The Memory Sinkhole - Unleashing An X86 Design Flaw Allowing Universal Privilege Escalation

What people said

sabas123 · 2022-07 · Recommendation

This is a thing and was used in this fantastic piece: [VIDEO] However the way they obtained these dumps is by going deep into debugger mode of the cpu which makes me doubt anything spooky would be going on.

Read the original HN comment ↗

throwaway47292 · 2021-12 · Reference

I can make an argument that money will make it even worse, as people will full-time make even more useless features that just increase the attack surface. This particular class of problems (same as the sqlite fts tokenizer exploit and most of openssl exploits, even lots of the sendmail exploits) are just obscure unused features. It happens even in CPUs themselves. (e.g. [VIDEO] ) Removing code is twice harder than adding code, why do you think paid maintainers would improve anything? Just look at the code written in FAANG or any enterprise, and those maintainers are very well paid, imagine this code being public, we will have 1 new exploit per day per company... and that is assuming non malicious developers that can be shipping trojan code [LINK] (it is also hard to assume all millions of developers are non malicious, even if we assume 1 in 100000, things look really bad) Less code is the one solution. Regardless if open source or enterprise code. We are stuck, and change is needed, but money is not a solution, and might even be the cause of the problem. (incentive to write more code)

Read the original HN comment ↗

rasz · 2021-06 · Criticism

Chris Domas works at Battelle Memorial Institute. Battelle is a "non profit R&D house" that just so happens to hire "retiring" CIA operatives, and work on tons of CIA/NSA contracts. Completely coincidentally Chris Domas managed to discover the only Intel CPU backdoor ever discovered and publicized the very same year Intel already patched it [VIDEO]

Read the original HN comment ↗