2

My question

  • Meaning of persistent full-chain -- ?
  • What is the difference between OS-level CE and Kernel level CE?
    1. How do OS-level CE and Kernel level CE differentiate in impacting a system?
    2. Rarity and difficulty when it comes to exploitation
  • When is user-interaction needed to successfully exploit the CE?
2
  • is this a homework question (sounds like it is) anyway, if its not. can you give some context to this question? What is it you are trying to learn? where did you find these terms? etc.
    – LvB
    Nov 5, 2019 at 10:29
  • I learn about code execution and found these terms on lifehacker.com/…
    – pov
    Nov 5, 2019 at 10:48

1 Answer 1

1

Ok, lets first add some context:

  • Lock screen bypass: $100,000
  • User data extraction: $250,000
  • Unauthorized access to high-value user data: $100,000
  • Kernel code execution: $150,000
  • CPU side-channel attack on high-value data: $250,000
  • One-click unauthorized access to high-value user data: $150,000
  • On-click kernel code execution: $250,000
  • Zero-click radio to kernel with physical proximity network attack: $250,000
  • Zero click access to high-value user data: $500,000
  • Persistent full-chain kernel code execution attack without user interaction: $1,000,000 Source

Lets first look at the difference between OS level and KERNEL level. At boot the first level (a.e the one with the most permissions) that will run is the Kernel, it is responsible for managing the system resources and scheduling when what program will run (it is the 'Master Control Program').

The OS is started by the Kernel, and is usually run mostly in USER space (a more limited environment that is more secure)

  • An Code Execution Exploit in the OS will most likely only have the permissions of the program that it exploited and can not go out of the scope of those permissions.

  • An Code Execution Exploit in the Kernel has access to the WHOLE SYSTEM. and is there for much more dangerous.

  • A Persistent Full chain Kernel code execution exploit is basically everything you need to start abusing the exploit to do anything on an device. (all security is broken basically).

The only option to restore security is whats called a 'Nuke from orbit', e.a. completely reinstall the device (and firmware) from a clean backup or destroy the device. but you can not before it up before everything is cleaned.

  • By User interaction we mean any action like clicking on a accept button or opening a file that a user needs to do to (start the) infection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .