https://padlet.com/yongari0308/s6bcbpl49w3wflsu en-us 2022-02-22 06:53:24 UTC 2024-06-04 12:33:39 UTC hello@padlet.com yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059984446 writing quality sometimes poor]]> 2022-02-22 06:53:52 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059984446 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059984727 mitigation not convincing]]> 2022-02-22 06:54:08 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059984727 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059984848 dict. read optimization not evaluated]]> 2022-02-22 06:54:16 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059984848 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059985160 repetitive reading to avoid catastrophic error propagation -> not evaluated]]> 2022-02-22 06:54:28 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059985160 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059985508 general idea (exploit reflection) is obvious]]> 2022-02-22 06:54:48 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059985508 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059991571 contribution is small]]> 2022-02-22 06:59:17 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059991571 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059992634 straw-men alternatives]]> 2022-02-22 07:00:13 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059992634 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059993597 the attack would be most plausible cross-VM, but only demonstrated cross-process]]> 2022-02-22 07:00:53 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059993597 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059995050 only demonstrated python&meltdown, even though it claims it works on many languages and vulnerabilities]]> 2022-02-22 07:02:03 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059995050 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059995396 reletively little content]]> 2022-02-22 07:02:23 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059995396 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059996076 relatively little attention to mitigation -> not a good fit for DSN]]> 2022-02-22 07:02:55 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059996076 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059998345 too many assumptions:
read kernel objects and victim process
-> with these assumptions, why need this approach in the first place?]]> 2022-02-22 07:04:31 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2059998345 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060000272 minor issues:
- what are 'initial metaobjects' exactly?
- global variable name: 'secret_key']]> 2022-02-22 07:06:09 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060000272 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060002194 too many assumptions: break KASLR, extract page table, victim process layout similar with local process]]> 2022-02-22 07:07:41 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060002194 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060005129 key techniques are unclear
1. breaking KASLR
2. pre-inspection of initial metaobj. location]]> 2022-02-22 07:10:03 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060005129 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060006867 evaluation needs clarification
1. how JIT-ROP exactly?
2. 527.84MBs vs 1,892 bytes?]]> 2022-02-22 07:11:04 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060006867 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060007787 limited information about performance (in terms of speed) of the attacks]]> 2022-02-22 07:11:49 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060007787 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060036112 first approach to apply data leakage techniques on extracting dynamic, complex data objects (which many modern language systems exhibit)
+ even possible with only black-box query access

does not require any more assumptions from the underlying data leakage primitive, other than the existence of reflection.
+ these primitive by themselves are insufficient, needing a clever way to optimize and prune the data subject to extraction]]> 2022-02-22 07:33:02 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060036112 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060058730 1. KASLR can be exploited with primitive
2. page tables can be made 'hot' by black-box queries
3. pre-inspection can be done in the victim machine (*clarify in paper)]]> 2022-02-22 07:47:34 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060058730 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060070760 *replace case study A. attack on cryptographic library from meltdown&python to foreshadow-ng&javascript]]> 2022-02-22 07:55:59 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060070760 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060074159 *exclude naive approach ('fake metaobject') and elaborate more on later mitigations
+ evaluate mitigation in terms of time & space overhead ]]> 2022-02-22 07:58:27 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060074159 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060075503 *improve naive attack by utilizing page tables]]> 2022-02-22 07:59:26 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060075503 yongari0308 https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060076804 *add 2nd y-axis to figure 6 to denote time/byte]]> 2022-02-22 08:00:23 UTC https://padlet.com/yongari0308/s6bcbpl49w3wflsu/wish/2060076804