stevemk14ebr

Checkout the shadow stack used for CET (control flow enforcement technology). It is literally this idea

Can someone ELI5 please? My field is low level computer systems, and unfortunately that knowledge does not extend to low level physiological processes!

Also see https://blog.can.ac/2021/03/22/speculating-x86-64-isa-with-o...

I like it alot. Feels straight edged and modern

Calling a sync function from an async when using the tokio executor is literally documented as a thing you should not do. Furthermore if you want to then spawn a task or whatever it's called, which is the documented way to do this safely, then you have to capture with static lifetime. That is a hard guarantee to provide for sufficiently complex code! Rust is definitely colored, and it's not as simple as just spawning an executor

This is big. I was a user of the pre-release and had a nice experience. So happy to see this as being taken seriously by the team

'Yes, it looks simple at the surface. It most likely isn't' my point is the issue is simple, as the article proves.

it _is_ simple, as evident by the article if you read it in full

Here my C++ defer implementation https://twitter.com/stevemk14ebr/status/1347408381301190658?...

It can definitely be said that this may be an indicator of a larger security issue at the company. But assuming that issue is the cause for the backdoor, yes that is a leap, and an unfounded one. Correlation != Causation, and it's always unreasonable to assume otherwise.

I think this twitter thread is a very reasonable analysis of this article: https://twitter.com/pwnallthethings/status/13602327536236298.... I think critically there are a lot of claims here, and none of them provide _concrete_ proof of any form. There's a lot of 'senior official said X' and X number of people in the know declined to comment, but these are just appeals to authority/credentials. People are flawed and second hand rumours of rumours can easily bend the truth. I don't think it's necessarily fair to put out a story claiming this is 'the truth' when alot of the sourcing is indirect and 'declined to comment'. It's just not there with the facts! True or not, we can't know, but this report need more facts.

The attack is unique in its usage of the supply chain. The malware is not 'sophisticated' in the same way stuxnet is because it has different goals. This actors goals align with stealth above all else, which is evident in both the design of the malware and the choice of the supply chain delivery vehicle. Also realize that the network comminication scheme used attempts to blend in with the legitimate SolarWinds software. If you design a stuxnet like malware and deploy it to 18k+ companies it will be found, because exploiting zero days left and right is super noisey. This malware was minimal. It's cool in a different way

It's not a zero sum game. It is interesting in that it marks the first _wide spread_ attack on a supply chain via cyber space. The malware's DNS signaling protocol is pretty neat, which you can look at here: https://www.fireeye.com/blog/threat-research/2020/12/sunburs...

The whole weak password thing was simply a funnily timed thing some guy found. It had absolutely nothing to do with the malicious update, which was the source of this supply chain attack. For some reason a bunch of people online decided that two things happening around the same time means they are related. They are not

'but I wouldn't fault Twitter for not rewarding this'

I would. A researcher who may do this for a living did not get paid for valid work they did. By definition that is a scam. And it flys in the face of what a bug bounty program is supposed to insentivise. Every unpaid report is a signal to not submit other valid bugs, undermining the whole program.

Getting _a_ signing key is not equal to having access to SolarWind's signing key. It is interesting because it shows the extent of the breach.

This is almost certainly just a funny and unfortunate coincidence. The malicious binary was signed, you can't do that with just FTP upload access. The code looks to be injected at build time according to this report by reversing labs: https://blog.reversinglabs.com/blog/sunburst-the-next-level-...

'Signing occurred within a minute of library compilation. That leaves no time for the attackers to be able to monitor the build system, replace the binary and change the metadata to match this perfectly. The simplest way for all these timestamp artifacts to align perfectly is to have the attackers’ code injected directly into the source, and then have the existing build and signing system perform the compilation and release processes as defined by the Orion software developers.'

we're programmers, anything can be done with enough time or money

This doesn't work if source code is not available. I can get a trace of the function calls but no arguments, or return values or anything. This makes it entirely useless as a reverse engineering tool, something i was very excited to use it as due to it essentially being a tracer. It also NEEDS modern java support.

I'm in the security field and do work similar to this professionally. This article it poorly written and i found the videos shown absolutely useless. If you want to see how technical articles should read, take a look at j00ru's blog (research that found this). That is how you write about this stuff.

if you place the data at the end of the trampoline it avoids these issues of mixing data and code, it's like a little custom data segment you make since you have to allocate the trampoline anyways. This is what i do in my lib. The disp is after the jmp the trampoline uses to jmp back to the original. The original function only has the jmp [disp] and no data is mixed.

yes there is. \x25\xff\x00\x00\x00\x00 where 0 is a 32 bit displacement to a memory location that contains a 64 bit constant is what i use: jmp [disp] but you need to be able to place the constant +- 32bits. This is really hard for x64 on windows, since VirtualAlloc gives you no guarantees, i used to walk pages manually now i just new/delete in a loop and hope for the best.

There's also:

push rax

mov rax, 0xDEADBEEFDEADBEEF

xchg qword ptr ss:[rsp], rax

ret

but i dont like it as much since it touches stack (technically more detectable since you overwrite stuff at rsp - 8). RSP & RAX are original values after that gadget though.

Also fun fact. My library supports JIT-ing, so you can create the stub that the hook jmps to at runtime and it will JIT translation logic for the calling convention and pack the args + ret value into a structure that can be modified. So you can hook unknown functions at runtime.

I wrote a hooking library that implements the methods talked about, plus a bunch more it doesn't. As well as handle a bunch of edge cases not mentioned: https://github.com/stevemk14ebr/PolyHook_2_0

There's similar, and smaller (no llvm) library that i like alot: https://github.com/asmjit/asmjit

wireless power exists already? Is this the same tech:

https://www.youtube.com/watch?v=YeNXRD8eziA&t=0s

Why is this antigen so rare? Is it not something that can be grown and manufactured in a lab. We know of at least a few people that produce it naturally, have studies been done to simulate the process that occurs naturally?

How would this work? What does it mean to be "made of" a black hole

Good find. This should be linked in the readme