Hacker News Reader

Comment by athrowaway3z | Hacker News Reader

A glance at the nmap one seems potentially high severity. It might be a nothing in practice, but it being around parser code means the chances of preparing something to jump around are pretty high.

There'd be a certain irony being able to reverse shell anyone doing an nmap scan. If i had infinite tokens i'd throw claude on writing an exploit and dig through the history who made it possible because - if we take a moment to wildly speculate and assume it can ACE - this is the kind of bug an intelligence agency would love to have: Add a few ipv6 packets that then edit the trace being observed if the observer uses nmap / get access to any researcher pc who uses nmap.

View on HN

Wireshark dissectors (protocol decoders) are basically all written in C, and anyone sending packets can pick a dissector.

I'm more worried about AV software. Code that also needs to be able to parse a large number of file formats, opens every file that enters your computer through one of many pathways, and generally runs at a high privilege level. A huge attack surface that's easy to reach and with far reaching consequences if it can be exploited. Add to this that it's in wide use, often even mandated by corporate IT and its recipe for disaster.

> I'm more worried about AV software

Media codecs pretty much, single-handedly even, drove about a new era of defenses and mitigations in Android: https://blog.isosceles.com/the-legacy-of-stagefright / https://archive.vn/x3d0Y

AV as in antivirus, not audio/visual

In theory the parsing could run at a low privilege level subprocess. Root/admin is only needed to get the bytes.

That’s generally too slow though; these things run in kernel space as they scan every I/O stream. Context switching and memory copies would kill performance.

https://i.imgur.com/t5jDXrt.png

"Why don't we unpack malware in the kernel" - "And so the search for intelligent life continues..."

These kind of tools have always had a broad attack surface. I've assumed state level actors already have exploits for them, mostly based on when I've used such tools for mundane network maintenance tasks and somehow do something that triggered an old-fashioned segfault.

>There'd be a certain irony being able to reverse shell anyone doing an nmap scan.

Every TV / movie hacker has known about this.

Reply on news.ycombinator.com