5 ms·

Hm. > Chrome's sandbox [...] prevents exploitation of this sandbox escape vulnerability. It reads to me as though Google disclosed an 0day to promote Google C

by eganist 10y ago

Hm. > Chrome's sandbox [...] prevents exploitation of this sandbox escape vulnerability. It reads to me as though Google disclosed an 0day to promote Google Chrome. This is fine. ••• Edit: http://venturebeat.com/2016/10/31/google-discloses-actively-exploited-windows-vulnerability-just-10-days-after-reporting-it-to-microsoft/ http://venturebeat.com/2016/10/31/google-discloses-actively-... > A source close to the company also shared that the exploit Google describes requires the Adobe Flash vulnerability. Since Flash has been patched, the Windows vulnerability is mitigated. If the immediate risk has been mitigated (barring other unknown attack vectors, this was the immediate one of which Google appears to have been aware), this makes the disclosure seem even more shamelessly promotional. I'd presume the Flash vuln would be to enable drive-by exploitation, so if that risk is mitigated, then they really seriously could've let this one wait.

magicalist 10y ago
> Chrome's sandbox [...] on Windows 10 [...] prevents exploitation of this sandbox escape vulnerability. the Windows version is an important part of that statement since it's unclear from this what versions of Windows are affected by the vulnerability.
- eganist 10y ago
  > since it's unclear from this what versions of Windows are affected by the vulnerability. If anything, this just makes it worse, since it tells me Windows 7 users are SOL.
  - magicalist 10y ago
    > If anything, this just makes it worse Makes what worse? There's no mention of other browsers (so how could this be an ad for Chrome? Is Edge vulnerable? Is Firefox?) and the plain implication is that Chrome on Windows 7 is indeed SOL.
    - deleted 10y ago
      [deleted]
    - eganist 10y ago
      > There's no mention of other browsers (so how could this be an ad for Chrome? Is Edge vulnerable? Is Firefox?) If this wasn't an ad and was merely a security disclosure, I'd have expected appropriate research into which configurations mitigate the risk, not just a single configuration which happens to favor the browser maker. Add on top of that the trivialization of "Windows 10" as the noun in a second-order preposition of place as well as the reference to Chrome as the primary subject of the sentence, and even basic analysis of the sentence in question shows a bias.
      - holtalanm 10y ago
        The disclosure came from Google. Of course there's a bias if they spent time coming up with a mitigation within their software. They aren't responsible for other browsers, so why would they research fixes within those browsers? That assumption is just plain idiotic. They are under NO responsibility to research each and every possible fix. Hell, they technically didn't even have to come up with a mitigation for Chrome.
        eganist 10y ago
        > They are under NO responsibility to research each and every possible fix. Hell, they technically didn't even have to come up with a mitigation for Chrome. Then they should've waited until an official fix was out. They know one's being actively worked on. They know the primary exploit path (via Flash) was patched. To my earlier point: they should've just waited. > That assumption is just plain idiotic. That's not necessary. You might not see my face, but I'm still a person deserving of some amount of respect.
        tptacek 10y ago
        Exactly what is the benefit of them waiting until an official fix is released if they have evidence of actual exploitation? How is anyone better off not knowing the details of a vulnerability that people are exploiting already? I'm having trouble making sense of your arguments on this thread, and I really am trying.
- 21 10y ago
  What they mean is that in Windows 10 a process can opt-in to some security features which mitigate this attack. Firefox/others will still be affected if they don't opt-in. Just in case anybody wonders, this mitigation is opt-in because what it does is it disables all win32k.sys calls (GDI, ...).
Ajedi32 10y ago
Disclosing in-the-wild vulnerabilities like this 7 days after their discovery has been Google's policy for more than 3 years now. https://security.googleblog.com/2013/05/disclosure-timeline-for-vulnerabilities.html https://security.googleblog.com/2013/05/disclosure-timeline-...
- eganist 10y ago
  http://www.theverge.com/2016/10/31/13481502/windows-vulnerability-sandbox-google-microsoft-disclosure http://www.theverge.com/2016/10/31/13481502/windows-vulnerab... > This is the first major invocation of the policy in the three years since it was put in place http://venturebeat.com/2016/10/31/google-discloses-actively-exploited-windows-vulnerability-just-10-days-after-reporting-it-to-microsoft/ http://venturebeat.com/2016/10/31/google-discloses-actively-... > This is not the first time that Google has disclosed Windows vulnerabilities before a patch was ready. In fact, the company did this for Windows 8.1 twice in January 2015. Microsoft understandably wasn’t pleased, but this time around is even more serious. Both of those earlier vulnerabilities weren’t being actively exploited. [emphasis added] ••• A longstanding policy doesn't make it a good one.
  - iancarroll 10y ago
    Both of those earlier incidents were after Microsoft passed the 90 day (3 months!) deadline.
    - eganist 10y ago
      That makes this one even worse, if anything. The disclosure in question wasn't even two weeks in.
      - foota 10y ago
        It means the other two examples aren't relevant.
      - anfedorov 10y ago
mtgx 10y ago
The part you conveniently omitted was the most important part in that sentence. Chrome on Windows 10 is protected. So if anything, it's an ad for Windows 10, not Chrome. Chrome is still vulnerable on Windows 7 and Windows 8/8.1 - which is what, 70-80% of the Windows users? And as others have said, it probably affects all the other browsers, too, so if Google was indeed the "good guy" in this story, it would still do this so the users of other browsers find out about the vulnerability, too.
- eganist 10y ago
  > The part you conveniently omitted was the most important part in that sentence. Speaking grammatically, that's the least important part of the sentence. Quoting my reply to the same point elsewhere, > Add on top of that the trivialization of "Windows 10" as the noun in a second-order preposition of place as well as the reference to Chrome as the primary subject of the sentence, and even basic analysis of the sentence in question shows a bias. A proper non-promotional security disclosure would've included multiple mitigating strategies, even if they're user actions such as browsing only trusted sites until a patch is released. Even if that sentence was worded differently ("Browsers which block win32k.sys system calls using the Win32k lockdown mitigation on Windows 10, such as Chrome, prevent exploitation of this sandbox escape vulnerability."), I would've given them a partial pass.
tptacek 10y ago
Respectfully, but: I don't think Neel Mehta gives a fuck whether you use Chrome or not. He's Neel Mehta. He probably doesn't even care if people use Google to Google things. How to sum Mehta up? Even before he discovered Heartbleed, he was one of the most renowned vuln researchers in the industry. A mental model of Mehta that has served me pretty well: if he says something publicly like this, it's probably because it's important and correct. The idea that he'd be wasting his time on marketing stunts for the Chrome browser is a bit naive.
- eganist 10y ago
  You certainly know him better than most people on here, so I can appreciate your position and believe you when you say it. If that's the case, though, then he could benefit from reading this HN submission in writing future disclosures.
  - CiPHPerCoder 10y ago
    > If that's the case, though, then he could benefit from reading this HN submission in writing future disclosures. Benefit how exactly? By becoming another mindless conformist whitehat who never exercises full disclosure when a vendor isn't taking security seriously (but oh man will they ever pay lip-service to the idea of taking security seriously)? That's what a lot of the comments in this thread would have him do, anyway. I think the best benefit he could get from reading the comments here is the realization that so much of the tech industry knee-jerk-defends software vendors without realizing the importance of diverse vulnerability disclosure practices. Then when someone gets particularly nasty with him, he can shrug it off as just a particularly-vocal entitled developer who has probably never found a security vulnerability before, and proceed with following the established P0 policies. But he probably already knows/realizes this. But ultimately, I think the comments here would be a waste of time that could better be spent on things that matter far more than the egos of most HN commenters. Myself especially.
    - eganist 10y ago
      If the team wants to continue with the practice of full disclosure, that's on them. My gripe was with the promotional impression I got from the Chrome plug. Therefore: > Benefit how exactly? Benefit by observing more nuanced language practices in the future. If tptacek's point stands (and I have no reason to doubt him), then Neel benefits by receiving less controversy for a highly controversial practice simply through tweaking the write-up. It has nothing to do with "egos of most HN commenters." I'd like to think most commenters on HN have practical roles at their organizations and likewise have to deal with the fallout from disclosures like this much the way I now have to.

by eganist 10y ago

magicalist 10y ago

> Chrome's sandbox [...] on Windows 10 [...] prevents exploitation of this sandbox escape vulnerability. the Windows version is an important part of that statement since it's unclear from this what versions of Windows are affected by the vulnerability.

eganist 10y ago
> since it's unclear from this what versions of Windows are affected by the vulnerability. If anything, this just makes it worse, since it tells me Windows 7 users are SOL.
- magicalist 10y ago
  > If anything, this just makes it worse Makes what worse? There's no mention of other browsers (so how could this be an ad for Chrome? Is Edge vulnerable? Is Firefox?) and the plain implication is that Chrome on Windows 7 is indeed SOL.
  - deleted 10y ago
    [deleted]
  - eganist 10y ago
    > There's no mention of other browsers (so how could this be an ad for Chrome? Is Edge vulnerable? Is Firefox?) If this wasn't an ad and was merely a security disclosure, I'd have expected appropriate research into which configurations mitigate the risk, not just a single configuration which happens to favor the browser maker. Add on top of that the trivialization of "Windows 10" as the noun in a second-order preposition of place as well as the reference to Chrome as the primary subject of the sentence, and even basic analysis of the sentence in question shows a bias.
    - holtalanm 10y ago
      The disclosure came from Google. Of course there's a bias if they spent time coming up with a mitigation within their software. They aren't responsible for other browsers, so why would they research fixes within those browsers? That assumption is just plain idiotic. They are under NO responsibility to research each and every possible fix. Hell, they technically didn't even have to come up with a mitigation for Chrome.
      - eganist 10y ago
        > They are under NO responsibility to research each and every possible fix. Hell, they technically didn't even have to come up with a mitigation for Chrome. Then they should've waited until an official fix was out. They know one's being actively worked on. They know the primary exploit path (via Flash) was patched. To my earlier point: they should've just waited. > That assumption is just plain idiotic. That's not necessary. You might not see my face, but I'm still a person deserving of some amount of respect.
        tptacek 10y ago
        Exactly what is the benefit of them waiting until an official fix is released if they have evidence of actual exploitation? How is anyone better off not knowing the details of a vulnerability that people are exploiting already? I'm having trouble making sense of your arguments on this thread, and I really am trying.
21 10y ago
What they mean is that in Windows 10 a process can opt-in to some security features which mitigate this attack. Firefox/others will still be affected if they don't opt-in. Just in case anybody wonders, this mitigation is opt-in because what it does is it disables all win32k.sys calls (GDI, ...).

Ajedi32 10y ago

Disclosing in-the-wild vulnerabilities like this 7 days after their discovery has been Google's policy for more than 3 years now. https://security.googleblog.com/2013/05/disclosure-timeline-for-vulnerabilities.html https://security.googleblog.com/2013/05/disclosure-timeline-...

eganist 10y ago
http://www.theverge.com/2016/10/31/13481502/windows-vulnerability-sandbox-google-microsoft-disclosure http://www.theverge.com/2016/10/31/13481502/windows-vulnerab... > This is the first major invocation of the policy in the three years since it was put in place http://venturebeat.com/2016/10/31/google-discloses-actively-exploited-windows-vulnerability-just-10-days-after-reporting-it-to-microsoft/ http://venturebeat.com/2016/10/31/google-discloses-actively-... > This is not the first time that Google has disclosed Windows vulnerabilities before a patch was ready. In fact, the company did this for Windows 8.1 twice in January 2015. Microsoft understandably wasn’t pleased, but this time around is even more serious. Both of those earlier vulnerabilities weren’t being actively exploited. [emphasis added] ••• A longstanding policy doesn't make it a good one.
- iancarroll 10y ago
  Both of those earlier incidents were after Microsoft passed the 90 day (3 months!) deadline.
  - eganist 10y ago
    That makes this one even worse, if anything. The disclosure in question wasn't even two weeks in.
    - foota 10y ago
      It means the other two examples aren't relevant.
    - anfedorov 10y ago

mtgx 10y ago

The part you conveniently omitted was the most important part in that sentence. Chrome on Windows 10 is protected. So if anything, it's an ad for Windows 10, not Chrome. Chrome is still vulnerable on Windows 7 and Windows 8/8.1 - which is what, 70-80% of the Windows users? And as others have said, it probably affects all the other browsers, too, so if Google was indeed the "good guy" in this story, it would still do this so the users of other browsers find out about the vulnerability, too.

eganist 10y ago
> The part you conveniently omitted was the most important part in that sentence. Speaking grammatically, that's the least important part of the sentence. Quoting my reply to the same point elsewhere, > Add on top of that the trivialization of "Windows 10" as the noun in a second-order preposition of place as well as the reference to Chrome as the primary subject of the sentence, and even basic analysis of the sentence in question shows a bias. A proper non-promotional security disclosure would've included multiple mitigating strategies, even if they're user actions such as browsing only trusted sites until a patch is released. Even if that sentence was worded differently ("Browsers which block win32k.sys system calls using the Win32k lockdown mitigation on Windows 10, such as Chrome, prevent exploitation of this sandbox escape vulnerability."), I would've given them a partial pass.

tptacek 10y ago

Respectfully, but: I don't think Neel Mehta gives a fuck whether you use Chrome or not. He's Neel Mehta. He probably doesn't even care if people use Google to Google things. How to sum Mehta up? Even before he discovered Heartbleed, he was one of the most renowned vuln researchers in the industry. A mental model of Mehta that has served me pretty well: if he says something publicly like this, it's probably because it's important and correct. The idea that he'd be wasting his time on marketing stunts for the Chrome browser is a bit naive.

eganist 10y ago
You certainly know him better than most people on here, so I can appreciate your position and believe you when you say it. If that's the case, though, then he could benefit from reading this HN submission in writing future disclosures.
- CiPHPerCoder 10y ago
  > If that's the case, though, then he could benefit from reading this HN submission in writing future disclosures. Benefit how exactly? By becoming another mindless conformist whitehat who never exercises full disclosure when a vendor isn't taking security seriously (but oh man will they ever pay lip-service to the idea of taking security seriously)? That's what a lot of the comments in this thread would have him do, anyway. I think the best benefit he could get from reading the comments here is the realization that so much of the tech industry knee-jerk-defends software vendors without realizing the importance of diverse vulnerability disclosure practices. Then when someone gets particularly nasty with him, he can shrug it off as just a particularly-vocal entitled developer who has probably never found a security vulnerability before, and proceed with following the established P0 policies. But he probably already knows/realizes this. But ultimately, I think the comments here would be a waste of time that could better be spent on things that matter far more than the egos of most HN commenters. Myself especially.
  - eganist 10y ago
    If the team wants to continue with the practice of full disclosure, that's on them. My gripe was with the promotional impression I got from the Chrome plug. Therefore: > Benefit how exactly? Benefit by observing more nuanced language practices in the future. If tptacek's point stands (and I have no reason to doubt him), then Neel benefits by receiving less controversy for a highly controversial practice simply through tweaking the write-up. It has nothing to do with "egos of most HN commenters." I'd like to think most commenters on HN have practical roles at their organizations and likewise have to deal with the fallout from disclosures like this much the way I now have to.