5 ms·
> We used a JavaScript engine bug within Microsoft Edge to achieve the code execution inside the Edge sandbox, and we used a Windows 10 kernel bug to escape fro
by tapirl 10y ago
> We used a JavaScript engine bug within Microsoft Edge to achieve the code execution inside the Edge sandbox, and we used a Windows 10 kernel bug to escape from it and fully compromise the guest machine," ...
What? The security of VMware relies on the security of the guest OS? Really a surprise, and a horrible, for me.
btw, how many people are using Edge browser? 1%? And how many of them use it in VM? 1%%%? :-)
- Tepix 10y agoNo, it does not. Here is the next sentence from the article: "Then we exploited a hardware simulation bug within VMware to escape from the guest operating system to the host one. All started from and only by a controlled a website."
- tapirl 10y agoThanks for clarification. So the key of the hacking is a hardware simulation bug within VMware. It is not a surprise to exploit the security holes in Edge at all.
- alanbernstein 10y agoI think the key is having all three at once?
- samat 10y agoThe last vm escape is very impressive at its own.
- platinumrad 10y agoEdge isn't nearly the security nightmare that Internet Explorer was and runs sandboxed in a similar manner as Chrome so you shouldn't underestimate the impressiveness of that first escape either.
- greggman 10y agonot even close. Just look at the CVE listings for 2016 Chrome vs Edge. Edge: 74 code execution vulnerabilities, Chrome: 2
- oceanswave 10y agoGiven that Chrome runs on many platforms, and Edge one, it makes this even more sobering
- staticassertion 10y agoCVE listings are not a meaningful metric at all for security. What that could reflect is that Edge's bounty program is far more popular than Chrome's. It could mean that Edge is willing to hand out CVEs for uncomfirmed bugs whereas Chrome requires further proof (I am not saying this is the case at all, to be clear).
- tapirl 10y agoAre there any reasons Edge won't go open source? Avoid too many bugs been found?
- staticassertion 10y agoYou think that Edge is closed source to avoid more bugs being found, but Microsoft also pays 3rd party developers for finding bugs in Edge?
- tapirl 10y agoYou didn't answer my question at all. Are there any special reasons Edge has not been open sourced yet?
- staticassertion 10y agoI didn't really understand what your question was, it sounded as if you were trying to imply the reason yourself. I do not work for Microsoft, I have no insight into their decision making process. I doubt it has to do with security.
- rspeer 10y agoThis may not fit your preconceptions, but the article is saying that Edge is considered a difficult target for hacking.
- oceanswave 10y agoWhich is a strange preconception for the article to have given https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/year-2016/opec-1/Google-Chrome.html https://www.cvedetails.com/vulnerability-list/vendor_id-1224... vs https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-32367/year-2016/opec-1/Microsoft-Edge.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...
- staticassertion 10y agoAs I said above, CVE listings are a useless metric for measuring safety of a product. High # of CVEs can easily indicate a safer product with a more mature bug bounty program or an attitude of "Assume it's vulnerable, don't require full exploits to prove it". There is no good information to be drawn from those two links.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]