robertdfrench

6 ms·

1.
by robertdfrench 4mo ago
that's what Big POSIX wants you to think pal
2.
by robertdfrench 4mo ago
Ohhh I had no idea about hwcaps! This is great! That is the way to solve this problem.
3.
by robertdfrench 4mo ago
I have a conspiracy theory, unsupported by facts, that Richard Stallman secretly invented POSIX as a way to get the proprietary UNIX vendors to waste time on something whose only value was to make it easier for folks to port their apps to G
4.
by robertdfrench 4mo ago
I think .init_array is too late in the game. ifunc lets you hijack the loader, because it is sort of like a plugin or dynamic config for the loader itself. Everything should be loaded and resolved by the point that .init_array stuff starts
5.
by robertdfrench 4mo ago
You may well be right about this! What I genuinely don't understand then, is why Jia Tan relied on ifunc rather than POSIX constructors. Seems like that would have been easier and more widely applicable, right?
6.
by robertdfrench 4mo ago
I don't have any secret information! Folks were giving me a hard time about claiming that ifunc is central to this attack , and I would genuinely find it valuable to know that Jia Tan could have (for example) performed this attack aga
7.
by robertdfrench 4mo ago
I've updated the post and am offering $500 if you can pull this attack off without ifunc.
8.
by robertdfrench 4mo ago
Take my money!!
9.
by robertdfrench 4mo ago
I take your meaning, but I think a threat actor targeting a system without IFUNC would be delighted if it suddenly showed up. It's like finding a website with a file upload form that purposefully supports ../ in paths.
10.
by robertdfrench 4mo ago
I do not think the OpenSSH folks are at fault! I was trying to drive the point that OpenSSH was forced to work in an environment that is very, very different from where it is primarily developed. I don't think the OpenSSH folks should
11.
by robertdfrench 4mo ago
> The game was lost as soon as the attacker had arbitrary code installed in a semi-common library. That is not quite true! You still have to get the code to be executed . I can call dlopen on a malicious library, load it into my address