2 ms·

That might be the case! That's why my statement was "don't come across as hyping" rather than "don't disclose a solution." Elsewhere, I also stated a preferenc

by eganist 10y ago

That might be the case! That's why my statement was "don't come across as hyping" rather than "don't disclose a solution." Elsewhere, I also stated a preference for conveying multiple solutions, "even if they're [only] user actions such as browsing only trusted sites until a patch is released." This would've been great to disclose for the many corporate users on Windows 7 since the specific mitigating feature implemented by Chrome (and Edge, if Microsoft's implication is to be trusted) in Windows 10 isn't available to these users.

tptacek 10y ago
Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. You're suggesting that Google give terrible security advice simply to dull the discomfort you think they should feel about the fact that their browser's security model defeats this particular vulnerability. I feel like either I'm missing something, or you can't really be thinking this through carefully.
- eganist 10y ago
  > Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. An experienced attacker, sure. Targeted campaigns, sure. I'd argue this doesn't apply all that readily to attackers who might just buy an exploit kit for quick mass-mailed wins, though. It's not terrible advice at all (though perhaps "only sites you know" might be better). It's only marginally effective, but for most users it's absolutely better than nothing at all. When the only advice an 0day disclosure gives is to use the disclosing company's product, it compels people to question the motive for the disclosure especially when, as discussed elsewhere in the thread, literally nothing is achieved by the public disclosure itself. There are multiple solutions here. They might not all be nearly as effective as "Use Chrome" (paraphrasing), but they're all more effective than merely informing users that there's an 0day for a superset of users and then giving only a subset of those users a mitigation path. I'm rather surprised we're not in agreement here, actually.
  - tptacek 10y ago
    I'm feel like I didn't explain myself carefully enough, so just one more time, just to clarify, I'm going to re-state: The attackers this disclosure contemplates have both browser RCE and a zero-day Windows kernel privilege escalation vulnerability. There is no site you can direct them to that an attacker can't briefly replace with a malware installation vector. The advice you're suggesting Google provide simply doesn't apply.
    - eganist 10y ago
      > The attackers this disclosure contemplates have both browser RCE and a zero-day Windows kernel privilege escalation vulnerability. There is no site you can direct them to that an attacker can't briefly replace with a malware installation vector. The advice you're suggesting Google provide simply doesn't apply. Elsewhere in the thread (and far prior to our discussion here), I linked to http://venturebeat.com/2016/10/31/google-discloses-actively-exploited-windows-vulnerability-just-10-days-after-reporting-it-to-microsoft/ http://venturebeat.com/2016/10/31/google-discloses-actively-... > A source close to the company also shared that the exploit Google describes requires the Adobe Flash vulnerability. Since Flash has been patched, the Windows vulnerability is mitigated. That said, Microsoft still needs to plug the security hole as it could be leveraged in other types of attacks. So, it would appear there's no RCE and that there's just an 0day priv-esc.
      - tptacek 10y ago
        Yes, as I've been saying, it can be leveraged by any browser RCE.
        eganist 10y ago
        If you're talking about the set of unknown size we're calling undisclosed RCEs, then we have two potential decisions which hinge on attack economics whereby an attacker leverages an unknown RCE in tandem with this priv-esc in: • targeted attacks (much more likely) • mass campaigns (I'd argue much less likely) Since Google's disclosure is to everyone, advice which applies to everyone will also cover the set of people who: • aren't targets of attackers with an unknown RCE, and • are likely to download attachments w/ the priv-esc alone. I don't have the stats, but telling everyone to be careful also tells this likely-majority subset of people to be careful, optimistically mitigating the substantially higher risk that they'll be owned by the priv-esc alone. The remaining at-risk set is the population of people for whom attackers may decide that burning an unpublished RCE is a valuable trade. ••• If you're also talking about known and patched RCEs, then users who are missing those updates have bigger problems. ••• To quote one of my employees who's got an eye on this thread: "At this point, the argument between the two of you is entirely pedantic in nature." heh

by eganist 10y ago

tptacek 10y ago

Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. You're suggesting that Google give terrible security advice simply to dull the discomfort you think they should feel about the fact that their browser's security model defeats this particular vulnerability. I feel like either I'm missing something, or you can't really be thinking this through carefully.

eganist 10y ago
> Huh? You can't tell people to "only visit trusted sites". An attacker who is combining browser RCE with OS privilege escalation zero day will have no problem whatsoever coercing victims into visiting whatever site they choose. An experienced attacker, sure. Targeted campaigns, sure. I'd argue this doesn't apply all that readily to attackers who might just buy an exploit kit for quick mass-mailed wins, though. It's not terrible advice at all (though perhaps "only sites you know" might be better). It's only marginally effective, but for most users it's absolutely better than nothing at all. When the only advice an 0day disclosure gives is to use the disclosing company's product, it compels people to question the motive for the disclosure especially when, as discussed elsewhere in the thread, literally nothing is achieved by the public disclosure itself. There are multiple solutions here. They might not all be nearly as effective as "Use Chrome" (paraphrasing), but they're all more effective than merely informing users that there's an 0day for a superset of users and then giving only a subset of those users a mitigation path. I'm rather surprised we're not in agreement here, actually.
- tptacek 10y ago
  I'm feel like I didn't explain myself carefully enough, so just one more time, just to clarify, I'm going to re-state: The attackers this disclosure contemplates have both browser RCE and a zero-day Windows kernel privilege escalation vulnerability. There is no site you can direct them to that an attacker can't briefly replace with a malware installation vector. The advice you're suggesting Google provide simply doesn't apply.
  - eganist 10y ago
    > The attackers this disclosure contemplates have both browser RCE and a zero-day Windows kernel privilege escalation vulnerability. There is no site you can direct them to that an attacker can't briefly replace with a malware installation vector. The advice you're suggesting Google provide simply doesn't apply. Elsewhere in the thread (and far prior to our discussion here), I linked to http://venturebeat.com/2016/10/31/google-discloses-actively-exploited-windows-vulnerability-just-10-days-after-reporting-it-to-microsoft/ http://venturebeat.com/2016/10/31/google-discloses-actively-... > A source close to the company also shared that the exploit Google describes requires the Adobe Flash vulnerability. Since Flash has been patched, the Windows vulnerability is mitigated. That said, Microsoft still needs to plug the security hole as it could be leveraged in other types of attacks. So, it would appear there's no RCE and that there's just an 0day priv-esc.
    - tptacek 10y ago
      Yes, as I've been saying, it can be leveraged by any browser RCE.
      - eganist 10y ago
        If you're talking about the set of unknown size we're calling undisclosed RCEs, then we have two potential decisions which hinge on attack economics whereby an attacker leverages an unknown RCE in tandem with this priv-esc in: • targeted attacks (much more likely) • mass campaigns (I'd argue much less likely) Since Google's disclosure is to everyone, advice which applies to everyone will also cover the set of people who: • aren't targets of attackers with an unknown RCE, and • are likely to download attachments w/ the priv-esc alone. I don't have the stats, but telling everyone to be careful also tells this likely-majority subset of people to be careful, optimistically mitigating the substantially higher risk that they'll be owned by the priv-esc alone. The remaining at-risk set is the population of people for whom attackers may decide that burning an unpublished RCE is a valuable trade. ••• If you're also talking about known and patched RCEs, then users who are missing those updates have bigger problems. ••• To quote one of my employees who's got an eye on this thread: "At this point, the argument between the two of you is entirely pedantic in nature." heh