Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I hardly think that this exploits hardened Linux systems since the JIT it exploits it is currently disabled by default. Maybe it should be titled "Attacking softened Linux systems...".


I think you're missing the point. The kernel module he exploits is also something that no sane sysadmin would choose to load. The technique "JIT spraying" targets JITs, however the broader methodology is "finding places to put stuff in memory without the NX bit set", the JIT used here is just one example. A relatively simple example. There are other things that do this too.

It's much like a "hello world" tutorial. You choose simple goals, use simplified but demonstrative non core parts, and show the overall method/technique/code/whatever in an easily digestible manner.

Further, I think a bigger takeaway than even the technique here is the good use of many different parts, each innocuous on its own, but in combination a path to owning the system. Its a clever combination of side-effects and primary effects, but with goals never considered by the original authors.


That is fine take away and I agree with it and really your whole comment. Except for the missing the point part. The title was inflamatory, link-bait and mostly inaccurate.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: