14 ms·
Virtual machine escape fetches $100k at Pwn2Own hacking contest
- mistersys 10y agoTitle misleading: virtual machine escape from a web browser, all the way down to host machine.
- sliken 10y agoDunno, seems pretty good. I'm much more impressed by escaping the virtual machine than a microsoft browser.
- astrodust 10y agoMakes for a better movie title. I mean who'd pay to see Escape from Microsoft Edge?
- empath75 10y agoMisleading in a way that makes it seem less impressive than it actually was.
- andrewflnr 10y agoReally, they escaped from two virtual machines, the JavaScript VM and the VMWare VM. Maybe give them half a VM-point for breaking the confines of the Windows process (if you take your OS textbook seriously, a process is an abstraction of a computer, so sort of a VM).
- CalChris 10y agoIdeally that process is a jail. If Edge is anything like Chrome, it has dropped privileges for that process and that process is just a renderer. https://seclab.stanford.edu/websec/chromium/chromium-security-architecture.pdf https://seclab.stanford.edu/websec/chromium/chromium-securit... Read this as I'm very impressed by the exploit.
- Godel_unicode 10y agoOne of those "VMs" gets escaped from all the time. The other is made by VMware.
- bonzini 10y agoOne of them has plenty of help from the hardware and has a pretty limited feature set.
- hcs 10y agoAs someone said in a comment: "Breaking out of the Alcatraz, and then breaking into Fort Knox right afterwards!"
- pizza 10y agoHow does someone learn this skill? I get that it obviously takes a ton of work, but how do you even prepare/study for (whatever it takes work to do) in the first place? The intuition required seems so different from what my intuition of computer systems would allow even imagining.
- CalChris 10y agoA good security class will give you the principles. Look at CS 161 at Berkeley: http://www-inst.cs.berkeley.edu/~cs161/sp16/ http://www-inst.cs.berkeley.edu/~cs161/sp16/ Any bug is a potential exploit. That exploit may not get you very far but it can be chained with another which will get you further. The principles are almost elegant. The details are mind numbing. Luckily, common exploits get collected into metasploit: https://www.metasploit.com/ https://www.metasploit.com/ Script kiddies (Annoyingly Persistent Teenagers to quote Nick Weaver) generally use toolkits like metasploit.
- 9erdelta 10y agoI too would like to know. One recommendation I saw in regards to learning to hack stuff like the Nintendo Switch is, first learn to write a kernel, and also learn about compilers. Also, personally I've been considering working through Bunnie Huang's "Hacking the Xbox".
- toomuchtodo 10y ago> Also, personally I've been considering working through Bunnie Huang's "Hacking the Xbox". Do so. It was the first Bunnie book I purchased, and now I'm a lifelong fan owning all of his work. If you haven't read his most recent book, "The Hardware Hacker", it's a must read.
- pizza 10y agoJust finished reading "Hacking the Xbox," per your suggestion - agree that it's quite good at explaining the process. The actual presentation does a good job of condensing what I imagine was an arduous adventure. Thanks for the recommendation.
- lokedhs 10y agoBeing someone who uses Qubes OS, seeing cracks that allows a virtualised system to break out to the is scary. After all, the entire security model of Qubes OSis based on the fact that it's not possible to break out from the VM's. I'm really glad these guys valued their reputation higher than the extra money they could have gotten from selling these exploits on the blank market, but this makes me wonder how many such vulnerabilities are available that hasn't been published.
- besselheim 10y agoIndeed, all commonly-used hypervisors have had host escape vulnerabilities reported over the years, including Xen as used in Qubes - see e.g. http://blog.quarkslab.com/xen-exploitation-part-3-xsa-182-qubes-escape.html http://blog.quarkslab.com/xen-exploitation-part-3-xsa-182-qu... Of relevance to Edge exploitation, Microsoft are currently working on a Qubes-like sandboxing model for Edge, based on Hyper-V (though it looks like it'll be aimed towards enterprise customers rather than consumer): https://blogs.windows.com/msedgedev/2016/09/27/application-guard-microsoft-edge/#YyTRfeRwP6ihvEsb.97 https://blogs.windows.com/msedgedev/2016/09/27/application-g.... Will be interesting to see if that's part of the challenge in Pwn2Own 2018. Somewhat surprisingly, Hyper-V wasn't successfully exploited at this year's contest.
- mobiplayer 10y agoWhy are you surprised Hyper-V hasn't been exploited? Did it happen in the past? And this is VMware Workstation, not ESXi; which many people on this thread seem to be confusing.
- mzkfkkfickv 10y agoActually, the bug was in the wmware tools, which may be available on your vm's handled by esxi.
- mobiplayer 10y agoThat's not how it works I'm afraid. Otherwise if I installed those VMware tools on my physical computer and exploited them... to where do I escape? Alternate reality? :-)
- simplehuman 10y agoThis is why we need rust. Has Windows and edge and VMware used rust, these bugs wouldn't have happened. Rust is a game changer with it's borrow checker.
- scott_karana 10y agoI love Rust too, but while it likely would have prevented these three bugs, there are many other classes of bugs caused by poorly designed interfaces/abstractions/protocols, misunderstandings, "valid but wrong" logic mistakes, unanticipated interactions, etc. Let's not make magic bullet statements about technology. It's a good way to scare people away...
- newsat13 10y ago> while it likely would have prevented these three bugs Isn't that the point of the parent's comment?
- simion314 10y agoI think the point is that Rust fanboy will repeat same thing for years "all security bugs would have been avoided if Rust was used" and when first security issue will be found in Servo or other Rust component(maybe the kernel some Rust devs work on) then Rust reputation will suffer, I see tons of article and blog posts m most of them made to slap the annoyng fanboys that repeated same thing. Btw if they would have used C# then those 3 bugs would not have happen, the thing is that for some work cases you have to do unsafe stuff so C# as Rust has a way to run unsafe code so bug would have happened especially in some low-level code like for a JIT.
- eridius 10y agoOP is correct in saying Rust would have prevented these specific bugs, so I don't understand why you're trying to dismiss them as a "fanboy".
- 10y ago
- mnarayan01 10y agoSo if you were using a use-once-and-destroy VM to do some Edge security testing, they could blow threw everything and get you anyway. The fact that there are vulnerabilities in each of three layers they needed to hit is unsurprising, but having one guy find all three is more incredible to me than Barcelona's recent come back against PSG.
- sundvor 10y agoYes, this has to be one of the most impressive - and scary - things I've read in a while. Fantastic work by the team, and thank goodness there's security competitions like these to work as a rewarding outlet for their extreme talents.
- alanbernstein 10y agoThat comment makes me wonder: would funding more of these with public money be explicitly worth the savings in avoiding attacks?
- vog 10y agoI'd rather see this money used for increasing software security through all layers. [1][2] See, all these vulnerabilities started as major or minor bugs. And these originate from somewhere. While 100% bugfree software may be too hard to be worth the effort in most applications, there is a huge difference between the ideal state "the first exploit hits you hard, and after two or three more severe bugs in your software, you are out of business." Instead, we have "you can 'loose' huge amounts of data every few months and are still in business." And no regulator, no expert in a law suite, actually nobody, wants to have a look at your source code anyway. Even if you don't hide it through SaaS or other means, almost nobody asks for the source. [3] Instead, public money is used to declare "cyberwar" and to buy zerodays - which creates an incentive for people to keep their findings private, instead of reporting early on. And more imporantly, these create an incentive to put in such bugs in the first place. [4] [1] See also https://news.ycombinator.com/item?id=13772293 https://news.ycombinator.com/item?id=13772293 [2] audits, bug bounties (every bug, not just obviously-security-related bugs), better static analysis tooling and improving type systems and programming languages as a whole, donate to projects like OpenBSD and Mozilla / Rust, etc. [3] ... unless it is about copyright. But I've never seen such a request in a software-security related incident. [4] An attacker doesn't even need to establish a full-blown backdoor. They can just contribute some code with a missing or slightly-wrong check, and see how to exploit it later on, after enough time has passed.
- tapirl 10y ago> We used a JavaScript engine bug within Microsoft Edge to achieve the code execution inside the Edge sandbox, and we used a Windows 10 kernel bug to escape from it and fully compromise the guest machine," ... What? The security of VMware relies on the security of the guest OS? Really a surprise, and a horrible, for me. btw, how many people are using Edge browser? 1%? And how many of them use it in VM? 1%%%? :-)
- Tepix 10y agoNo, it does not. Here is the next sentence from the article: "Then we exploited a hardware simulation bug within VMware to escape from the guest operating system to the host one. All started from and only by a controlled a website."
- tapirl 10y agoThanks for clarification. So the key of the hacking is a hardware simulation bug within VMware. It is not a surprise to exploit the security holes in Edge at all.
- alanbernstein 10y agoI think the key is having all three at once?
- samat 10y agoThe last vm escape is very impressive at its own.
- platinumrad 10y agoEdge isn't nearly the security nightmare that Internet Explorer was and runs sandboxed in a similar manner as Chrome so you shouldn't underestimate the impressiveness of that first escape either.
- greggman 10y ago
- jtchang 10y agoA set of exploits like the 3 described could be worth quite a bit on the open market. I'm surprised how low the bounty was for a full vmware escape starting from a browser. Surely there are other exploits like this out in the wild under government lock and key.
- hrrsn 10y agoThat's what I was thinking. $100k for this sounds low.
- Royalaid 10y agoWhile crafting the exploit may seem like the hard part I can imagine trying to market it and get paid can be very difficult too.
- roel_v 10y agoSay you have such an exploit. How do you propose making money from it? Exactly what steps would you take?
- sillysaurus3 10y agoThere are various security broker companies that governments work with. An unscrupulous pentester could find one, email them, and ask them if they're interested. The trouble would be how to prove the exploit works without also revealing how it's done. The best bet would be to demo one or two out of the three exploits required to work, then talk business in exchange for the third.
- jacquesm 10y agoBusiness transactions between parties that don't trust each other is a solved problem: escrow.
- alexkon 10y agoDoes escrow really work with secrets like this? The buyer receives the exploit and claims it doesn’t work. The seller claims it does. The money is still in escrow. How do you proceed? The escrow agent is getting a commission, they should not have access to the full secret. It’s really hard to find an escrow agent who has the skills to assess an exploit and whom both the buyer and the seller would trust not to leak it or use it for their own benefit.
- hl5 10y agoI don't think I'd want to take credit for a hack like this. I imagine a few interesting phone calls are heading the researchers way.
- raesene9 10y agoThey're a team from Qihoo360 a large Chinese security company. They do a tonne of this kind of research, so I'd imagine the company are used to it by now. If you look at pwn2own or similar for the last couple of years you'll see a variety of their teams cropping up...
- tannhaeuser 10y agoImpressive. Is there consensus on security bad/best practices when it comes to VMs and containers? I mean if even established VMs/Hypervisors can't save you, what prospect is there of containers to actually contain anything? Maybe POSIX chroot jails aren't that bad after all? Because, like, they're the simplest thing that can possibly work, and don't come with the complexity of VMs and Linux containers/namespaces; and if they turn out to be vulnerable you'd be able to switch to another kernel (BSDs)?
- temac 10y agoYou have bugs in every (mainstream) kernels. With them, you can elevate your privileges to kernel level, and once you've done that it's game over. There is no reason to believe an additional layer (a VM) will always protect you (at least given how they are also written in unsafe languages for now). However there is no reason to believe it will in average makes things worse, and every reasons to believe it will in average increase your security.
- staticassertion 10y agoBasically the VM is sandwiched between the host and parent OS. With a full VM you have a separate kernel. With containers, like Docker, you share a kernel. The VM is then considered more secure because it adds that extra layer between them... but is it? It's just more code - more code, more problems. The more effective solution is to simply harden the kernel of the host system, and then use a lighter solution like docker. Grsecurity + Docker seems like a solid fit to me, and you can mash another layer like Apparmor on top. It is very rare that I see a kernel vulnerability that would not be entirely mitigated by Grsecurity, or otherwise made far more costly. The point is to stop adding layers on top and instead to focus on security that lower, trusted base.
- rsync 10y ago"Is there consensus on security bad/best practices when it comes to VMs and containers?" Yes - it's called simplicity. Fewest moving parts possible. Limit attack surface to the smallest amount possible. You can pursue this at every layer of the stack and at every layer of abstraction - it should be a primary design philosophy that informs every system you build.
- lima 10y ago> You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes. ~Theo de Raadt http://marc.info/?l=openbsd-misc&m=119318909016582 http://marc.info/?l=openbsd-misc&m=119318909016582
- jankedeen 10y agoPerfect storm.
- kbart 10y ago"All started from and only by a controlled a website" That is really scary. And another reason to limit/disable JavaScript (if somebody still don't find enough). Has anyone found more detailed report? I'd love to see this in action.