Secure Browser Plugins
0Native Client is Google's attempt at bringing millions of lines of existing C/C++ code to the Chrome web browser in a secure sandbox through a combination of software fault isolation, a custom compiler toolchain and a secure plugin architecture. Sound challenging? It is! Native Client isn't a typical browser extension and it certainly isn't ActiveX. Native Client allows for all sorts of applications to run inside in your browser, everything from games to PDF readers. In this talk I will cover the basics of the Native Client sandbox and general security relevant architecture including PPAPI (the replacement for NPAPI), vulnerabilities I discovered via source review in the PPAPI interface and finally a tool that dynamically generates code to fuzz the Native Client PPAPI interfaces based on the IDL (Interface Description Language) files found in the Chrome source tree.
Presented By:
Chris Rohlf
Black Hat - USA - 2012 Hacking conference
#hacking, #hackers, #infosec, #opsec, #IT, #security
Other Videos By All Hacking Cons
| 2021-12-31 | Denying Service to DDoS Protection Services |
| 2021-12-31 | Java Every Days Exploiting Software Running on Three Billion Devices |
| 2021-12-31 | Maltego Tungsten As a Collaborative Attack Platform |
| 2021-12-31 | Big Data for Web Application Security |
| 2021-12-31 | Detecting Vulnerabilities in Virtual Devices with Conformance Testing |
| 2021-12-31 | BinaryPig Scalable Malware Analytics in Hadoop |
| 2021-12-31 | Javascript Static Security Analysis Made Easy with JSPrime |
| 2021-12-31 | Just In Time Code Reuse The More Things Change, the More They Stay the Same |
| 2021-12-31 | Hacking for Fun & Profit |
| 2021-12-31 | Web Exploit Toolkits |
| 2021-12-31 | Secure Browser Plugins |
| 2021-12-31 | Bouncer Land |
| 2021-12-31 | Trust, Security and Society Presented By Bruce Schneier |
| 2021-12-31 | Ghost in the Air Traffic |
| 2021-12-31 | Random Number Generator in PHP |
| 2021-12-31 | BlackOps |
| 2021-12-31 | We have you by the Gadgets |
| 2021-12-31 | Torturing OpenSSL |
| 2021-12-31 | Probing The Mobile Operating Networks |
| 2021-12-31 | Find Me in your Database |
| 2021-12-31 | Digging Deep into the Flash Sandboxes |