Weird Machines: Exploiting Turing-Completeness
summary
Claim: many innocuous renderers and file parsers become accidental Turing‑complete and attackers craft inputs that act as programs. Example: a JBIG2 image decoded by CoreGraphics contains Boolean primitives and a JBIG2 virtual machine (registers, a 20‑bit adder) that, combined with a buffer overflow and Objective‑C calls, performs zero‑click spyware installation on iPhones. Simpler cases include heavy bidi handling using left‑right markers that deadlock WhatsApp and font ligature tables implementing fonts ligature FizzBuzz. Detection is hard because of the halting problem.
AI-written summary · about
chapters (9)
- 0:00Introduction to weird machines
- 1:05What is a weird machine
- 7:48Turing completeness in systems
- 10:42Accidental Turing completeness
- 17:00Real-world weird machines
- 26:23NSO zero-click exploit
- 36:43Implications of weird machines
- 42:01Security best practices
- 45:31Q&A and closing
related talks
59mBrowsers Gone Wild
48mKeynote Presentation: Escaping Cantor's Find-Fix Cycle
22mThinking Outside the JIT Compiler
52mStructure aware fuzzing
36mCompromising LLMs: The Advent of AI Malware
37mHow to Break AI Systems (Before Someone Else Does)
46mThe Anatomy of Java Vulnerabilities
51mExploiting Hardware Glitches And Side Channels In Perfect Software