Authentication vulnerabilities in OpenBSD
We discovered an authentication-bypass vulnerability in OpenBSD’s authentication system: this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms.
Stories Behind Papers: Integer Overflow
Overall, dynamic detection of integer-related undefined behaviors in C/C++ is not difficult, but convincing people to take these bugs seriously was a long struggle and the broader issue of how integer overflows relate to program bugs is interesting and deep.
unarcrypto is an educational tool to depict cryptography usage in zip, rar and 7zip archives
Amazon built one of the world’s most efficient warehouses by embracing chaos
First, random storage makes finding the toothpaste faster in an era of on-demand efficiency. If there were a dedicated “toothpaste shelf” and someone ordered toothpaste, a “picker”—how Amazon refers to employees who gather items—would need to travel there, whether he were 10 feet or 100 yards away from that location. But if the warehouse stores toothpaste in 50 different locations, there’s a much better chance that there’s a tube close to some picker. There’s also a greater chance that the second item the customer ordered is also nearby.
Bad utmp implementations in Glibc and FreeBSD
I wondered: If the files consist of fixed-sized records, and are readable by regular users, how is consistency maintained? That is – how can a process ensure that, when it updates the database, it doesn’t conflict with another process also attempting to update the database at the same time? Similarly, how can a process reading an entry from the database be sure that it receives a consistent, full record and not a record which has been partially updated? (after all, POSIX allows that a write(2) call can return without having written all the requested bytes, and I’m not aware of Linux or any of the *BSDs documenting that this cannot happen for regular files). Clearly, some kind of locking is needed; a process that wants to write to or read from the database locks it first, performs its operation, and then unlocks the database. Once again, this happens under the hood, in the implementation of the getutent/pututline functions or their equivalents.
Building a Language and Compiler for Machine Learning
We need a language to write differentiable algorithms, and Flux takes Julia to be this language. Being designed from the ground up for mathematical and numerical computing, Julia is unusually well-suited for expressing ML algorithms. Meanwhile, its mix of modern design and new ideas in the compiler makes it easier to address the high performance needs of cutting edge ML.
Where typical frameworks are all-encompassing monoliths in hundreds of thousands of lines of C++, Flux is only a thousand lines of straightforward Julia code. Simply take one package for gradients (Zygote.jl), one package for GPU support (CuArrays.jl), sprinkle with some light convenience functions, bake for fifteen minutes and out pops a fully-featured ML stack.
One Windows Kernel
In this blog post, I will talk about the evolution of the core pieces of the Windows kernel that allows it to transparently scale across a low power NVidia Tegra chip on the Surface RT from 2012, to the giant behemoths that power Azure data centers today.
Plasma is an interactive disassembler for x86/ARM/MIPS
PLASMA is an interactive disassembler. It can generate a more readable assembly (pseudo code) with colored syntax. You can write scripts with the available Python api (see an example below). The project is still in big development.
Paseto is a Secure Alternative to the JOSE Standards (JWT, etc.)
Many developers responded to our post with the same question: “What should we use instead of JWT?” Today, I’m happy to announce a viable replacement.
That’s it. There are no levers to pull, buttons to pull, or knobs to fiddle with. You don’t have to worry about the complexity required to use RSA safely. You don’t have to worry if the public key for a given message is even on the curve. Paseto is simple, obviously secure, solves 99% of the use cases for JSON Web Tokens. There is no guesswork; the cryptography aims to be boring.
A Curious Tale of Remote Code Execution, The TP-Link Story – CVE-2017-13772
This post will outline the steps taken to identify vulnerable code paths, and how we can exploit those paths to gain remote code execution. I will start by describing how I found the first vulnerability, the methods taken to develop a full working exploit and then follow this by showing that this vulnerability presents a “pattern” that potentially exposes this device to hundreds of exploits.
Plus some nice notes about exploiting MIPS.
To develop this exploit, there are a few things to note about the Mips architecture. The first is cache in-coherency. This has been covered extensively in other blogs (I suggest http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/). Put simply, if we try to execute shellcode on the stack, the CPU will check if it has data from that virtual address in its cache already, if it does it will execute that, which means whatever was on the stack before we triggered our exploit will most likely get executed. Moreover, if our shellcode has self-modifying properties (IE we use an encoder), the encoded instructions will end up being executed instead of the decoded.
What is the random oracle model and why should you care?
About eight years ago I set out to write a very informal piece on a specific cryptographic modeling technique called the “random oracle model”. This was way back in the good old days of 2011, which was a more innocent and gentle era of cryptography. Back then nobody foresaw that all of our standard cryptography would turn out to be riddled with bugs; you didn’t have to be reminded that “crypto means cryptography“. People even used Bitcoin to actually buy things.
That first random oracle post somehow sprouted three sequels, each more ridiculous than the last. I guess at some point I got embarrassed about the whole thing — it’s pretty cheesy, to be honest — so I kind of abandoned it unfinished. And that’s been a major source of regret for me, since I had always planned a fifth, and final post, to cap the whole messy thing off. This was going to be the best of the bunch: the one I wanted to write all along.
How I accidentally took down GitHub Actions
Commit shorthashes have a major problem: As a repository accumulates a large number of commits, eventually it will contain two commit hashes that start with the same seven characters (and have the same shorthash). After this happens, tools that use shorthashes will start to break because the commit shorthash is ambiguous (it’s no longer a pointer to a single commit). Due to the birthday problem, any repository that has at least 19291 commits is likely to have a pair of ambiguous commits somewhere. So if we waited for the actions/docker repo to have tens of thousands of commits, one of the shorthashes would eventually become ambiguous and break someone’s build.
Your Movements Shall Be Traced: The New EU Regulation on Cross-Border Portability
However, the Regulation does not contemplate the possibility that users would wish to opt out of cross-border portability (e.g., in the example above, that the Estonian user would wish to forego access to Estonian Netflix programming while he is temporarily present in Belgium). Article 7.1 explicitly precludes users from contracting out of cross-border portability
Didn't know double frees are back.
Turns out new versions of Ubuntu use tcache, which means there’s a fast path for malloc/free without any safety checks. Pretty cool and trivially exploitable in many cases.
Comcast Has a Point on Pay Equity Bill
In early December, City Council unanimously approved a pay equity bill sponsored by Councilman Bill Greenlee that would prevent employers from asking prospective employees what they’ve earned in the past.
Though the city tried to model the pay equity bill after a similar Massachusetts bill that was widely accepted, Hawkins argues that there’s a big difference between the two bills that may be rubbing the business community the wrong way.
ripgrep code review
Recreating Asteroids with Lasers
Amazing. Hardware vector graphics. Plus a great explanation and demo of how it all works.
Spectre is here to stay: An analysis of side-channels and speculative execution
An Adaptive Packed-Memory Array
The packed-memory array (PMA) is a data structure that maintains a dynamic set of N elements in sorted order in a Θ(N)-sized array. The idea is to intersperse Θ(N) empty spaces or gaps among the elements so that only a small number of elements need to be shifted around on an insert or delete. Because the elements are stored physically in sorted order in memory or on disk, the PMA can be used to support extremely efficient range queries.
Eating the World Every Morning
Stories and pictures of breakfast.
Including breakfast burritos? Including breakfast burritos.
The Frontier burritos are notoriously hefty, filling a large dinner plate, but the eggs, golden hash browns, crispy bacon, cheddar cheese, and hot green chile all wrapped in a homemade tortilla are beckoning, and I devour the entire thing.