Put on Your Tinfoil Hat If You're My Type
miaubiz presents fuzzing methodologies that discovered hundreds of type confusion and memory corruption vulnerabilities in modern browser JavaScript engines.
Summary
Architecture and Background
The IDA Pro APIs for interacting with type information are full of opportunities (horrible problems). I will show you how to create unparseable types, how to apply these types to functions and variables and how to transfer these types from one IDB to another.
Vulnerability Analysis
miaubiz is a senior doctor of security at Azimuth Security. he has previously found bugs in web browsers and has spoken at SyScan, Infiltrate, T2.
Exploitation and Demonstrations
his interests are bad APIs and sniffing ARMpits.
Remediation and Defensive Strategies
Related talks
Main Stage·48 min
Martin Doyhenard
Martin Doyhenard demonstrates reverse engineering proprietary HTTP servers, exploiting interprocess communication (IPC) and memory corruption for remote code execution.
Main Stage·45 min
Ben Barnea · Ophir Harpaz
Akamai researchers Ben Barnea and Ophir Harpaz explore Microsoft Remote Procedure Call (MS-RPC), discovering zero-day vulnerabilities in core Windows services.
Main Stage·41 min
Omer Gull
Demonstrates arbitrary code execution achievable through malicious SQLite queries, requiring only a SQL injection primitive in any SQLite-backed application.