Rust on Matt Suiche

Researching BLASTPASS: Detecting the exploit inside a WebP file - Part 1

Wed, 27 Sep 2023 12:00:00 +0200

Introduction 🔗

Once again compression algorithms are showing us that they are ruling the internet. My initial encounter with compression algorithms was in the year 2007, while reversing the Windows hibernation file to reimplement the now well-known Microsoft LZXpress which I discovered later was used in most Microsoft products until today. This journey continues today, with the scrutiny of the vulnerability CVE-2023-4863 located within the open-source Libwebp library, affecting Chromium-based browsers such as such Mozilla, Chrome, and Edge but also messaging applications such as iMessage.

Researching FORCEDENTRY: Detecting the Exploit With No Samples

Mon, 19 Dec 2022 12:00:00 +0200

Earlier this month, I reached out to my friend Valentina and told her I wanted to learn about macOS/iOS exploitation, so she recommended taking a look at the CVE-2021-30860 vulnerability, also known as FORCEDENTRY, and the prior work her friend Jeffrey Hofmann posted on Twitter.

One year ago, Google Project Zero published an analysis of the NSO iMessage-based zero-click exploit caught in-the-wild by Citizen Lab and was dubbed as “one of the most technically sophisticated exploits we’ve ever seen” by the Google Project Zero team.

POC 2022 - Korea - Keynote 🦀

Thu, 10 Nov 2022 12:00:00 +0200

POC is one of the top conference in Asia and has been running since 2006, and today I’ve had the opportunity to give the opening keynote (Slides) for POC 2022 conference in Seoul, Korea where I discussed our favorite memory safe language: Rust - thanks again to the organizers for the invitation.

I chose to discuss Rust from a software engineering and application security point of view. The main points were:

The current availability of high-performance memory safe languages like Rust, make it the best time in history of computer science to be (or become) a software engineer.
Rust is a great language to learn if you are new to programming and are looking for pointers for your software engineering career. I always recommend to students who want to get into software engineering to start with Python to learn the basics of programming, and then to learn a more mature language such as Rust which can be used for production level coding.
Rust is a great language if you are starting a new project from scratch, but if you are trying to migrate an existing code base written in C/C++ this may be more challenging to fully rewrite everything the larger your existing code base is.
Rust allows you to focus on the logic of your code instead of wasting unnecessary time debugging (especially compared to C/C++), without sacrificing on performance.
Memory safety bugs represent around around 70% of security bugs (as reported by MSRC), so having the opportunity to have safe code that compiles and works is amazing.
There are two main avenues to make applications more secure:
- either you improve the compiler (which is the best solution for legacy code base that can’t be rewritten for various reasons)
- or you actually use a safer language (a memory safe language - which is the best solution for new code base)
Although Microsoft has been doing a great job at promoting Rust, the lack of official WDK for kernel programming is problematic and we will probably see a lot of people writing Windows Rust user-mode applications just like they would write C/C++ user-mode applications due to lack of resources (There is definitely room for improvement that could be done on that side).

You can find the slides here. (Slides)