marcosscriven

Oh yes definitely seen the reachability problem!

Good ideas on the QEMU. I guess you’d have to patch the binary if it’s expecting particular hardware etc?

Not sure what you mean by “desktop shaped”?

Can you give a concrete example of UAF on heap? I’m learning a bit on how this is done, and eventually recognised the LLM is doing something called heap spray. But that seemed to rely on hoping some object you wrote just happened to get interpreted by some process. And that was the “no, wait, pointer f isn’t y” loops.

I get the principle - what I struggle to find is concrete examples of how it can practically be used.

How do you know which pointer (as I say, especially if it’s in the heap)? And I know it can go wrong - but how do you do more than just crash the kernel?

In OOB writes in a stack variable it’s completely clear to me. For other situations I’d love to find real and clearly explained exploits of past UAF or OOB vulnerabilities.

Can anyone explain how use after free results in a practical exploit?

I ask because I’ve been dabbling in rooting various closed devices at home. I’m finding AI fantastic at finding vulnerabilities statically (from firmware upgrade binaries), but when you then ask it to use it to get root or code execution it just goes in circles.

In the end it usually ends up there’s no exploit it can find, because it can’t actually influence the affected memory in a useful way. This is especially so if that memory is in the heap. On the stack it’s a lot more predictable (especially with OOB writes).

By reading articles like this one, for instance?

But it contains the 4090 variant.

Not what I mean at all.

Firstly, the forum site I’m theorising here is not compromised.

Secondly, as I mentioned, in this situation I would limit the URLs it’s allowed to get.

You’d allow the top level of the forum index, and only then allow it to follow links within that site. “Thisissomedata” would be denied anyway.

All I meant was all of these complex limitations still don’t prevent exfiltration.

I agree of course, but those things are all the more obvious ones you can start to attempt to prevent.

Stripping headers, not allowing other than GET requests. Only allows HTTPS etc, the list goes on.

My point was that even if you locked down an agent to only ever read a single forum, and only to be able to access other post URLs that are from that forum, and not allow any query parameters that aren’t necessary etc.

Even then you can be having the slightest public effect that can exfiltrate data - a read count on some old post. I know it’s wildly impractical, it’s more a thought experiment on how hard it it.

Been thinking about this a lot lately, and it’s a surprisingly difficult problem.

All it needs is public access to anything it can have the tiniest effect on, and it can exfiltrate data. Something as simple as a read count on some obscure forum post would be enough, albeit very slow.

Then what’s the point of discussion? You claim all usages should be illegal. I give you what I think shows a valid use.

And what next? The answer is it’s not true? What’s even the point?

Why wouldn’t it be the real reason? You like to assume people are lying?

Yes, it’s the real and ONLY reason I have these. When my flight is over I take them off and revert to regular shades.

I use them alone, in a glider, to help review my own flights. It gives a very helpful PoV, and I can see the instruments and where I was looking.

That should be a crime?

What’s a good provider?