SoylentNews is people
SoylentNews
from the all-fun-n-games-until-someone-gets-cracked dept.
A fascinating article on how to compromise a Linux desktop using Super Nintendo Entertainment System (SNES) processor opcodes:
TL;DR: full reliable 0day drive-by exploit against Fedora 25 + Google Chrome, by breaking out of Super Nintendo Entertainment System emulation via cascading side effects from a subtle and interesting emulation error.
The fault is built around the fact that the Linux gstreamer media playback framework supports playback of SNES music files by.... emulating the SNES CPU and audio processor, and the processor emulation has some exploitable vulnerabilities. The author (Chris Evans) then describes the process of working out how to escalate this into a full exploit in complete (and fascinating) detail.
Also, to quote from the article:
As always, the general lack of sandboxing here contributes to the severity. I think we inhabit a world where media parsing sandboxes should be mandatory these days. There's hope: some of my other recent disclosures appear to have motivated a sandbox for Gnome's tracker.
The processor in question is The Ricoh 5A22, a derivative of the 6502 processor, built specifically for the SNES the Sony SPC700 audio processor, not the Ricoh 5A22. [Ed: thanks KritonK for the update]
(Score: 0) by Anonymous Coward on Wednesday December 14 2016, @09:06AM
Yes, but remember that worse is better.
An end user is not that likely to be a victim of an exploit, and even if they are compromised, it is often too hard to identify which component led to the eventual malware infection. And once You are being blackmailed for decryption keys for Your stuff, it is often small consolation to know which software part has broken security (and then understanding that it's actually all of them).
Developing software with good security is hard, and requires thought and time to implement features which are unseen by the user. On the other hand, features such as playing snes audio are visible (or rather: audible in this case) and might be preferable to unnoticeable security.
Hence, software that provides noticeable features at the cost of security, will probably triumph over software that provides security over noticeable features.