TyphoonCon 2020 Speaker
Amy Burnett is a senior security researcher and co-founder of RET2 Systems, where she specializes in browser security and mitigation bypass. Amy has spoken about and had lead training on advanced browser exploitation at multiple private events and conferences worldwide. She and her team developed and publicly demonstrated a remote code exploit against Safari for Pwn2Own 2018, which also leveraged a macOS bug to gain root level code execution.
Amy’s research usually consists of looking for bugs in the JavaScript engines of Chrome and Safari with a focus on analyzing their JIT compilers. Beyond finding bugs Amy likes to write exploits for disclosed bugs, with a focus of coming up with mitigation/hardening bypass techniques and designing stage two payloads.
Amy Burnett | Co-founder & Security researcher at RET2 Systems
Location: Courtyard by Marriott Seoul Namdaemun, Seoul, Korea
Title: Forget the Sandbox Escape: Abusing Browsers from Code Execution
Date: June 18th, 2020
BIO
Amy is a senior security researcher and co-founder of RET2 Systems, where she specializes in browser security and mitigation bypass. Amy has spoken about and had lead training on advanced browser exploitation at multiple private events and conferences worldwide. She and her team developed and publicly demonstrated a remote code exploit against Safari for Pwn2Own 2018, which also leveraged a macOS bug to gain root level code execution.
Amy’s research usually consists of looking for bugs in the JavaScript engines of Chrome and Safari with a focus on analyzing their JIT compilers. Beyond finding bugs Amy likes to write exploits for disclosed bugs, with a focus of coming up with mitigation/hardening bypass techniques and designing stage two payloads.
LECTURE DETAILS
The complexity of JavaScript and Web APIs has led to an increase in vulnerabilities found in modern web browsers. Many of these vulnerabilities are relatively easy to exploit and lead to full code execution within the browser process. To combat this, browser vendors have worked to secure their platforms through sandboxing.
Amy’s talk will examine the functionality available to a compromised rendered process and see how it can be abused to compromise browser users and abusing features in Safari and Firefox to attack other origins, steal user sessions, and install persistent UXSS to other sites.
