The tension between vulnerability power and exploit technique flexibility

When trying to exploit a memory corruption bug on a reasonably hardened target, there’s a tradeoff around where to invest time. Would it be most efficient to try and find the most powerful, most...

pacibsp.github.io

10,353

sha1lan

sha1lan @sha1lan

28 Dec 2024

"Invariant inversion" in memory-unsafe languages pacibsp.github.io/2024/invar…

“Invariant inversion” in memory-unsafe languages

One way of seeing the difference between memory-safe and memory-unsafe languages is that in a memory-safe language, the invariants used to uphold memory safety only “lean on” invariants that are...

pacibsp.github.io

9,666

sha1lan

sha1lan @sha1lan

2 Nov 2024

Code auditing is not the same as vulnerability research pacibsp.github.io/2024/code-…

Code auditing is not the same as vulnerability research

One thing I’ve often been frustrated by while working on a security team at a large company is a seeming lack of understanding of the difference between code auditing and vulnerability research....

pacibsp.github.io

9,990

sha1lan

sha1lan @sha1lan

26 Aug 2024

Some thoughts on memory safety pacibsp.github.io/2024/some-… This post briefly describes some theoretical aspects of memory safety that feel important to me but that aren't always obvious from how I see memory safety being discussed.

Some thoughts on memory safety

In this post I want to share a few thoughts on some more theoretical aspects of memory safety. These points aren’t necessarily new, but I feel like they’re sometimes underappreciated.

pacibsp.github.io

1,225

sha1lan

sha1lan @sha1lan

12 Aug 2024

Why exploits prefer memory corruption Thanks to @halvarflake and @chompie1337! pacibsp.github.io/2024/why-e…

Why exploits prefer memory corruption

Why do most in-the-wild exploits that target end-user platforms use memory corruption?

pacibsp.github.io

252

19,015