Profile picture
Natalie Silvanovich
@natashenka
, 8 tweets, 4 min read Read on Twitter
Today, @5aelo and I unrestricted five bugs in iMessage! Here are some highlights:
@5aelo CVE-2019-8647 is a remote, interactionless use-after-free

bugs.chromium.org/p/project-zero…

CVE-2019-8662 is similar

bugs.chromium.org/p/project-zero…
@5aelo CVE-2019-8660 is remote, interactionless memory corruption

bugs.chromium.org/p/project-zero…
@5aelo CVE-2019-8646 allows an attacker to read files off a remote device with no user interaction, as user mobile with no sandbox

bugs.chromium.org/p/project-zero…
@5aelo We are withholding CVE-2019-8641 until its deadline because the fix in the advisory did not resolve the vulnerability
@5aelo You can see the full list here: bugs.chromium.org/p/project-zero…
@5aelo I'll be talking about these bugs and more at my #BHUSA talk. Hope to see you there!

blackhat.com/us-19/briefing…
The correct link for the second bug is bugs.chromium.org/p/project-zero…
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Natalie Silvanovich
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Related hashtags

#BHUSA

More from @natashenka see all

Profile picture
Natalie Silvanovich
@natashenka
A lot of people recommend writing down your passwords in case something happens to you. It's important to plan for your loved ones, but writing down passwords is error prone, puts you at risk and probably won't work in a few years due to 2FA.

Here's what you should do instead:
1) Have a will and a power of attorney document in case you are incapacitated. This is 100% the most important thing you can do for your family to prepare for the worst case
2) Many large account providers such as Google and Facebook support the ability to select a trustee if you die. Set this up where possible
Read 13 tweets

Related threads

Profile picture
UBI for America
@UBI4America
So you've decided to vote for @AndrewYang.

But what else can you to do help him win?

(THREAD)

#Yang2020 #YangGang #HumanityFirst
1. DONATE.

For new donors, as little as $1 counts, and will increase Yang's individual donor count, which is a crucial metric.

Money is the fuel that campaigns run on. The more money raised, the farther he can go. Fundraising also = press coverage.

secure.actblue.com/donate/ayorgan…
2. Donate again!

If you've donated in the past, please consider making another contribution, and/or setting up recurring donations. This is important. If you can afford to chip in another $20, it moves the needle. #SecureTheBag

secure.actblue.com/donate/ayorgan…
Read 23 tweets
Profile picture
Harry Roberts
@csswizardry
The issues are manifold. In theory, loading CSS anywhere in the BODY is 💯% a great idea in 2019. See here: csswizardry.com/2018/11/css-an… and, more thoroughly, here: jakearchibald.com/2016/link-in-b… by @jaffathecake.
Loading CSS in-BODY allows for a progressive render, as almost all browsers will only block rendering of *subsequent* content (that is to say, content beneath the rel=styleheet), as opposed to the traditional behaviour of blocking of all content.
Here’s what used to happen (credit: @jaffathecake):
Read 20 tweets
Profile picture
John Wilander
@johnwilander
Here are my thoughts on yesterday's privacy announcement from the Chrome team (blog.chromium.org/2019/05/improv…). [Thread]
First, I want to say that I'm happy about what they have to say. Specifically because they 1) acknowledge that tracking is a problem on the web and 2) are willing to make changes to Chrome's default behavior.
What Chrome has announced is a change to their default cookie policy, going from allowing third-party cookie access to not allowing it. However, developers can simply reconfigure their cookies to opt out this new policy and we should expect all trackers to do so immediately.
Read 9 tweets
Profile picture
Ivan Fratric
@ifsecure
A more serious take on this: What makes me sad is (once again) undermining end-user security to the benefit of corporate dinosaurs who can't be bothered to adapt. The IE Compat View certainly has a long history of abuse, but let's also take a look at some other examples: (1/4)
In 2017 MS disabled VBScript in IE, but left it running in Intranet and Trusted Sites zones for the benefit of said dinosaurs still using it. Guess what? By leaving it in, it could be abused from Internet zone as well: bugs.chromium.org/p/project-zero… and bugs.chromium.org/p/project-zero… (2/4)
Last year, MS disabled Flash in Edge by default, but left a whitelist of "trusted" sites. Guess what? bugs.chromium.org/p/project-zero… (3/4)
Read 5 tweets
Profile picture
Dmitry Sviridkin
@Nekrolm
Ну ладно, давайте откроем неиссякаемый источник безумия:
(Я в процессе такие восхитительные вещи понаходил)

Один лайк — один пример UB на C++!
1. Начнем с классики. Переполнение знакового целого есть UB.
Простой пример: кажется, что index должен был переполниться, и массив не будет заполнен, но нет.
ideone.com/tNrA0c
2. Битовый сдвиг влево отрицательных чисел есть UB.
Просто сдвиг знакового, но положительного, тоже влечет UB, если произойдет "переполнение".
Забавных примеров, к сожалению, найти сложно. UB хоть и значит, что произойти что угодно. Но чаще всего компилятор выкидывает часть кода
Read 68 tweets
Profile picture
Ivan Fratric
@ifsecure
bugs.chromium.org/p/project-zero… is another JScsript issue (like 1506) where a JScsript variable (Note: a variable itself, not a backing object) is not properly tracked by a garbage collector. This type of issues is interesting for 2 reasons:
1. These bugs are very difficult to find by fuzzing because an entire block of variables needs to get freed to observe a crash. We did find it by fuzzing, but only after a pretty large amount of iterations.
2. It gives you a very powerful exploitation primitive that can be reliably exploited for arbitrary read/write by triggering the bug only once.
Read 5 tweets

Trending hashtags

#FOIA #academia #GardnerShutdown #stormerbreaker #AmericanDOS #CovingtonBoys #DEVILS #HarrietDeservesBetter #EVIL #define #Pâques #phosphore #CVE #TrumpShutdown #include #TRAITORS #ExtinctionRebellion #YIM2019 #crediblecommitments #RejectRamtha #Poutine #WorldSuicidePreventionDay #ResearchHighlight #Arrest #terrorism
Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!