Tackling Privilege Escalation with Offense and Defense

No ratings

Presented at BlackHat Europe 2019 by

Abdul-aziz Pek

Over the past couple of years, various JavaScript APIs have been closely examined by security researchers. They've been audited and fuzzed thoroughly for classic memory corruption issues like buffer overflows, use-after-frees, and type confusions. Nevertheless, there's an interesting class of vulnerabilities that requires manual auditing rather than fuzzing. This class of bugs surfaced back in 2015, and researchers discovered how to exploit it to allow them to bypass built-in security restrictions within the JavaScript engine. Chaining these privilege escalations with undocumented features in Adobe Reader enabled reliable arbitrary code execution. When one bypass was patched, researchers would discover new and innovative ways to circumvent the restrictions. To make matters worse, leveraging these JavaScript API restriction bypasses opened the door to numerous memory corruption issues that existed in the less audited security-relevant JavaScript APIs. Even with sandbox protection an untrusted document executing JavaScript code in the privileged context provides avenues for abuse.Efforts on both the offensive and defensive side of the field were kicked off to combat this class of issues. This presentation will focus on the efforts to combat this class of vulnerabilities which leverag