James McParlane's Blog

“A new generic method for exploiting a common problem in software code that was previously thought to be prohibitively difficult to attack is generating a wave of concern and surprise in the security community.”

http://news.bbc.co.uk/2/hi/technology/7358792.stm

This is really just another buffer overflow attack. If he is taking advantage of bugs in the VM then it’s just an old fashioned exploit.

Because the ‘code’ you execute in a Virtual Machine or Intereter does not directly access the low level runtime libraries, we assume that the programs we develop can not cause a buffer exploit. If there is an exploit then it lies in the VM itself. Its very easy in a low level language like C or C++ to allow a buffer exploit simply due to the semantics of some of the calls. You have to actively check for these issues and have some knowledge on how these exploits arise. When developing code that is executed via a VM, the onus for this checking for and blocking of this class of exploit is shifted to the application, which in this case is the VM itself.

We trust that a VM is checked and tested thoroughly and is free of these kind of bugs so that as developers we can not worry (so much) that our code has some kind of exploit.

If anything this paper simply reminds us that these VMs are just another application and if they have holes, these can be exploited.

Finally blogging an observation I made last year.

Its very simple.

History is repeating itself.

In the US, “Freed Men” where given the soft and non explicit right to vote by the Thirteenth Amendment in 1865, although it was 100 years before laws were passed to make it illegal to prevent people from voting based on their race.

Women voted nationwide for the first time in the presidential election of 1920.

There was a battle between the Suffragettes and the “Freed Men” for the public high ground, one of the arguments being along the lines that the American public would not let both groups get the vote at the same time. One group would have to go first.

The fight was dirty and divisive.

“After the American Civil War, both Stanton and Anthony broke with their abolitionist backgrounds and lobbied strongly against ratification of the Fourteenth and Fifteenth Amendments to the US Constitution granting African American men the right to vote.^“

“Eventually, Stanton’s oppositional rhetoric took on racial overtones. Arguing on behalf of female suffrage, Stanton posited that women voters of “wealth, education, and refinement” were needed to offset the effect of former slaves and immigrants whose “pauperism, ignorance, and degradation” might negatively affect the American political system. She declared it to be “a serious question whether we had better stand aside and see ‘Sambo’ walk into the kingdom [of civil rights] first.” While her frustration was palpable and perhaps understandable after her long fight for female suffrage, some scholars have argued that Stanton’s emphasis on property ownership and education, opposition to black male suffrage, and desire to holdout for universal suffrage fragmented the civil rights movement by pitting African-American men against women and, together with Stanton’s emphasis on “educated suffrage,” in part established a basis for the literacy requirements that followed in the wake of the passage of the fifteenth amendment.^“

What we see on our TV’s every night seems to mirror this ancient epic struggle.

And if history repeats itself – it will be Obama who gets to be the Democratic Candidate.

It also pains me that I seem to know more about the US political system than that of my own country.

Its pains me more that I seem to care more about the US elections but as I said in 2000. “The US elections effect the world to such an extent, they are too important to be left up to Americans”. I think history has borne that one out so far.