DEF CON 31 - Terminally Owned - 60 Years of Escaping - David Leadbeater

  Переглядів 18,223

DEFCONConference

DEFCONConference

7 місяців тому

It is 60 years since the first publication of the ASCII standard, something we now very much take for granted. ASCII introduced the Escape character; something we still use but maybe don't think about very much. The terminal is a tool all of us use. It's a way to interact with nearly every modern operating system. Underneath it uses escape codes defined in standards, some of which date back to the 1970s.
Like anything which deals with untrusted user input, it has an attack surface. 20 years ago HD Moore wrote a paper on terminal vulnerabilities, finding multiple CVEs in the process. I decided it was time to revisit this class of vulnerability.
In this talk I'll look at the history of terminals and then detail the issues I found in half a dozen different terminals. Even Microsoft who historically haven't had strong terminal support didn't escape a CVE. In order to exploit these vulnerabilities they often need to be combined with a vulnerability in something else. I'll cover how to exploit these vulnerabilities in multiple ways.
Overall this research found multiple remote code execution vulnerabilities across nearly all platforms and new unique ways to deliver the exploits.

КОМЕНТАРІ: 19
@wulliest
@wulliest 7 місяців тому
I started watching this thinking "yawn" - by the end it was "r0fl - wtf?!" - David Leadbeater *knows* how things work!
@drumhed
@drumhed 7 місяців тому
I suspected it wouldn't take long for this to get hilariously interesting. I was not disappointed.
@deadbeef2482
@deadbeef2482 7 місяців тому
dope!
@alexhannah8889
@alexhannah8889 5 місяців тому
These types of vulns are always hilarious, much thanks to the speaker for the work to get this done, making me laugh, and me even learning some history. Edit: Holy CVE list
@ChuckvdL
@ChuckvdL 6 місяців тому
I remember creating an April fools email loaded with ansi code that made it look like the college system just rebooted and returned to 1200 baud initial config..
@jamestaylor3805
@jamestaylor3805 6 місяців тому
In a middle school computer lab filled with Apple 2e, I attached a little script to one of the copies of Odel Lake available for the students to play... it over rode the screen with scrolling code that would loop on random line. The school effing panicked like the computer had asked if someone wanted to play a nice game of chess.
@steiner254
@steiner254 6 місяців тому
Awesome
@zxcvb_bvcxz
@zxcvb_bvcxz 7 місяців тому
Description is incorrect
@le_david
@le_david 7 місяців тому
Now fixed, thanks for watching!
@TheBitKrieger
@TheBitKrieger 7 місяців тому
@jamestaylor3805
@jamestaylor3805 6 місяців тому
Oh holy fuck, the Lear Siegler AMD. I haven't seen one of those in almost 40 years. My grandfather was one of a cluster of WWII vets who were tech fanboys and all running small businesses. That whole group used these until upgraded to Amigas sourced from RadioShack to manage thier businesses. Essentially they functioned as the worlds slowest address book and accounts notation system ever. Filing cabinets were so much faster. Lear is an amazing source of comparatively useless trivia. But man he is attached to a lot of geeky history.
@NitroNilz
@NitroNilz 6 місяців тому
I love this stuff - and then OpenBSD was running too🐡
@FixIt42
@FixIt42 7 місяців тому
4 GB of ; rotfl
@robertbruce7686
@robertbruce7686 5 місяців тому
😆 excellent
@eugrus
@eugrus 4 місяці тому
20:10 representations of ESC
@itwaslikethiswhenifoundit5941
@itwaslikethiswhenifoundit5941 6 місяців тому
39:40 🎉
@DommageCollateral
@DommageCollateral 7 місяців тому
Missing is the fact that the Querty keboard came from the typewriters. At some point, someone wanted to invent a better typewriter, so he placed the keys according to the likelihood of them appearing in a setence to prevent the machine from breaking down. then came asci. 70-80 years later we still build on this basis. ai was invented in the 60s. can you imagine a life without a computer? -like running around with notesheets?
@ChuckvdL
@ChuckvdL 6 місяців тому
There’s so much wrong there I don’t know where to start. The QWERTY layout comes from mechanical typewriters that used long hammer like leavers with the type on them. If you went too fast the leavers would jam. The layout was intentionally designed to slow the typist down. Incidentally it also allowed salespeople to spell out “typewriter” entirely on the top row. Once powered electric typewriters were available it was possible for the machine to go fast enough and better more logical/ergonomic layouts could be created, and thus we got the Dvorak layout and others that are better than QWERTY in every measurable way. Unfortunately the cost of retooling all the existing systems and training materials and retraining workers was wrongly considered prohibitively expensive and the world never switched away from the terrible QWERTY keyboard. Another sad example of “good enough” beating out “better” because it was thought cheaper. A number of Dvorak layouts are still around. They are still used, but mostly by people that keyboard for a living and need to reduce RSI. Dvorak even created some specific to one handed typing, frequently used by disabled folk. You can easily remap your computer keyboard to them if you want. My wife switch to Dvorak decades ago for his reason as she does a lot of writing g n her work. Incidentally, all the typing speed records for decades were set using that layout, which has always been about being better for humans, not for the machine as you stated. ASCII has zero to do with the keyboard layout, and is basically encoded into binary in numerical/alphabetic order. The thing that confuses people is that it starts with non-printable characters. I learned to decode it in order to steal passwords by turning on the tape punch on the teletype after I logged off. The encoding makes ‘sense’ in binary, not in decimal. But again, zero relationship between ascii encoding and the typewriter keyboard layout. The concept of AI is far older than the 60’s, far older than the term even. Asimov created his famous 3 laws of robotics in the early 40’s when computers were still in their infancy and used vacuum tube ‘valves’ for logic gates. I Robot and his other shorts on that subject are still worth reading today. I don’t have to imagine life without computers, I didn’t own a computer until my 20’s (C64), practical laptops weren’t a thing for nearly another 20 years. People showed up at meetings with note pads and pens/pencils.. bringing laptops to meetings didn’t become the norm until after the turn of the millennium. Half the people currently in the workforce lived through what is boggling your mind to imagine. Maybe ask them about it?
@pete3897
@pete3897 3 місяці тому
Um, so, so....um um, um, so so, sooo... um? (so)
Анита просто на химии, поэтому такая сильная
00:21
Женя Лизогуб SHORTS
Переглядів 2,8 млн
DEF CON 31 -  Closing Ceremonies & Awards - The Dark Tangent, DEF CON Senior Staff
1:53:33
NFC Technology (Mifare Access Control)
9:15
Tech Security Tools
Переглядів 2,3 тис.
Has Generative AI Already Peaked? - Computerphile
12:48
Computerphile
Переглядів 147 тис.
DEF CON 22 - Michael Ossmann - The NSA Playset: RF Retroreflectors
47:22
DEFCONConference
Переглядів 180 тис.
Broken Flex Repair #technology #mobilerepair
0:50
ideal institute aligarh
Переглядів 1,4 млн
НЕ ПОКУПАЙТЕ НОВЫЙ СМАРТФОН, ПОКА НЕ ВЫШЕЛ ЭТОТ [2024]
13:25
Thebox - о технике и гаджетах
Переглядів 77 тис.
Хомяк может разблокировать АЙФОН
0:14
Собиратель новостей
Переглядів 399 тис.
Creepy Samsung Alarm cannot be turned off 😱🤣 #shorts
0:14
Adani Family
Переглядів 972 тис.