[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <6ab61252-e538-48fe-a0dd-e84fb0557d38@gmail.com>
Date: Sat, 27 Sep 2025 05:06:28 -0400
From: Demi Marie Obenour <demiobenour@...il.com>
To: Peter Gutmann <pgut001@...auckland.ac.nz>,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
"Adiletta, Andrew" <ajadiletta@....edu>, Solar Designer
<solar@...nwall.com>, Andrew Cooper <andrew.cooper3@...rix.com>,
"jcb62281@...il.com" <jcb62281@...il.com>
Cc: "openssh@...nssh.com" <openssh@...nssh.com>, "Tol, Caner" <mtol@....edu>,
"Sunar, Berk" <sunar@....edu>, "Doroz, Yarkin" <ydoroz@....edu>,
"Todd C. Miller" <Todd.Miller@...rtesan.com>
Subject: Re: Re: [EXT] Re: CVE-2023-51767: a
bogus CVE in OpenSSH
On 9/27/25 04:43, Peter Gutmann wrote:
> Demi Marie Obenour writes:
>
>> Is there something about Rowhammer specifically that makes it an unattractive
>> attack, even for nation-state attackers against well-protected targets?
>
> Not Rowhammer specifically, there are a near-infinite number of gee-whiz
> conference-paper-worthy attacks that fall into the same category.
>
> Attackers know what works and that's what they go for. To see what works,
> look at any survey of attacks, for example the OWASP Top Ten. Rowhammer is at
> position 26,672 in that list, right next to Spectre and and Meltdown and
> Zenbleed and using a reflection in someone's eyeball in a selfie that shows a
> reflection on a window that has a reflection on a glass-encased wall image
> that has a reflection of a monitor that displays a password.
>
> There's no point worrying about Mission-Impossible attacks when all an
> attacker has to do is buy the account credentials from an exploit broker or
> something similar. Cool attacks and countermeasures are fun to talk about,
> but if you want to make the system more secure you need to fix the things that
> actually matter.
You are definitely correct about 99.99% of users, but my work aims
to protect the 0.01%. The people who have a legitimate reason to
believe that a nation-state actor really is out to get them.
Specifically, I work on Spectrum OS (https://spectrum-os.org)
and used to work on Qubes OS (https://qubes-os.org). Spectrum OS
isn't ready for wide use yet, but Qubes OS *is* widely used,
and being able to protect against attackers with zero-day
exploits is one of its biggest advantages.
Due to Qubes OS's heavy use of virtualization, the attacker's
only options are:
1. Attack the hypervisor.
2. Attack one of other trusted components on the
host that is also accessible to the guest.
3. Attack the hardware.
4. Attack the supply chain.
5. Give up.
The vast majority of attackers will indeed give up, but not
all will, and my question is about the attackers who won't.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
