Halvar Flake
SABRE Security GmbH
Halvar.falke@sabre-security.com
Title: More on uninitialized local variables

This is really hard to describe without diagrams so I am only going to give a high level summary. For details, find Halvar at a show and check it out.

Trickery and abuse of memory is always the popular topic when you are trying to exploit a condition. It comes down to “How can we exploit some undefined behavior?"

In terms of trickery, no one will argue that Halvar is one of the best tricksters.

Exploitation via this vector was thought to be too large of a space to be feasible but Halvar found a way via graph structures and sequential patterns to shrink the space significantly and with just the right maneuvers, can author content in this uninitialized space (the residual of some previous actions) such that it can be subsequently used to run exploit code.

This is an area of research that over the next 12 months, I am sure there will be some discoveries that will rock the world of computing. Halvar, BINDIFF rocks and keep up the great work.

The next talk entitled “Security Issues Related to Pentium System Mgmt Mode” (SMM) employs a similar memory range problem but a billion times more severe given that most Pentium-x86-based Unix systems running an Xserver display can fall victim to this technique.

--tk