The poisoned NUL byte, 2014 edition

Posted by Chris Evans, Exploit Writer Underling to Tavis Ormandy Back in this 1998 post to the Bugtraq mailing list, Olaf Kirch outlined an attack he called “The poisoned NUL byte”. It was an off-by-one error leading to writing a NUL byte outside the bounds of the current stack frame. On i386...

What does a pointer look like, anyway?

Posted by Chris Evans, Renderer of Modern Art In Adobe’s August 2014 Flash Player security update, we see: These updates resolve memory leakage vulnerabilities that could be used to bypass memory address randomization CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545. I...

Mac OS X and iPhone sandbox escapes

Posted by Chris Evans, Finder of None Of These As part of our launch manifesto, we committed to openness and transparency, including sharing full details of our research. About a month ago, Apple released two security advisories which fixed some Project Zero findings. Today, we’re releasing the...

pwn4fun Spring 2014 - Safari - Part I

Posted by Ian Beer Back in March this year I entered the pwn4fun hacking contest at CanSecWest http://www.pwn2own.com/2014/03/pwning-lulzand-charity/ targeting Safari running on a brand new MacBook Air. In this first post I’ll detail how I got code execution within the Safari renderer sandbox usi...

Announcing Project Zero

Posted by Chris Evans, Researcher Herder Security is a top priority for Google. We’ve invested a lot in making our products secure, including strong SSL encryption by default for Search, Gmail and Drive, as well as encrypting data moving between our data centers. Beyond securing our own products,...