3 ms·

It is disappointing to see that no matter, how many exploit mitigation and sand-boxing techniques are used, Edge+Windows is still an exploitable combination (mu

It is disappointing to see that no matter, how many exploit mitigation and sand-boxing techniques are used, Edge+Windows is still an exploitable combination (multiple exploits targeted this successfully). I am a bit disappointed to see this since it was a new browser from ground up, and they could have gotten things right. But then browsers and operating systems are big attack surface and it is difficult to get everything right. That is where exploit mitigation techniques come into play. Apparently they also do not offer much. Secondly, it is interesting to see that all (except one) security teams, that won the contest, were Chinese teams. I am surprised at the absence of US/Russian/EU hackers. Perhaps they are selling their exploits at much larger premium in black market, to NSA et all.

nickpsecurity 10y ago
I wonder if it was operation or legacy software side that screwed up security potential of Edge. Microsoft did publish a design for strong security of browsers around the time Google did Native Client. Here was Microsoft's: https://www.microsoft.com/en-us/research/publication/the-multi-principal-os-construction-of-the-gazelle-web-browser/ https://www.microsoft.com/en-us/research/publication/the-mul... Here's recent work on securing networked apps: https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-hawblitzel.pdf https://www.usenix.org/system/files/conference/osdi14/osdi14... They're capable of making most of a browser immune to attacks likely to hit it. They can also make a strong system for containment. These simply weren't present in Edge to degree MS Research had designed. There's something blocking the transfer of those quite-practical tech that MS Research has been building.
shakna 10y ago
> I am a bit disappointed to see this since it was a new browser from ground up It's really not. The browser does have some new innovations... But it isn't something new from the ground up. EdgeHTML is a fork of Trident. They dropped legacy code, and fixed a ton of things... But still a fork. In fact, EdgeHTML was available as an experimental feature in IE11. Chakra is a fork of the JavaScript engine that was running in IE. Edge is nowhere near a brand new browser. But it does look like they're on the way to get IE right under the new name. (Though security still needs some more work, apparently.)

nickpsecurity 10y ago

I wonder if it was operation or legacy software side that screwed up security potential of Edge. Microsoft did publish a design for strong security of browsers around the time Google did Native Client. Here was Microsoft's: https://www.microsoft.com/en-us/research/publication/the-multi-principal-os-construction-of-the-gazelle-web-browser/ https://www.microsoft.com/en-us/research/publication/the-mul... Here's recent work on securing networked apps: https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-hawblitzel.pdf https://www.usenix.org/system/files/conference/osdi14/osdi14... They're capable of making most of a browser immune to attacks likely to hit it. They can also make a strong system for containment. These simply weren't present in Edge to degree MS Research had designed. There's something blocking the transfer of those quite-practical tech that MS Research has been building.

shakna 10y ago

> I am a bit disappointed to see this since it was a new browser from ground up It's really not. The browser does have some new innovations... But it isn't something new from the ground up. EdgeHTML is a fork of Trident. They dropped legacy code, and fixed a ton of things... But still a fork. In fact, EdgeHTML was available as an experimental feature in IE11. Chakra is a fork of the JavaScript engine that was running in IE. Edge is nowhere near a brand new browser. But it does look like they're on the way to get IE right under the new name. (Though security still needs some more work, apparently.)