm assuming there was an assumption that others might also discover this soon as well. Hence the urgency. At least that's my charitable interpretation
9.
by firer 4mo ago
This is very similar in root cause and exploitation to Copy Fail. Which illustrates pretty well something that's lost when relying heavily on LLMs to do work for you: exploration. I find that doing vulnerability research using AI rea
10.
by firer 5mo ago
System partitions being non-writable has nothing to do with the vulnerability - it allows modifying the cache of any file that you can open for reading. Not using setuid anywhere means you'd have to build a slightly more clever exploit
11.
by firer 5mo ago
Yeah, totally agree now that I've looked into it more. > If OSS models are equally up to the task, why not find novel vulnerabilities? To be fair, in the same blog post Anthropic mentioned costs in the tens of thousands of dollars p
12.
by firer 5mo ago
> Open source models found the same bugs? Sure, if you tell them "here is a for which may contain a vulnerability, look for a big in how function XYZ handles ABC" In one of Anthropic's blog post, they describe that that&#x
13.
by firer 5mo ago
Security efforts are not evenly distributed, even within a single project. This includes both the thinking that the developers put in, and the scrutiny given to a piece of code by researchers. The initial batch of publicly disclosed vulnera
14.
by firer 10mo ago
I agree with the general sentiment, but it seems fair to me that an old "lifetime" license won't have access to new features.
15.
by firer 2y ago
I love this stuff. If anybody wants another outlandish example here is an emulator I built: https://github.com/DanielFi/sqlite-vm/blob/main/emulator.sql
16.
by firer 2y ago
Fuzzing data flow separately from control flow is an interesting idea I can believe that it dramatically speeds up finding certain bugs, but I doubt that it can reach a large class of complex vulnerabilities, which in the case of high value