I'm sorry but again, I dont see how an 4 byte OOB write will realistically lead to RCE without the custom buffer in the POC that explicitly puts a function pointer directly where the overflow happens, then invokes it.
I'm happy to be shown what I'm missing but this seems like a memory corruption bug, not RCE, and if it was feasible w/o the custom buffer then why not provide that as the example? In the real world, a ffmpeg invocation would use the default buffer handler that will use padding/alignment/etc that makes the heap even less predictable, and incredibly unlikely to have a function pointer exactly following the frame buffer that will deterministically be invoked by a process placing it there?
Maybe I'm missing something but the ffmpeg buffer "exploit" involves passing a custom exploited buffer callback to parse a RASC file that presumably has been crafted to contain a packet that can exploit the custom buffer passed in? I don't see how this would be used in practice in the wild as to achieve the first step (custom buffer invocation) would require you to already have access to the machine to even invoke ffmpeg with it?
Like yes there is a heap OOB issue in an incredibly old file format, but without already having arguably compromised access to a machine, exploiting it for RCE seems impossible?
- moot was fundraising for his VC backed startup during the years the emails are in, and he was likely connected via mutuals in USV or other firms. These meetings were clearly around him trying to solicit investment in his canv.as project.
- /pol/ was /new/ being returned; the ethos of the board had already existed for a long time and the decision to undo the deletion of /new/ was entirely unsurprising for denizens at the time, and was consistent with a concerted push moot was making for more transparency in the enforcement of rules on the site and fairness towards users who followed the rules. /pol/ didn't start a culture war at this time any more than /new/ had previously - it just existed as a relatively content-unmoderated platform for people to discuss earnestly what would get them banned elsewhere.
I believe a lot of this expectation is that as people replace Google searches with LLMs, or even enriched LLM results pushed at the top of Google results, far less click through to the actual sources happens.
This is happening across a lot of web verticals that previously relied on excellent SEO ranking and click through performance to drive ad revenue/conversions/sales. I have direct knowledge of some fairly catastrophic metrics coming out of knowledge base businesses; it wouldn't surprise me in the slightest that something like Tailwind is suffering a similar fate.
I think this author is comically misguided about the speed at which oil extraction happens in Venezuela. Even if the plan was to pay for everything with Venezuelan crude sales, I don't believe ~$30MM/d is going to move the needle much.
Not trying to be pedantic but where do you see this? I do not see the SE even listed in Apple's refurbished store anymore and I am struggling to find any documentation or evidence suggesting it is available thru Apple authorized resellers (no inventory I can find at ATT, T-Mobile, Verizon, etc)
FWIW I've been using a 2016 SE since... 2016, and I bought a spare one from Apple's refurbished clearance in 2019 when it became clear the phone would no longer be available outside ebay/grey market. If it's been silently available this whole time at any authorized seller that'd be huge news to me.
Assuming you mean the 2016 iPhone SE, in the US you cannot buy it from a retail store - it is not presently available on the market as new stock (that i'm aware of). You can only get them used, refurbed, or maybe NoS if you're lucky.
I'm happy to be shown what I'm missing but this seems like a memory corruption bug, not RCE, and if it was feasible w/o the custom buffer then why not provide that as the example? In the real world, a ffmpeg invocation would use the default buffer handler that will use padding/alignment/etc that makes the heap even less predictable, and incredibly unlikely to have a function pointer exactly following the frame buffer that will deterministically be invoked by a process placing it there?
It seems very far fetched.