15 ms·

Disclosing vulnerabilities to protect users

305 points by nnx 10y ago

voltagex_ 10y ago
Does anyone know which version of Chrome this was fixed in? This may force $EMPLOYER to finally update from an unholy mix of 50 and 53.
- jrowley 10y ago
  Why would your employer fix you to a specific version of chrome? Thats bizarre.
  - voltagex_ 10y ago
    Yes, yes it is.
  - cesarb 10y ago
    Large companies tend to be bad at keeping up-to-date. I know of a bank that still uses OpenOffice. No, not Apache OpenOffice: they still use the real OpenOffice.org. Workstations are often locked down, so employees can't install or upgrade anything.
    - ajdlinux 10y ago
      A friend of mine working for the government told me that in one major government agency, the most popular version of IE used on their website is IE11. The second most popular version? IE 6. Not even 8. IE 6. Who still uses it? Employees of other government departments...
      - alanh 10y ago
        Yeah… just a reminder: IE6 was released in August 2011.
        Diggsey 10y ago
        No it wasn't... It was released in 2001
        kpozin 10y ago
        A little earlier than that: August 2001.
        alanh 10y ago
        Can I blame bitrot? Yes, thanks, of course I meant 2001.
        madgar 10y ago
        For a sense of just how long ago that was, IE6 was released before 9/11. Truly a more innocent time.
        drv 10y ago
        2001, not 2011. Time flies. :)
      - konklone 10y ago
        While this is plausible for the past, I think this info is outdated now. https://analytics.usa.gov https://analytics.usa.gov has lots of data on this (and you can break it out by agency using the dropdown at the top). It also estimates that only 5% of data comes from federal networks. (Disclaimer: I work on analytics.usa.gov.)
        ajdlinux 10y ago
        I didn't say US Government. Australia :)
        voltagex_ 10y ago
        We should have analytics.dto.gov.au.
        konklone 10y ago
        It's open source. ;) https://github.com/18f/analytics.usa.gov#analyticsusagov https://github.com/18f/analytics.usa.gov#analyticsusagov
        voltagex_ 10y ago
        https://www.dto.gov.au/blog/building-better-services-with-analytics/ https://www.dto.gov.au/blog/building-better-services-with-an...
      - tjalfi 10y ago
        I would hope that they are using IE11 set to IE6 compatibility mode. My employer has an application that requires IE5 compatibility mode.
      - angry_octet 10y ago
        This is because some project once created an internal application with a web interface, which was tested with IE6. This application may be critical to keeping people happy (e.g. the HR system) or some unqualified bozo may want to 'cut costs' like updating apps to new browsers, so mandates sticking to a 'stable' version like IE6. And all future apps will have to target IE6 forever more... It gets worse... People write apps that use Flash (online training) or Java applets. There are solutions to this, but none of them involve using the one true SOE, one SOE to rule them all!
    - peterwwillis 10y ago
      Even if the employee can update it themselves, it is often prohibited, and fixing a vulnerability is treated as unauthorized installation of software, which is clearly against the terms of employment when using company computers. Whether they treat it as a big deal or not depends on who is involved, of course.
  - acdha 10y ago
    Never underestimate the degree to which enterprise IT departments view change as something to be feared. I once heard someone say that they wanted to delay Chrome updates until their security team could review them — said review process basically being waiting in a backlog for weeks and then someone searches for CVEs posted on that version.
    - nailer 10y ago
      > Never underestimate the degree to which enterprise IT departments view change as something to be feared. This. These supposedly risk-averse organisations also have no concept of the risk of stasis, only the risk of change.
    - technion 10y ago
      I worked with a Government group that firmly rejected the concept of Windows security updates. The general premise was, if you apply an update and something breaks (note that "changed behaviour" means "broken"), someone's head will roll. If you do nothing and get compromised, it's those damned <country> hackers again.
    - protomyth 10y ago
      > Never underestimate the degree to which enterprise IT departments view change as something to be feared. Never underestimate the management's ability to fire a Enterprise IT workers for applying an update that the developer's swear changes no behavior in the companies enterprise software, but actually does. // been on both sides, we suck at testing and risk assessment in this profession
      - acdha 10y ago
        Definitely — when you see people afraid to do something, that almost always indicates a deeper organization problem.
  - woliveirajr 10y ago
    I (anecdote) know a country- sized governamental system that sticks to specific versions of Firefox. Not chrome or edge or IE or Safari or... Just Firefox. Specific versions. With some big lag when new versions of Firefox come out. Companies and citizens, live with that.
    - voltagex_ 10y ago
      Firefox has the ESR release for this purpose.
      - woliveirajr 10y ago
        Yes, thanks for this information. But sadly no, they don't follow this kind of stable release.
  - shthed 10y ago
    Java applets! I know a government department that'll be stuck on Chrome 44 for a looong time.
    - protomyth 10y ago
      Someone could make a mint selling a Java applet runner to government agencies.
- leesalminen 10y ago
  If you rely on printing things, don't update to Chrome 54. https://bugs.chromium.org/p/chromium/issues/detail?id=658606 https://bugs.chromium.org/p/chromium/issues/detail?id=658606
  - voltagex_ 10y ago
    Christ, Google. At least the workaround is relatively simple - print to PDF (using Chrome's built in option) and then print that from another reader.
  - 15thandwhatever 10y ago
    Edit: I deleted my original comment because I totally confused the brands (Xerox, not Brother). Brother doesn't do rebranded Samsung printers. Link to Xerox issue: http://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_are_switching_written_numbers_when_scanning http://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_...
- revelation 10y ago
  None of the vulnerabilities are in Chrome?
  - voltagex_ 10y ago
    Google says their sandbox prevents it, but https://helpx.adobe.com/security/products/flash-player/apsb16-36.html https://helpx.adobe.com/security/products/flash-player/apsb1... says Chrome's embedded Flash is affected.
    - revelation 10y ago
      I think they update that separately from Chrome versions. My Chrome already updated to 54 so I can't verify that, but you can check chrome://plugins/ to see if you have the fixed 23.0.0.205 version.
jdright 10y ago
Well done! That should be the rule, anything else is hypocritical.
- Analemma_ 10y ago
  No, "hypocritical" would be disclosing critical vulnerabilities in a competitor's product after a week of notification, when you yourself stop shipping security updates for your mobile operating system after two years; instead suggesting "buy a new phone!" as the solution. But no one would be that sleazy.
  - bitmapbrother 10y ago
    Yes, it's far better to not inform the public that their computers are being infected by an active Windows zero day.
    - zelon88 10y ago
      I see where he's coming from though. It is hypocritical that Google cares so much about Microsoft's customers and then craps on their own user-base so regularly. Case in point: Google released the app launcher for Linux, waited for adoption to take place (so that devs and users had apps made, tested, installed, and in-use) and then they canned the whole thing because it was taking market share away from Chromium. Then, they canned Chromium OS! If I were Microsoft I'd tell them to mind their own damn business as well. It's obvious anyway that the only thing Google cares about in this instance is making themselves look good at the expense of Microsoft.
      - JoshTriplett 10y ago
        > Then, they canned Chromium OS! Chromium OS is alive and well. Perhaps you're thinking of the Chrome-specific "application" APIs, which have been deprecated in favor of web technologies?
      - bitmapbrother 10y ago
        Why shouldn't Google care about customers that use Windows? A large percentage of them also use Google services so it's in their interest to inform them. >If I were Microsoft I'd tell them to mind their own damn business as well. What would you tell their customers that were infected by their negligence? Let me guess? "Mind your own damn business".
bitmapbrother 10y ago
From VentureBeat: >Microsoft harshly criticized the disclosure. “Today’s disclosure by Google puts customers at potential risk,” a Microsoft spokesperson said. “We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection.” Really? Because I thought "your customers" were already at risk for an in the wild zero day exploit that's currently being used to infect Windows computers. How dare Google warn the public to allow them the time to take precautionary steps. I guess they think it's better for their customers to take it up the ass until they figure out how to patch it.
- TallGuyShort 10y ago
  Given Microsoft's well-known cadence for releases, it might be prudent for Google to update their policy to 2 weeks in some cases (e.g. not yet observed being actively exploited) so that something reported to Microsoft right before an update doesn't get disclosed right before they can reasonably release an update without moving heaven and earth. But if it's being actively exploited? Yes, thank you Google for letting us know ASAP. Would indeed be irresponsible not to in this case.
  - Shank 10y ago
    The actively exploited window is 7 days, but the "normal" window is 90 days, which is far, far more than the Microsoft cadence. 7 days is plenty for a kernel level, actively exploited privilege escalation vulnerability, in my humble opinion.
  - deleted 10y ago
    [deleted]
  - alanh 10y ago
    There is precedent for Microsoft to release patches on days other than Tuesday (they call this “going out of band”) when an exploit is being used in the wild, especially if it is wormable. (This was the case for the hole that was later exploited by Conficker, for example.)
  - anfedorov 10y ago
pianoben 10y ago
What an interesting comment on the state of corporate relationships; Google actively delayed disclosure of an impactful vulnerability for Apple (https://news.ycombinator.com/item?id=12795332 https://news.ycombinator.com/item?id=12795332). I wonder why they would not do the same for Microsoft?
- revelation 10y ago
  That was a design error, this is presumably a simple bug fix. It's also being actively exploited.
- blinkingled 10y ago
  Google did not claim they were aware of active exploitation of the Apple vulnerability whereas for this Windows one, they claim knowledge of it being exploited actively.
- valas 10y ago
  Was that Apple vulnerability actively exploited in the wild during the delay?
- jlgaddis 10y ago
  They have done the same for Microsoft, extending the 90-day deadline multiple times. Why they didn't in this specific instance is probably because it was being actively exploited in the wild, but that's just a guess.
besselheim 10y ago
Advertising the details of an exploitable vulnerability before the vendor has patched is protecting users now? I don't buy this motive at all.
- Godel_unicode 10y ago
  That level of detail allows malware detection by static analysis, A/V signatures, HIPS rules, etc. Source: I've done these things before based off notices like this, and caught malware with it
  - besselheim 10y ago
    At the same time it allows exploit writers to quickly add this to their kits. I'd expect AV vendors to already have signatures for this given that it's being actively exploited, which means there must be malware samples to know this.
    - anfedorov 10y ago
      Most importantly it tells MS "fix your shit when your users are being attacked". Seven days ago was a Monday. That means they had a full week and a weekend to fix this. I understand that big bureaucratic organizations move slowly, and that the fix isn't trivial, but this is really the kind of thing for which they should have "scramble the jets and fix it" processes in place if they care about their user's security. When there are known exploits attacks against users, giving a short time to get out quick patches to trusted software vendors makes a lot of sense, but I don't see a good reason for giving more than 24-48 hours before public disclosure.
    - ascendantlogic 10y ago
      Ah yes, the endless holy war over what constitutes "responsible" disclosure and the concern over who benefits more, the attackers or the attackees? In this case, the exploit was being actively used in the wild. That means bad actors already had access to this and it was the users who were in the dark. Now it may be added to the "toolkits" of scripters and people who buy exploit frameworks but the people who do real damage were already using it according to Google.
eganist 10y ago
Hm. > Chrome's sandbox [...] prevents exploitation of this sandbox escape vulnerability. It reads to me as though Google disclosed an 0day to promote Google Chrome. This is fine. ••• Edit: http://venturebeat.com/2016/10/31/google-discloses-actively-exploited-windows-vulnerability-just-10-days-after-reporting-it-to-microsoft/ http://venturebeat.com/2016/10/31/google-discloses-actively-... > A source close to the company also shared that the exploit Google describes requires the Adobe Flash vulnerability. Since Flash has been patched, the Windows vulnerability is mitigated. If the immediate risk has been mitigated (barring other unknown attack vectors, this was the immediate one of which Google appears to have been aware), this makes the disclosure seem even more shamelessly promotional. I'd presume the Flash vuln would be to enable drive-by exploitation, so if that risk is mitigated, then they really seriously could've let this one wait.
- magicalist 10y ago
  > Chrome's sandbox [...] on Windows 10 [...] prevents exploitation of this sandbox escape vulnerability. the Windows version is an important part of that statement since it's unclear from this what versions of Windows are affected by the vulnerability.
  - eganist 10y ago
    > since it's unclear from this what versions of Windows are affected by the vulnerability. If anything, this just makes it worse, since it tells me Windows 7 users are SOL.
    - magicalist 10y ago
      > If anything, this just makes it worse Makes what worse? There's no mention of other browsers (so how could this be an ad for Chrome? Is Edge vulnerable? Is Firefox?) and the plain implication is that Chrome on Windows 7 is indeed SOL.
      - deleted 10y ago
        [deleted]
based2 10y ago
https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure
XparXnoiAx 10y ago
It should be pointed out that most vulnerabilities are, in fact, being exploited before they are patched. Citation in this article: https://medium.com/@xParXnoiAx/irresponsible-disclosure-52d08cddcd07 https://medium.com/@xParXnoiAx/irresponsible-disclosure-52d0...
- fulafel 10y ago
  So that's linking to a Forbes article that's paraphrasing this study from 2012: https://users.ece.cmu.edu/~tdumitra/public_documents/bilge12_zero_day.pdf https://users.ece.cmu.edu/~tdumitra/public_documents/bilge12... It doesn't support your assertion but it's still interesting 2008-2010 data from an antivirus vendor. It's talking about about how long some vulnerabilities were exploited by malware before getting disclosed, use in targeted attacks, and so on.
  - XparXnoiAx 10y ago
    The study says that most vulnerabilities were being exploited before being disclosed.
    - fulafel 10y ago
      I don't think it says that about the set of all vulnerabilities (IOW - citation needed!). It does say "In this paper, we consider only exploits that have been used in real-world attacks before the corresponding vulnerabilities were disclosed" so it's unsurprising that in their dataset this is the case :)
      - XparXnoiAx 10y ago
        Yeap, you're right, I misread. Here is a quote from the paper: "15% of these exploits were created before the disclosure of the corresponding vulnerability." So there's a lower bound.
nulagrithom 10y ago
Incidentally this reminds me, I recall that Angular 1.x was banned from Firefox add-ons... Was the vulnerability ever made public?
- 45h34jh53k4j 10y ago
  yeah, it does eval(); no vuln, just a specific design choice that breaks the security model of the browser plugins. Basically the plugin operates at a higher level than the regular page DOM, so by running angular from a plugin you gain the ability to both execute (arbitrary) javascript from the page but also read/write to the disk. very bad. cannot be fixed. arbitrary code execution by design.
kovrik 10y ago
Probably a very stupid question, but I'm wondering if containers (which are extremely popular nowadays) can help us to improve web security? What I mean is, that all major browsers are trying to create their own sandbox environment to be more secure, right? But maybe it is better to do the other way round: give them all permissions, but put them in a controlled and restricted sandbox environment (container). And browser window will be just a small app that talks to that container, sends requests and gets resulting page (rendered) and just shows it? So, it will literally have no access to outside of the container. As a bonus, it decouples UI from backend. Asking, because the purpose of containers is to isolate and create sandbox environments, and the purpose of browser is to render and show web pages. So why do browsers care about security, if we already have containers? Or that makes no sense and gives no advantage/security?
- tedunangst 10y ago
  ?? This is a sandbox escape exploit. Calling a sandbox a container isn't going to stop the exploit.
- viraptor 10y ago
  > major browsers are trying to create their own sandbox environment This is partially true: for example there are sandboxes considering the website origin and related restrictions, but on the process level browsers reuse the system mechanism instead of implementing their own. For example on linux, chrome uses seccomp and a number of other ways to separate the ui from the backend. Windows has its own solutions for this. So I don't think it's right to say they create their own sandboxes. At least not in a NIH meaning. Containers are just a fancy package for the protections offered directly by namespaces and other existing restrictions. User namespaces are already used in chrome sandboxes for example (https://chromium.googlesource.com/chromium/src/+/master/docs/linux_sandboxing.md#User_namespaces_sandbox.md https://chromium.googlesource.com/chromium/src/+/master/docs...)
- technion 10y ago
  Have a look at what Microsoft is doing with Edge and Application Guard: https://blogs.windows.com/msedgedev/2016/09/27/application-guard-microsoft-edge https://blogs.windows.com/msedgedev/2016/09/27/application-g...
greggman 10y ago
All browsers have about the same amount of bugs but Chrome's design or as they say "defense in depth" acknowledges that there will always be bugs so tries to make it as hard as possible for bugs to allow bad things. Compare vulnerabilities Chrome 6% code execution, 0.4% gain privileges Firefox 48% code execution, 8.4% gain privileges Safari 60% code execution, 9.4% gain privileges IE 79% code execution, 7.2% gain privileges Edge 55% code execution, 16.4% gain privileges Before you complain Firefox and IE are older is older we can compare just the last 2 years of vulerabilities https://docs.google.com/spreadsheets/d/1nqBd7zmg6grVBEws_UPXFBIdZT_0ISjIaHPK4cJvjII/edit?usp=sharing https://docs.google.com/spreadsheets/d/1nqBd7zmg6grVBEws_UPX... I expect Firefox's newer stats to get better on this front as they move to electrolysis and servo It's interesting to note that Safari has zero "gain privileges bugs" for the last 2 years even if it has 22x the code execution bugs as Chrome http://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 http://www.cvedetails.com/product/15031/Google-Chrome.html?v... http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?vendor_id=452 http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?... http://www.cvedetails.com/product/2935/Apple-Safari.html?vendor_id=49 http://www.cvedetails.com/product/2935/Apple-Safari.html?ven... http://www.cvedetails.com/product/9900/Microsoft-Internet-Explorer.html?vendor_id=26 http://www.cvedetails.com/product/9900/Microsoft-Internet-Ex... http://www.cvedetails.com/product/32367/Microsoft-Edge.html?vendor_id=26 http://www.cvedetails.com/product/32367/Microsoft-Edge.html?...
- fjarlq 10y ago
  It looks like you've made several errors quoting from cited spreadsheet. Aren't these the correct numbers according to the spreadsheet? Browser vulnerabilities 2015/01 - 2016/10 ========================================= Browser Code Execution Gain Privileges ------- -------------- --------------- Chrome 2.89% 0.58% Firefox 43.59% 2.88% Safari 69.11% 0.00% IE 69.08% 6.07% Edge 55.22% 2.24% Source: https://docs.google.com/spreadsheets/d/1nqBd7zmg6grVBEws_UPXFBIdZT_0ISjIaHPK4cJvjII https://docs.google.com/spreadsheets/d/1nqBd7zmg6grVBEws_UPX...
  - deleted 10y ago
    [deleted]
gbil 10y ago
While it is good that users are informed for an upcoming threat in order to pay attention, when you start that vulnerability disclosure with the title "Disclosing vulnerabilities to protect users" you are an attention whore and you are not doing it for the public.
jacquesm 10y ago
I like the fact that they disclose the vulnerabilities but I'd be even more interested in where they are exploited.
bshastry 10y ago
We sell your data and in return make browsing safe for you so we can sell more of your data. Clever Google. Really clever...
thinkMOAR 10y ago
Personally i'm still not convinced this is good or bad. Protect users AND educating script kiddies, this is a hard trade off, and all lazy updating users will be more vulnerable then before. (more being more script kiddies, not so much more vulnerabilities). As long as it is done responsible and vendors are given chances to fix this before. Not disclosing is worse i guess in any case. However, "We encourage users to verify that auto-updaters have already updated Flash" While adobe recommends to not install it, meh.. :)
- cmdrfred 10y ago
  Script kiddies used to mean someone who downloaded a DOS tool for example and ran it. As far as I know Google didn't release such a tool, nor is one available. Did the definition change?
  - Shanea93 10y ago
    That's my understanding of the popular usage, however I have noticed people also using it to refer to people who take advantage of known security issues using "simplistic" programming languages and techniques. IE, a script kiddie is more likely to use python or php to SQL inject than to execute a timing attack against a crypto library.
  - thinkMOAR 10y ago
    Why a 'dos' tool? They download 'scripts/utils' and simply use them and call themselves hackers. They don't always do a denial of service attack. That never changed, but perhaps you never learned it correctly. Telling the world about vulnerabilities is a knife that cuts on two sides. Inform users about security. Inform wankers how to abuse stuff.
    - cmdrfred 10y ago
      Just an example: "someone who downloaded a DOS tool for example"
- thinkMOAR 10y ago
ainiriand 10y ago
win32k.sys, the fractal of bugs.
us0r 10y ago
Here is a question for the armchair (or real) lawyers - How does disclosing this not run afoul of the law?
- xenophonf 10y ago
  In the U.S. people are guaranteed by law to express themselves as they see fit, without government interference except in the most constrained cases. A security vulnerability disclosure does not meet any of the constrains I can think of off-hand: not incitement, not libel (written) nor slander (spoken), not child pornography, not obscenity, not false advertising, etc. https://en.wikipedia.org/wiki/United_States_free_speech_exceptions https://en.wikipedia.org/wiki/United_States_free_speech_exce...

305 points by nnx 10y ago

Does anyone know which version of Chrome this was fixed in? This may force $EMPLOYER to finally update from an unholy mix of 50 and 53.

jrowley 10y ago
Why would your employer fix you to a specific version of chrome? Thats bizarre.
- voltagex_ 10y ago
  Yes, yes it is.
- cesarb 10y ago
  Large companies tend to be bad at keeping up-to-date. I know of a bank that still uses OpenOffice. No, not Apache OpenOffice: they still use the real OpenOffice.org. Workstations are often locked down, so employees can't install or upgrade anything.
  - ajdlinux 10y ago
    A friend of mine working for the government told me that in one major government agency, the most popular version of IE used on their website is IE11. The second most popular version? IE 6. Not even 8. IE 6. Who still uses it? Employees of other government departments...
    - alanh 10y ago
      Yeah… just a reminder: IE6 was released in August 2011.
      - Diggsey 10y ago
        No it wasn't... It was released in 2001
      - kpozin 10y ago
        A little earlier than that: August 2001.
        alanh 10y ago
        Can I blame bitrot? Yes, thanks, of course I meant 2001.
        madgar 10y ago
        For a sense of just how long ago that was, IE6 was released before 9/11. Truly a more innocent time.
      - drv 10y ago
        2001, not 2011. Time flies. :)
    - konklone 10y ago
      While this is plausible for the past, I think this info is outdated now. https://analytics.usa.gov https://analytics.usa.gov has lots of data on this (and you can break it out by agency using the dropdown at the top). It also estimates that only 5% of data comes from federal networks. (Disclaimer: I work on analytics.usa.gov.)
      - ajdlinux 10y ago
        I didn't say US Government. Australia :)
        voltagex_ 10y ago
        We should have analytics.dto.gov.au.
        konklone 10y ago
        It's open source. ;) https://github.com/18f/analytics.usa.gov#analyticsusagov https://github.com/18f/analytics.usa.gov#analyticsusagov
        voltagex_ 10y ago
        https://www.dto.gov.au/blog/building-better-services-with-analytics/ https://www.dto.gov.au/blog/building-better-services-with-an...
    - tjalfi 10y ago
      I would hope that they are using IE11 set to IE6 compatibility mode. My employer has an application that requires IE5 compatibility mode.
    - angry_octet 10y ago
      This is because some project once created an internal application with a web interface, which was tested with IE6. This application may be critical to keeping people happy (e.g. the HR system) or some unqualified bozo may want to 'cut costs' like updating apps to new browsers, so mandates sticking to a 'stable' version like IE6. And all future apps will have to target IE6 forever more... It gets worse... People write apps that use Flash (online training) or Java applets. There are solutions to this, but none of them involve using the one true SOE, one SOE to rule them all!
  - peterwwillis 10y ago
    Even if the employee can update it themselves, it is often prohibited, and fixing a vulnerability is treated as unauthorized installation of software, which is clearly against the terms of employment when using company computers. Whether they treat it as a big deal or not depends on who is involved, of course.
- acdha 10y ago
  Never underestimate the degree to which enterprise IT departments view change as something to be feared. I once heard someone say that they wanted to delay Chrome updates until their security team could review them — said review process basically being waiting in a backlog for weeks and then someone searches for CVEs posted on that version.
  - nailer 10y ago
    > Never underestimate the degree to which enterprise IT departments view change as something to be feared. This. These supposedly risk-averse organisations also have no concept of the risk of stasis, only the risk of change.
  - technion 10y ago
    I worked with a Government group that firmly rejected the concept of Windows security updates. The general premise was, if you apply an update and something breaks (note that "changed behaviour" means "broken"), someone's head will roll. If you do nothing and get compromised, it's those damned <country> hackers again.
  - protomyth 10y ago
    > Never underestimate the degree to which enterprise IT departments view change as something to be feared. Never underestimate the management's ability to fire a Enterprise IT workers for applying an update that the developer's swear changes no behavior in the companies enterprise software, but actually does. // been on both sides, we suck at testing and risk assessment in this profession
    - acdha 10y ago
      Definitely — when you see people afraid to do something, that almost always indicates a deeper organization problem.
- woliveirajr 10y ago
  I (anecdote) know a country- sized governamental system that sticks to specific versions of Firefox. Not chrome or edge or IE or Safari or... Just Firefox. Specific versions. With some big lag when new versions of Firefox come out. Companies and citizens, live with that.
  - voltagex_ 10y ago
    Firefox has the ESR release for this purpose.
    - woliveirajr 10y ago
      Yes, thanks for this information. But sadly no, they don't follow this kind of stable release.
- shthed 10y ago
  Java applets! I know a government department that'll be stuck on Chrome 44 for a looong time.
  - protomyth 10y ago
    Someone could make a mint selling a Java applet runner to government agencies.
leesalminen 10y ago
If you rely on printing things, don't update to Chrome 54. https://bugs.chromium.org/p/chromium/issues/detail?id=658606 https://bugs.chromium.org/p/chromium/issues/detail?id=658606
- voltagex_ 10y ago
  Christ, Google. At least the workaround is relatively simple - print to PDF (using Chrome's built in option) and then print that from another reader.
- 15thandwhatever 10y ago
  Edit: I deleted my original comment because I totally confused the brands (Xerox, not Brother). Brother doesn't do rebranded Samsung printers. Link to Xerox issue: http://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_are_switching_written_numbers_when_scanning http://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_...
revelation 10y ago
None of the vulnerabilities are in Chrome?
- voltagex_ 10y ago
  Google says their sandbox prevents it, but https://helpx.adobe.com/security/products/flash-player/apsb16-36.html https://helpx.adobe.com/security/products/flash-player/apsb1... says Chrome's embedded Flash is affected.
  - revelation 10y ago
    I think they update that separately from Chrome versions. My Chrome already updated to 54 so I can't verify that, but you can check chrome://plugins/ to see if you have the fixed 23.0.0.205 version.

jdright 10y ago

Well done! That should be the rule, anything else is hypocritical.

Analemma_ 10y ago
No, "hypocritical" would be disclosing critical vulnerabilities in a competitor's product after a week of notification, when you yourself stop shipping security updates for your mobile operating system after two years; instead suggesting "buy a new phone!" as the solution. But no one would be that sleazy.
- bitmapbrother 10y ago
  Yes, it's far better to not inform the public that their computers are being infected by an active Windows zero day.
  - zelon88 10y ago
    I see where he's coming from though. It is hypocritical that Google cares so much about Microsoft's customers and then craps on their own user-base so regularly. Case in point: Google released the app launcher for Linux, waited for adoption to take place (so that devs and users had apps made, tested, installed, and in-use) and then they canned the whole thing because it was taking market share away from Chromium. Then, they canned Chromium OS! If I were Microsoft I'd tell them to mind their own damn business as well. It's obvious anyway that the only thing Google cares about in this instance is making themselves look good at the expense of Microsoft.
    - JoshTriplett 10y ago
      > Then, they canned Chromium OS! Chromium OS is alive and well. Perhaps you're thinking of the Chrome-specific "application" APIs, which have been deprecated in favor of web technologies?
    - bitmapbrother 10y ago
      Why shouldn't Google care about customers that use Windows? A large percentage of them also use Google services so it's in their interest to inform them. >If I were Microsoft I'd tell them to mind their own damn business as well. What would you tell their customers that were infected by their negligence? Let me guess? "Mind your own damn business".

bitmapbrother 10y ago

From VentureBeat: >Microsoft harshly criticized the disclosure. “Today’s disclosure by Google puts customers at potential risk,” a Microsoft spokesperson said. “We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection.” Really? Because I thought "your customers" were already at risk for an in the wild zero day exploit that's currently being used to infect Windows computers. How dare Google warn the public to allow them the time to take precautionary steps. I guess they think it's better for their customers to take it up the ass until they figure out how to patch it.

TallGuyShort 10y ago
Given Microsoft's well-known cadence for releases, it might be prudent for Google to update their policy to 2 weeks in some cases (e.g. not yet observed being actively exploited) so that something reported to Microsoft right before an update doesn't get disclosed right before they can reasonably release an update without moving heaven and earth. But if it's being actively exploited? Yes, thank you Google for letting us know ASAP. Would indeed be irresponsible not to in this case.
- Shank 10y ago
  The actively exploited window is 7 days, but the "normal" window is 90 days, which is far, far more than the Microsoft cadence. 7 days is plenty for a kernel level, actively exploited privilege escalation vulnerability, in my humble opinion.
- deleted 10y ago
  [deleted]
- alanh 10y ago
  There is precedent for Microsoft to release patches on days other than Tuesday (they call this “going out of band”) when an exploit is being used in the wild, especially if it is wormable. (This was the case for the hole that was later exploited by Conficker, for example.)
- anfedorov 10y ago

pianoben 10y ago

What an interesting comment on the state of corporate relationships; Google actively delayed disclosure of an impactful vulnerability for Apple (https://news.ycombinator.com/item?id=12795332 https://news.ycombinator.com/item?id=12795332). I wonder why they would not do the same for Microsoft?

revelation 10y ago
That was a design error, this is presumably a simple bug fix. It's also being actively exploited.
blinkingled 10y ago
Google did not claim they were aware of active exploitation of the Apple vulnerability whereas for this Windows one, they claim knowledge of it being exploited actively.
valas 10y ago
Was that Apple vulnerability actively exploited in the wild during the delay?
jlgaddis 10y ago
They have done the same for Microsoft, extending the 90-day deadline multiple times. Why they didn't in this specific instance is probably because it was being actively exploited in the wild, but that's just a guess.

besselheim 10y ago

Advertising the details of an exploitable vulnerability before the vendor has patched is protecting users now? I don't buy this motive at all.

Godel_unicode 10y ago
That level of detail allows malware detection by static analysis, A/V signatures, HIPS rules, etc. Source: I've done these things before based off notices like this, and caught malware with it
- besselheim 10y ago
  At the same time it allows exploit writers to quickly add this to their kits. I'd expect AV vendors to already have signatures for this given that it's being actively exploited, which means there must be malware samples to know this.
  - anfedorov 10y ago
    Most importantly it tells MS "fix your shit when your users are being attacked". Seven days ago was a Monday. That means they had a full week and a weekend to fix this. I understand that big bureaucratic organizations move slowly, and that the fix isn't trivial, but this is really the kind of thing for which they should have "scramble the jets and fix it" processes in place if they care about their user's security. When there are known exploits attacks against users, giving a short time to get out quick patches to trusted software vendors makes a lot of sense, but I don't see a good reason for giving more than 24-48 hours before public disclosure.
  - ascendantlogic 10y ago
    Ah yes, the endless holy war over what constitutes "responsible" disclosure and the concern over who benefits more, the attackers or the attackees? In this case, the exploit was being actively used in the wild. That means bad actors already had access to this and it was the users who were in the dark. Now it may be added to the "toolkits" of scripters and people who buy exploit frameworks but the people who do real damage were already using it according to Google.

eganist 10y ago

Hm. > Chrome's sandbox [...] prevents exploitation of this sandbox escape vulnerability. It reads to me as though Google disclosed an 0day to promote Google Chrome. This is fine. ••• Edit: http://venturebeat.com/2016/10/31/google-discloses-actively-exploited-windows-vulnerability-just-10-days-after-reporting-it-to-microsoft/ http://venturebeat.com/2016/10/31/google-discloses-actively-... > A source close to the company also shared that the exploit Google describes requires the Adobe Flash vulnerability. Since Flash has been patched, the Windows vulnerability is mitigated. If the immediate risk has been mitigated (barring other unknown attack vectors, this was the immediate one of which Google appears to have been aware), this makes the disclosure seem even more shamelessly promotional. I'd presume the Flash vuln would be to enable drive-by exploitation, so if that risk is mitigated, then they really seriously could've let this one wait.

magicalist 10y ago
> Chrome's sandbox [...] on Windows 10 [...] prevents exploitation of this sandbox escape vulnerability. the Windows version is an important part of that statement since it's unclear from this what versions of Windows are affected by the vulnerability.
- eganist 10y ago
  > since it's unclear from this what versions of Windows are affected by the vulnerability. If anything, this just makes it worse, since it tells me Windows 7 users are SOL.
  - magicalist 10y ago
    > If anything, this just makes it worse Makes what worse? There's no mention of other browsers (so how could this be an ad for Chrome? Is Edge vulnerable? Is Firefox?) and the plain implication is that Chrome on Windows 7 is indeed SOL.
    - deleted 10y ago
      [deleted]

based2 10y ago

https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure

XparXnoiAx 10y ago

It should be pointed out that most vulnerabilities are, in fact, being exploited before they are patched. Citation in this article: https://medium.com/@xParXnoiAx/irresponsible-disclosure-52d08cddcd07 https://medium.com/@xParXnoiAx/irresponsible-disclosure-52d0...

fulafel 10y ago
So that's linking to a Forbes article that's paraphrasing this study from 2012: https://users.ece.cmu.edu/~tdumitra/public_documents/bilge12_zero_day.pdf https://users.ece.cmu.edu/~tdumitra/public_documents/bilge12... It doesn't support your assertion but it's still interesting 2008-2010 data from an antivirus vendor. It's talking about about how long some vulnerabilities were exploited by malware before getting disclosed, use in targeted attacks, and so on.
- XparXnoiAx 10y ago
  The study says that most vulnerabilities were being exploited before being disclosed.
  - fulafel 10y ago
    I don't think it says that about the set of all vulnerabilities (IOW - citation needed!). It does say "In this paper, we consider only exploits that have been used in real-world attacks before the corresponding vulnerabilities were disclosed" so it's unsurprising that in their dataset this is the case :)
    - XparXnoiAx 10y ago
      Yeap, you're right, I misread. Here is a quote from the paper: "15% of these exploits were created before the disclosure of the corresponding vulnerability." So there's a lower bound.

nulagrithom 10y ago

Incidentally this reminds me, I recall that Angular 1.x was banned from Firefox add-ons... Was the vulnerability ever made public?

45h34jh53k4j 10y ago
yeah, it does eval(); no vuln, just a specific design choice that breaks the security model of the browser plugins. Basically the plugin operates at a higher level than the regular page DOM, so by running angular from a plugin you gain the ability to both execute (arbitrary) javascript from the page but also read/write to the disk. very bad. cannot be fixed. arbitrary code execution by design.

kovrik 10y ago

Probably a very stupid question, but I'm wondering if containers (which are extremely popular nowadays) can help us to improve web security? What I mean is, that all major browsers are trying to create their own sandbox environment to be more secure, right? But maybe it is better to do the other way round: give them all permissions, but put them in a controlled and restricted sandbox environment (container). And browser window will be just a small app that talks to that container, sends requests and gets resulting page (rendered) and just shows it? So, it will literally have no access to outside of the container. As a bonus, it decouples UI from backend. Asking, because the purpose of containers is to isolate and create sandbox environments, and the purpose of browser is to render and show web pages. So why do browsers care about security, if we already have containers? Or that makes no sense and gives no advantage/security?

tedunangst 10y ago
?? This is a sandbox escape exploit. Calling a sandbox a container isn't going to stop the exploit.
viraptor 10y ago
> major browsers are trying to create their own sandbox environment This is partially true: for example there are sandboxes considering the website origin and related restrictions, but on the process level browsers reuse the system mechanism instead of implementing their own. For example on linux, chrome uses seccomp and a number of other ways to separate the ui from the backend. Windows has its own solutions for this. So I don't think it's right to say they create their own sandboxes. At least not in a NIH meaning. Containers are just a fancy package for the protections offered directly by namespaces and other existing restrictions. User namespaces are already used in chrome sandboxes for example (https://chromium.googlesource.com/chromium/src/+/master/docs/linux_sandboxing.md#User_namespaces_sandbox.md https://chromium.googlesource.com/chromium/src/+/master/docs...)
technion 10y ago
Have a look at what Microsoft is doing with Edge and Application Guard: https://blogs.windows.com/msedgedev/2016/09/27/application-guard-microsoft-edge https://blogs.windows.com/msedgedev/2016/09/27/application-g...

greggman 10y ago

All browsers have about the same amount of bugs but Chrome's design or as they say "defense in depth" acknowledges that there will always be bugs so tries to make it as hard as possible for bugs to allow bad things. Compare vulnerabilities Chrome 6% code execution, 0.4% gain privileges Firefox 48% code execution, 8.4% gain privileges Safari 60% code execution, 9.4% gain privileges IE 79% code execution, 7.2% gain privileges Edge 55% code execution, 16.4% gain privileges Before you complain Firefox and IE are older is older we can compare just the last 2 years of vulerabilities https://docs.google.com/spreadsheets/d/1nqBd7zmg6grVBEws_UPXFBIdZT_0ISjIaHPK4cJvjII/edit?usp=sharing https://docs.google.com/spreadsheets/d/1nqBd7zmg6grVBEws_UPX... I expect Firefox's newer stats to get better on this front as they move to electrolysis and servo It's interesting to note that Safari has zero "gain privileges bugs" for the last 2 years even if it has 22x the code execution bugs as Chrome http://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 http://www.cvedetails.com/product/15031/Google-Chrome.html?v... http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?vendor_id=452 http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?... http://www.cvedetails.com/product/2935/Apple-Safari.html?vendor_id=49 http://www.cvedetails.com/product/2935/Apple-Safari.html?ven... http://www.cvedetails.com/product/9900/Microsoft-Internet-Explorer.html?vendor_id=26 http://www.cvedetails.com/product/9900/Microsoft-Internet-Ex... http://www.cvedetails.com/product/32367/Microsoft-Edge.html?vendor_id=26 http://www.cvedetails.com/product/32367/Microsoft-Edge.html?...

fjarlq 10y ago
It looks like you've made several errors quoting from cited spreadsheet. Aren't these the correct numbers according to the spreadsheet? Browser vulnerabilities 2015/01 - 2016/10 ========================================= Browser Code Execution Gain Privileges ------- -------------- --------------- Chrome 2.89% 0.58% Firefox 43.59% 2.88% Safari 69.11% 0.00% IE 69.08% 6.07% Edge 55.22% 2.24% Source: https://docs.google.com/spreadsheets/d/1nqBd7zmg6grVBEws_UPXFBIdZT_0ISjIaHPK4cJvjII https://docs.google.com/spreadsheets/d/1nqBd7zmg6grVBEws_UPX...
- deleted 10y ago
  [deleted]

gbil 10y ago

While it is good that users are informed for an upcoming threat in order to pay attention, when you start that vulnerability disclosure with the title "Disclosing vulnerabilities to protect users" you are an attention whore and you are not doing it for the public.

jacquesm 10y ago

I like the fact that they disclose the vulnerabilities but I'd be even more interested in where they are exploited.

bshastry 10y ago

We sell your data and in return make browsing safe for you so we can sell more of your data. Clever Google. Really clever...

thinkMOAR 10y ago

Personally i'm still not convinced this is good or bad. Protect users AND educating script kiddies, this is a hard trade off, and all lazy updating users will be more vulnerable then before. (more being more script kiddies, not so much more vulnerabilities). As long as it is done responsible and vendors are given chances to fix this before. Not disclosing is worse i guess in any case. However, "We encourage users to verify that auto-updaters have already updated Flash" While adobe recommends to not install it, meh.. :)

cmdrfred 10y ago
Script kiddies used to mean someone who downloaded a DOS tool for example and ran it. As far as I know Google didn't release such a tool, nor is one available. Did the definition change?
- Shanea93 10y ago
  That's my understanding of the popular usage, however I have noticed people also using it to refer to people who take advantage of known security issues using "simplistic" programming languages and techniques. IE, a script kiddie is more likely to use python or php to SQL inject than to execute a timing attack against a crypto library.
- thinkMOAR 10y ago
  Why a 'dos' tool? They download 'scripts/utils' and simply use them and call themselves hackers. They don't always do a denial of service attack. That never changed, but perhaps you never learned it correctly. Telling the world about vulnerabilities is a knife that cuts on two sides. Inform users about security. Inform wankers how to abuse stuff.
  - cmdrfred 10y ago
    Just an example: "someone who downloaded a DOS tool for example"
thinkMOAR 10y ago

ainiriand 10y ago

win32k.sys, the fractal of bugs.

us0r 10y ago

Here is a question for the armchair (or real) lawyers - How does disclosing this not run afoul of the law?

xenophonf 10y ago
In the U.S. people are guaranteed by law to express themselves as they see fit, without government interference except in the most constrained cases. A security vulnerability disclosure does not meet any of the constrains I can think of off-hand: not incitement, not libel (written) nor slander (spoken), not child pornography, not obscenity, not false advertising, etc. https://en.wikipedia.org/wiki/United_States_free_speech_exceptions https://en.wikipedia.org/wiki/United_States_free_speech_exce...