News for hackers. Stuff that matters.

A comment on Backdooring JavaScript using minifier bugs.

Re:Backdooring JavaScript using minifier bugs by samuellb on Monday August 24, 2015 @03:44AM (#10108440)
This makes me think that there could be similar bugs in the browser, when it JIT-compiles or optimizes Javascript code. That could be used to take control of the whole browser/OS if used in an add-on/extension (given that it has sufficient privileges).
[ Parent | on HN ]
Re:Backdooring JavaScript using minifier bugs by makomk on Monday August 24, 2015 @08:51AM (#10109363)
There have been similar bugs in browser JITs that allow websites to escape the sandbox - usually incorrect optimisations that cause the JIT to elide bounds checks when it can't safely do so, probably since those are the easiest to exploit.
[ Parent | on HN ]
Re:Backdooring JavaScript using minifier bugs by bcrypt on Monday August 24, 2015 @01:11PM (#10111360)
There's actually a fair number of security researchers looking at browser-level exploits like those in JIT (c.f. pwn2own). My colleague Chris Rolhf co-authored a cool study on attacking JIT: https://www.nccgroup.trust/us/about-us/resources/jit/
[ Parent | on HN ]