1. Bromium Confidential

2. CVE-2012-4969 IE CMshtmlEd UAF

3. But did you ever wonder how we ended up here? And where are we going?

4. Bromium Confidential

11. Phun Profit/War Hacking For: 70s Now

13. strcpy(dst, src);

18. 2006 brought VT-x 90s

20. Microcode updates should be signed… so this shouldn’t be a problem… Chip Vendor OS Vendor Your CPU after boot add ecx, ebx == many micro instructions

21. SEH func Stack Heap spray attack NOPs + Shellcode SEH

25. Smart Pointers

26. All dynamic Objects in IE Process Heap IE as of June 2014 User created Objs Critical IE Objs Process Heap Isolated Heap Heap Separation

27. HeapFree() Freed by Allocator Right away IE as of July 2014 Secure HeapFree() Put on List to be Freed later Based on heuristics Delay Free

28. Kernel Exploits Hypervise every process Least privilege

29. Robert Cailliau, Jean-François Abramatic and Tim Berners-Lee at the 10th anniversary of the WWW Consortium

33. Without a hypervisor, weakness is Kernel exploit or something like: /* shocker: docker PoC VMM-container breakout (C) 2014 Sebastian Krahmer * Demonstrates that any given docker image someone is asking * you to run in your docker setup can access ANY file on your host, * e.g. dumping hosts /etc/shadow or other sensitive info, compromising * security of the host and any other docker VM's on it.

36. while(this_side_of_heaven) { c = catalyst(war||commerce); //currently cyberwar fuels 0day fascination x = build(c); y = break(x); if( y && motivation) attack(); x = fix(x, y); c, x = rebuild_innovate(x, smaller, cheaper, complexity++, security); }

37. Bromium Confidential labs.bromium.com@jareddemott