6 ms·

Can anyone tell me how secure web browsers are on linux generally. I was looking at the pwn2own results and was quite impressed with the edge compromise that g

by dm319 9y ago

Can anyone tell me how secure web browsers are on linux generally. I was looking at the pwn2own results and was quite impressed with the edge compromise that got out of the host OS it was running in. However, I didn't see any web browsers on linux being compromised - is that because it is harder, or no-one bothered?

nilved 9y ago
Zero. Nil. None. Wide open. Like any other computer with power supply.
bugmen0t 9y ago
The browser exploits that sell well and deliver a good show are rated by impact. Thus, folks go for windows.
lima 9y ago
Comparable to Windows. Windows is a high-profile target for web browsing so you're seeing more exploits. Web browser escapes usually target the operating system kernel in order to break out of the sandbox. Chrome can reduce its attack surface on Linux using seccomp, and while there's a win32 syscall filter on Windows 10, I'm not sure if Chrome uses it. Windows has stronger kernel self protection features than Linux, but also more attack surface. Chrome uses Linux namespaces (like LXC/Docker/...) for isolation in addition to seccomp-bpf. Chrome is by far the most secure one right now, but as evidenced by this blog article, Firefox is catching up.
- johncolanduoni 9y ago
  The Chromium sandbox supports the Win32k mitigation, though it’s possible it’s not enabled at runtime.
- ryuuchin 9y ago
  Chrome disables all win32k syscalls in its renderer/extension/plugin processes (at the very least flash and pdf). This has been the default for a while now. I believe the specific win32k syscall filter you're referring to (where you can white/black list specific syscalls) is still only accessible to Microsoft applications (Edge uses it).
mtgx 9y ago
It's best to use the browser with Firejail.
ryuuchin 9y ago
Back when grsecurity was still public I would've said that using it with Chrome provided the best security you could get on Linux. Between the defensive mitigations it added through PaX and all the other little things (like making chroots actually behave like jails) it greatly increased security. This is without even using any MAC system. I'm not entirely sure how things stack up now. In the past I never had much faith in the vanilla linux kernel.

by dm319 9y ago

nilved 9y ago

Zero. Nil. None. Wide open. Like any other computer with power supply.

bugmen0t 9y ago

The browser exploits that sell well and deliver a good show are rated by impact. Thus, folks go for windows.

lima 9y ago

Comparable to Windows. Windows is a high-profile target for web browsing so you're seeing more exploits. Web browser escapes usually target the operating system kernel in order to break out of the sandbox. Chrome can reduce its attack surface on Linux using seccomp, and while there's a win32 syscall filter on Windows 10, I'm not sure if Chrome uses it. Windows has stronger kernel self protection features than Linux, but also more attack surface. Chrome uses Linux namespaces (like LXC/Docker/...) for isolation in addition to seccomp-bpf. Chrome is by far the most secure one right now, but as evidenced by this blog article, Firefox is catching up.

johncolanduoni 9y ago
The Chromium sandbox supports the Win32k mitigation, though it’s possible it’s not enabled at runtime.
ryuuchin 9y ago
Chrome disables all win32k syscalls in its renderer/extension/plugin processes (at the very least flash and pdf). This has been the default for a while now. I believe the specific win32k syscall filter you're referring to (where you can white/black list specific syscalls) is still only accessible to Microsoft applications (Edge uses it).

mtgx 9y ago

It's best to use the browser with Firejail.

ryuuchin 9y ago

Back when grsecurity was still public I would've said that using it with Chrome provided the best security you could get on Linux. Between the defensive mitigations it added through PaX and all the other little things (like making chroots actually behave like jails) it greatly increased security. This is without even using any MAC system. I'm not entirely sure how things stack up now. In the past I never had much faith in the vanilla linux kernel.