4 ms·

Sure. How's "Don't come across as hyping your own product when you disclose an 0day"? Even if the wording was "Browsers such as Chrome which block win32k.sys s

by eganist 10y ago

Sure. How's "Don't come across as hyping your own product when you disclose an 0day"? Even if the wording was "Browsers such as Chrome which block win32k.sys system calls using the Win32k lockdown mitigation on Windows 10 prevent exploitation of this sandbox escape vulnerability," I would've given a partial pass because it looks less overtly self-promotional.

tptacek 10y ago
I find this baffling. They're disclosing a vulnerability that has no patch, and they're clarifying that their own browser has a workaround. That's not self-promotion. In fact: not clarifying that would have been irresponsible. 3 minutes later, after a second read: I understand that you're uncomfortable with the idea that for some users, switching to Chrome is the most reasonable workaround for a very serious vulnerability. But it is a factual statement.
- eganist 10y ago
  That might be the case! That's why my statement was "don't come across as hyping" rather than "don't disclose a solution." Elsewhere, I also stated a preference for conveying multiple solutions, "even if they're [only] user actions such as browsing only trusted sites until a patch is released." This would've been great to disclose for the many corporate users on Windows 7 since the specific mitigating feature implemented by Chrome (and Edge, if Microsoft's implication is to be trusted) in Windows 10 isn't available to these users.
  - tptacek 10y ago
    Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. You're suggesting that Google give terrible security advice simply to dull the discomfort you think they should feel about the fact that their browser's security model defeats this particular vulnerability. I feel like either I'm missing something, or you can't really be thinking this through carefully.
    - eganist 10y ago
      > Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. An experienced attacker, sure. Targeted campaigns, sure. I'd argue this doesn't apply all that readily to attackers who might just buy an exploit kit for quick mass-mailed wins, though. It's not terrible advice at all (though perhaps "only sites you know" might be better). It's only marginally effective, but for most users it's absolutely better than nothing at all. When the only advice an 0day disclosure gives is to use the disclosing company's product, it compels people to question the motive for the disclosure especially when, as discussed elsewhere in the thread, literally nothing is achieved by the public disclosure itself. There are multiple solutions here. They might not all be nearly as effective as "Use Chrome" (paraphrasing), but they're all more effective than merely informing users that there's an 0day for a superset of users and then giving only a subset of those users a mitigation path. I'm rather surprised we're not in agreement here, actually.
      - tptacek 10y ago
        I'm feel like I didn't explain myself carefully enough, so just one more time, just to clarify, I'm going to re-state: The attackers this disclosure contemplates have both browser RCE and a zero-day Windows kernel privilege escalation vulnerability. There is no site you can direct them to that an attacker can't briefly replace with a malware installation vector. The advice you're suggesting Google provide simply doesn't apply.
        eganist 10y ago
        > The attackers this disclosure contemplates have both browser RCE and a zero-day Windows kernel privilege escalation vulnerability. There is no site you can direct them to that an attacker can't briefly replace with a malware installation vector. The advice you're suggesting Google provide simply doesn't apply. Elsewhere in the thread (and far prior to our discussion here), I linked to http://venturebeat.com/2016/10/31/google-discloses-actively-exploited-windows-vulnerability-just-10-days-after-reporting-it-to-microsoft/ http://venturebeat.com/2016/10/31/google-discloses-actively-... > A source close to the company also shared that the exploit Google describes requires the Adobe Flash vulnerability. Since Flash has been patched, the Windows vulnerability is mitigated. That said, Microsoft still needs to plug the security hole as it could be leveraged in other types of attacks. So, it would appear there's no RCE and that there's just an 0day priv-esc.

by eganist 10y ago

tptacek 10y ago

I find this baffling. They're disclosing a vulnerability that has no patch, and they're clarifying that their own browser has a workaround. That's not self-promotion. In fact: not clarifying that would have been irresponsible. 3 minutes later, after a second read: I understand that you're uncomfortable with the idea that for some users, switching to Chrome is the most reasonable workaround for a very serious vulnerability. But it is a factual statement.

eganist 10y ago
That might be the case! That's why my statement was "don't come across as hyping" rather than "don't disclose a solution." Elsewhere, I also stated a preference for conveying multiple solutions, "even if they're [only] user actions such as browsing only trusted sites until a patch is released." This would've been great to disclose for the many corporate users on Windows 7 since the specific mitigating feature implemented by Chrome (and Edge, if Microsoft's implication is to be trusted) in Windows 10 isn't available to these users.
- tptacek 10y ago
  Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. You're suggesting that Google give terrible security advice simply to dull the discomfort you think they should feel about the fact that their browser's security model defeats this particular vulnerability. I feel like either I'm missing something, or you can't really be thinking this through carefully.
  - eganist 10y ago
    > Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. An experienced attacker, sure. Targeted campaigns, sure. I'd argue this doesn't apply all that readily to attackers who might just buy an exploit kit for quick mass-mailed wins, though. It's not terrible advice at all (though perhaps "only sites you know" might be better). It's only marginally effective, but for most users it's absolutely better than nothing at all. When the only advice an 0day disclosure gives is to use the disclosing company's product, it compels people to question the motive for the disclosure especially when, as discussed elsewhere in the thread, literally nothing is achieved by the public disclosure itself. There are multiple solutions here. They might not all be nearly as effective as "Use Chrome" (paraphrasing), but they're all more effective than merely informing users that there's an 0day for a superset of users and then giving only a subset of those users a mitigation path. I'm rather surprised we're not in agreement here, actually.
    - tptacek 10y ago
      I'm feel like I didn't explain myself carefully enough, so just one more time, just to clarify, I'm going to re-state: The attackers this disclosure contemplates have both browser RCE and a zero-day Windows kernel privilege escalation vulnerability. There is no site you can direct them to that an attacker can't briefly replace with a malware installation vector. The advice you're suggesting Google provide simply doesn't apply.
      - eganist 10y ago
        > The attackers this disclosure contemplates have both browser RCE and a zero-day Windows kernel privilege escalation vulnerability. There is no site you can direct them to that an attacker can't briefly replace with a malware installation vector. The advice you're suggesting Google provide simply doesn't apply. Elsewhere in the thread (and far prior to our discussion here), I linked to http://venturebeat.com/2016/10/31/google-discloses-actively-exploited-windows-vulnerability-just-10-days-after-reporting-it-to-microsoft/ http://venturebeat.com/2016/10/31/google-discloses-actively-... > A source close to the company also shared that the exploit Google describes requires the Adobe Flash vulnerability. Since Flash has been patched, the Windows vulnerability is mitigated. That said, Microsoft still needs to plug the security hole as it could be leveraged in other types of attacks. So, it would appear there's no RCE and that there's just an 0day priv-esc.