Top all-time · #6557
SecOps Insights
Company blog · graplsecurity.com/blogsecurity
SecOps Insights is the company blog at graplsecurity.com, writing about security. Since 2020, 11 different Hacker News readers have linked it 21 times, most often “Kernel Pwning with eBPF: A Love Story”. No feed was found, so read it on the site itself.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN readers link the Grapl security blog for exploit writeups, including an io_uring kernel exploit and a post on attacking AWS Firecracker, a Rust-based MicroVM monitor. Commenters also discuss the Rust-in-kernel debate.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
What key security threats are modern organizations facing? How are they detecting and responding to these risks? We cover these and more areas of interest.
Most-linked posts?
- Kernel Pwning with eBPF: A Love Story3 people · 5 mentions · first linked 2021-07-30
- Attacking Firecracker: AWS' MicroVM Monitor Written in Rust3 people · 3 mentions · first linked 2022-09-08
- /blog2 people · 3 mentions · first linked 2022-03-07
- Put an io_uring on it: Exploiting the Linux kernel2 people · 3 mentions · first linked 2022-03-08
- Anatomy of an Exploit: RCE with CVE-2020-13502 people · 2 mentions · first linked 2021-03-03
What Hacker News says?
My point is that this is basically just how exploits work for Linux, so it's pretty universal unless your main concern is 0days. As for me personally, I run a company that uses Linux in production. We happen to explicitly do research into Linux kernel security (we'll be publishing tomorrow on a 0day we had reported) https://www.graplsecurity.com/blog
Comment linking /blog
on “The Dirty Pipe Vulnerability”Submitted Put an io_uring on it: Exploiting the Linux kernel as a story · 282 points
HN discussion> What is your threat model / situation that you care about attackers who reverse engineer patches, but are not in the small circle of people who would be informed before hand. Virtually every single Linux user. I think what you're missing is how commonplace and straightforward it is for attackers to review these commits and how uncommon it is for someone to be on the receiving end of an embargo. Most exploits are f…
Comment linking /blog
on “The Dirty Pipe Vulnerability”Submitted Attacking Firecracker: AWS' MicroVM Monitor Written in Rust as a story · 212 points
HN discussion> Securing the network is more work than just securing the code, because now there's a network in the way. I very much disagree. > For all the repetition you have on this thread, can you summarize it with the actual benefit that you have gained in a serious production use? I already have summarized it. All I've done since is correct people being incorrect with regards to my summary. If you want a specific example, h…
Comment linking /post/architecting-for-performance-and-security-at-the-same-time
on “Give me back my monolith (2019)”Submitted Kernel Pwning with eBPF: A Love Story as a story · 136 points
HN discussionI found this to be surprisingly interesting and novel - usually I expect to see really low quality content when it's a post about microservices, whether for or against the idea. This boils it down to isolation, which I myself have written about in a similar vein[0]. > at this point security people simply don't believe that any of the following (each one the very best technology available at the time) is totally safe…
Comment linking /post/architecting-for-performance-and-security-at-the-same-time
on “Modules, Monoliths, and Microservices”Submitted Kernel Pwning with eBPF: A Love Story as a story · 6 points
HN discussionYeah, not quite related to the linked slides, which are about scaling in terms of productivity, but still a great talk. I really found that "isolation" is just a key optimization and one of the most useful properties of a system, which they call out in that talk. I wrote about it a bit more in depth here: https://www.graplsecurity.com/post/architecting-for-performa... I've written our data processing layer and our e…
Comment linking /post/architecting-for-performance-and-security-at-the-same-time
on “Scaling Erlang Developer Experience at WhatsApp [pdf]”Submitted Kernel Pwning with eBPF: A Love Story as a story · 2 points
HN discussionJust because there's heap grooming involved doesn't mean it's unreliable. Exploits that use heap grooming can often be ~100% reliable. Our POC for Sigred required lots of heap grooming but it was extremely reliable. https://www.graplsecurity.com/post/anatomy-of-an-exploit-rce... The overflow was hardly a footnote either, it's the primary bug being exploited here.
Comment linking /post/anatomy-of-an-exploit-rce-with-cve-2020-1350-sigred
on “Zoom RCE from Pwn2Own 2021”Submitted Kernel Pwning with eBPF: A Love Story as a story · 2 points
HN discussion> The vast majority of people spouting opinions on Rust don't even write systems software, and have never even compiled a kernel driver. I have done this. I don't anymore, but my entry into the software world was exploitation of C code and I was particularly interested in the Linux kernel. I'm not really an expert on it, but I've certainly worked with many. Here's an example of some of the work my company has done,…
Comment linking /blog
on “Rust in the 6.2 kernel”Submitted Anatomy of an Exploit: RCE with CVE-2020-1350 as a story · 2 points
HN discussion> That doesn't excuse downplaying the security issues so common when using languages that do not offer memory safety. Sure thing but can Rust live up to its memory-safety promise? Or even data-race freedom promise? I must say that, coming from systems programming background, I was always skeptical about those promises because IMO these problems fundamentally cannot be solved in bare-metal programming language. They'…
Comment linking /post/attacking-firecracker
on “Next steps for Rust in the kernel”https://graplsecurity.com/ That's my company. The blog is hosted elsewhere. Our frontend is hosted via a rust service, which talks to other rust services via grpc.
Comment linking /
on “Why Rust?”The author of this also did a writeup of an io_uring exploit a while back that you might find interesting https://www.graplsecurity.com/post/iou-ring-exploiting-the-l... (the September 8 date is definitely wrong, probably an artifact from moving blogging platforms)
Comment linking /post/iou-ring-exploiting-the-linux-kernel
on “Attacking Firecracker: AWS' MicroVM Monitor Written in Rust”fyi social links at the bottom of https://www.graplsecurity.com/ map to the wrong things (linkedin to discord, github to linkedin)
Comment linking /
on “New ScyllaDB Go Driver: Faster Than GoCQL and Its Rust Counterpart”It's all context-dependent. You're right that people shouldn't just drop into a project they don't understand and demand that all unsafes be factored out, but just because an unsafe block is internal and carefully vetted that doesn't mean it's totally fine and chill either. Here's a recent example where an unsafe led to a memory corruption vulnerability in a thoroughly battle-tested codebase: https://www.graplsecuri…
Comment linking /post/attacking-firecracker
on “A small reivew of the Poem Rust web framework”We have a very detailed writeup on eBPF exploitation for anyone interested in the subject: https://www.graplsecurity.com/post/kernel-pwning-with-ebpf-a...
Comment linking /post/kernel-pwning-with-ebpf-a-love-story
on “Detailed Report on Local Privilege Escalation in Ubuntu Desktop (Pwn2Own 2021)”Chompie ( https://twitter.com/chompie1337 ) does a great job on exploit writeups. Take a look at https://www.graplsecurity.com/post/iou-ring-exploiting-the-l... . She's got a few more blog posts at Grapl, but she's moved on to new things at xforcered at IBM.
Comment linking /post/iou-ring-exploiting-the-linux-kernel
on “Good Technical Infosec Blogs?”
