Address space layout randomization

But there were some protections.

Stat Canaries, ASLR, those kind of things.

However, there was no PIE protection.

compiled into those binaries.

Because I forget what all these compiler, I don't keep the memory of what all these compiler flags mean.

But position independent executable means it's a binary built.

It's a compiler flag to build a binary that allows it to run in different memory locations and accounts for that so that when you use ASLR and it randomizes where your memory is mapped, the binary can handle that.

In both these cases, PIE was not compiled into the binary.

But there were some protections.

Stat Canaries, ASLR, those kind of things.

However, there was no PIE protection.

compiled into those binaries.

Because I forget what all these compiler, I don't keep the memory of what all these compiler flags mean.

But position independent executable means it's a binary built.

It's a compiler flag to build a binary that allows it to run in different memory locations and accounts for that so that when you use ASLR and it randomizes where your memory is mapped, the binary can handle that.

In both these cases, PIE was not compiled into the binary.

Because it isn't just brute forcing payloads anymore.

To jump from 29 to 105, the model has to be analyzing the memory layout, recognizing ASLR implementations, and planning the heap spray efficiently.

It learns to recognize dead ends early and pivot its strategy rather than mindlessly fuzzing a binary until the clock runs out.

But

You know, we've got immutable containers, like we're pushing the bleeding edge of how secure you can make an application.

Also, it's just adjacent to a device with a 30-year-old C++ code base, you know, that doesn't have DEP or ASLR or like even the most basic memory protections.

And, like, every couple of months, you know, this device, whatever it might be, I won't name names, there's yet another, you know, remote code execution zero day in this thing.

And it's, you know, we have to use this third-party software on our systems.

but flaws in old code from the nineties, the odds, et cetera.

So,

so, so there is one problem that I often see is that the CBSS score doesn't take into account mitigations, right? Like it's a CBSS 9.8 or 10, assuming, uh, that the attacker can find an ASLR, uh, you know, some way to defeat, you know, some kind of memory protection that's going to be in place on any modern operating system, right? So there are things outside the bug itself that can prevent exploitation that have just become, so just like these frameworks kind of abstract away classes of bugs, we've seen that happen with memory protection in operating systems as well.

you know, and sandboxing in browsers, you know, efforts there.

And just an observation, you know, just to give us whiplash in the other direction, you know, whereas we see, you know, some people, you know, okay, everything we're going to build is in Rust, you know, we've got immutable containers, like we're pushing the bleeding edge of how secure you can make an application.

Also, it's just adjacent to a device with a 30-year-old C++ code base, you know, that doesn't have DEP or ASLR or like even the most basic memory protections.

And like every couple of months, you know, this device, whatever it might be, I won't name names, there's yet another, you know – remote code execution zero day in this thing.

And it's, you know, we have to use this third-party software on our systems.

I'll have to admit that up front, but very...

But flaws in old code from the 90s, the aughts, etc.

So there is one problem that I often see is that the CBSS score doesn't take into account mitigations, right? Like it's a CBSS 9.8 or 10, assuming that the attacker can find an ASLR code.

you know, some way to defeat, you know, some kind of memory protection that's going to be in place on any modern operating system, right? So there are things outside the bug itself that can prevent exploitation that have just become, so just like these frameworks kind of abstract away classes of bugs, we've seen that happen with memory protection in operating systems as well.

You know, we've got immutable containers, like, like we're pushing the bleeding edge of, of how secure you can make an application.

Also, it's, it's just adjacent to a device with a 30-year-old C++ code base, uh, you know, that, that, um, doesn't have DEP or ASLR or like, like even the most basic memory protections.

And, and [laughs] like every couple of months, you know, this device, whatever it might be, I won't name names, there- there's yet another, uh, you know, remote code execution zero day in, in, in this thing.

And it's, uh, you know, we, we have to use this third-party software o- on our systems.

So, so w- there is one problem that I often see is that the CVSS score doesn't take into account mitigations, right?

Mm.

Like it's a CVSS 9.8 or 10 assuming, uh, that the attacker can find an ASLR, uh, you know, some way to defeat, uh, you know, some kind of memory protection that's gonna be in place on any modern operating system, right? So there, there are things outside the bug itself, uh, that can prevent exploitation, uh, that, that are, have just become-

Hmm