Collaborate Disseminate
The LUKS1 format has been available for a long time, and the format specifications are easy to find. Recently, LUKS2 has been released, which features a number of important changes, such as AEAD and Argon2. The release notes … Continue reading LUKS2 on-disk format specifications
The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should only be doable if one is physically at the… Continue reading Authentication using SysRq
I am aware that there is no microcode fix for Meltdown available (it has already been answered in various questions), and that the only extant microcode patches (IBRS and IPBP) only help with one of the Spectre variants, but I would like t… Continue reading Is microcode physically able to mitigate Meltdown?
Short question
Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot suppress exceptions)? The Linu… Continue reading Mitigating Meltdown by checking the faulting address in every page fault?
If you’re already familiar with PCI behavior and Linux’s handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform memory accesses, and how the kernel handle… Continue reading DMA attacks despite IOMMU isolation
It is well known that a terminal tends to trust things which are printed to it through stdout/stderr, making outputting attacker-controlled data to the terminal a risky action. Is using cat -v an effective way to sanitize unt… Continue reading Is using cat -v an appropriate way to sanitize untrusted text?
The .rodata segment in ELF files contains data that is not meant to be changed. By default, all pages from this segment are read-only, and any attempt at modification will trigger a general protection fault. The Linux syscall mprotect() is… Continue reading Can mprotect() be used to change the permissions of .rodata?
When most Linux users hear “root”, they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, albeit one which the kern… Continue reading Methods root can use to elevate itself to kernel mode
Has there been any research on what buses in a computer can be analyzed while they are live, without rebooting the system to insert a proxy device? For example, I imagine I2C would be very easy to sniff because the wires are exposed, and b… Continue reading What buses carrying sensitive information on a running computer are vulnerable to sniffing?
As far as I know, there are two methods for performing cold boot attacks:
Reboot the system into an alternate operating system or BIOS with a minimal memory footprint which automatically exports memory to persistent media.
… Continue reading Methods of cold boot attacks in the wild