Zooming in on Zero-Click Exploits | Hacker News Reader

Zooming in on Zero-Click Exploits

googleprojectzero.blogspot.com

123 pointsheadalgorithm12 comments

> ASLR is arguably the most important mitigation in preventing exploitation of memory corruption, and most other mitigations rely on it on some level to be effective.

Hmm, not entirely sure I would agree. ASLR can help, sure, but ASLR isn't really that great in the context of other bugs (I guess this could be reworded as "it costs you one extra bug"). That said, Zoom should absolutely be using it, since it's so cheap.

I am with project zero folks on this one.

ASLR is the the important exploit mitigation technique I can think of.

Read-only and no-execute markings?

To prevent JIT Spraying, simply avoid EXecute-Write programs/applicatioms:

- Just-In-Time Compiler

- - JavaScript, in certain mode

- - .NET (Microsoft C# compiler)

- - Java Virtual Machine (JVM)

- - Adobe ActionScript (embedded JavaScript)

- Berkeley Packet Filter (Linux) API

- Adobe Actionscript (Adobe Flash)

As a security architect, you should be extremely mindful of the immense baggage that JIT design comes with.

References

- https://en.wikipedia.org/wiki/JIT_spraying

- https://en.wikipedia.org/wiki/W%5EX

Note that .NET 6 can use W^X now (and use it by default on ARM macOS). I agree W^X is an important security feature every JIT should support (V8, I am looking at you. Google, what's so difficult about this?).

I’m confused what JIT spraying has to do with this post?

if an app can allow WX memory segment (like Zoom), then JIT spray can then be able to occur.

Ok, but where is Zoom using a JIT?

via C# and .NET

there ye go… https://write.as/n5r0vjolumdnuk2k.md

Zoom has always been bad on security (& privacy). That's why prefer to use it in the browser when I really have to.

Unfortunately they (and Teams) are making this harder and harder.

I think it is because Zoom uses Microsoft C# compiler (that .NET uses as well). This compiler makes execute and write to same memory segment possible, no?

I did learn that backends of Zoom are made up of PHP, JavaScript (both server-sid and client-side), Python, CSS, and HTML.

Reply on news.ycombinator.com