Tackling Privilege Escalation with Offense and Defense
summary
Researchers report a sequence of concrete exploits and fixes against Acrobat’s JavaScript engine: a decompiled folder-level bin reveals folder‑level trusted functions and undocumented I/O APIs, AFParseDate lets crafted longEntry point to attacker code and an AFParseDate overwrite is used to replace collab/identity getters to call privileged APIs; other bypasses use globals persistence, proxying xqDialog, and mutable-variable writes. Defenses include hardening objects non‑writable, denying privileged calls from getters, and a datalog‑based points‑to static analysis that trades soundness for practical precision.
AI-written summary · about
chapters (35)
- 0:00Introduction
- 0:34Who are you
- 1:40Ideal Reader
- 2:28Architecture
- 5:37The IE Rush
- 7:26JavaScript Attack Surface
- 8:32JavaScript Engine
- 9:44privileged and unprivileged contexts
- 10:33trusted functions
- 11:22folderlevel scripts
- 12:17bin file
- 12:43decompile tool
- 13:44attacking the engine
- 16:09discovery
- 17:12root level eval
- 18:00trusted function
- 19:40fix
- 20:03identity
- 21:23global
- 23:18xqdialogue
- 24:11Adobe patch
- 24:51JJS API bypasses
- 26:45Defending the engine
- 27:07History of JavaScript
- 27:58Design Decisions
- 28:19Key Features
- 30:25Reference Monitor
- 31:13Implementation Problem
- 32:15Implementation Example
- 34:18Static Analysis
- 35:42Point Analysis
- 41:51Security Information Flow
- 45:29Soundness is not necessary
- 45:45Soundness is not binary
- 46:03Conclusion
related talks
37mAbusing Adobe Reader’s JavaScript APIs
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
27mPwning Electron Application : Analysis and Defense of Vulnerabilities in Electron Applications
01h 01mHow to Break AI Systems (Before Someone Else Does)
58mExploiting Adobe Flash Player In The Era Of Control Flow Guard
42mBypassing macOS Security and Privacy Mechanisms: From Gatekeeper to System Integrity Protectio
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
47mThe Art of Reverse Engineering Flash Exploits