16 ms·

Zero-Day Vulnerability in Microsoft Windows Leaked on Twitter

332 points by tzury 8y ago

ghostbrainalpha 8y ago
"Here is the alpc bug as 0day: https://github.com/SandboxEscaper/randomrepo/blob/master/PoC-LPE.rar https://github.com/SandboxEscaper/randomrepo/blob/master/PoC... … I don't fucking care about life anymore. Neither do I ever again want to submit to MSFT anyway. Fuck all of this shit." So is this person upset because Microsoft wouldn't patch the bug? Or that they didn't want to pay for the information? Comments seem to reference Apple pays 25k for this type of info. Can anyone with background give some context here?
- qeternity 8y ago
  Earlier tweets from this account seem to indicate they believe MS intentionally sabotaged the process so that they could sell the bugs, including to oppressive governments: https://twitter.com/SandboxEscaper/status/1034116189373521920 https://twitter.com/SandboxEscaper/status/103411618937352192... https://twitter.com/SandboxEscaper/status/1034112926045622274 https://twitter.com/SandboxEscaper/status/103411292604562227... EDIT as @dixie_land points out, it appears the author is open to selling indiscriminately.
  - dixie_land 8y ago
    I don't know how you reached that conclusion. The tweets read to me that the author is willing to sell to the highest bidder.
    - qeternity 8y ago
      Yeah, fair point. I think the thread that tweet is part of reads better the way you read it. Will edit my comment.
    - deleted 8y ago
      [deleted]
  - Rotdhizon 8y ago
    I'm not understanding. Is this lady mad because she wants to get out of bug hunting, so she found a major MSFT bug and tried to sell it, and they patched it and thwarted her attempt at that?
    - ghostbrainalpha 8y ago
      Definitely not that. Microsoft has not patched the issue. That's why its a big deal that she is posting it on Twitter.
  - mockingbirdy 8y ago
    Please see https://news.ycombinator.com/item?id=17860480 https://news.ycombinator.com/item?id=17860480 before downvoting. From her website - http://sandboxescaper.blogspot.com http://sandboxescaper.blogspot.com: > I'm also transgender. But my transition so far has been really difficult (social isolation, lack of support.. etc), my voice is still really manly and I don't really pass at all (which probably weirds people out.. so I would rather say it upfront so I don't need to have anxiety about it, I have alot of anxiety issues). I also have not been able to change my name yet, legally its still "Thomas". - - - w.r.t. the 0-day release: Well that's some seriously irresponsible stuff right there. I think she has a tough time (she's transgender and doesn't have support from her peers). It's sad that she hasn't found a way to live a happy life although she clearly has serious skills. I hope she'll be fine. It's just annoying that a lot of users are now at risk, I hope the patches will be installed ASAP.
    - daxorid 8y ago
      Full disclosure is not "irresponsible", and plenty of researchers do it even in the absence of armchair psychoanalysis by the Internet.
      - mockingbirdy 8y ago
        Most of them follow specific timelines for those disclosures which are communicated with the affected vendor.
        throwawayjava 8y ago
        And also don't follow up a disclosure with an offer to sell exploits to the highest bidder. Is selling an exploit to a foreign government even 100% legal? (Serious question; that seems like the sort of thing that could get one in trouble.)
        LinuxBender 8y ago
        If you sold to a country with standing sanctions, that could be an issue. 0-day's can also be considered munitions in some interpretations of law, though I am not a lawyer nor a weapons dealer.
  - samstave 8y ago
    Are you saying that MSFT wanted to be sure to maintain MSFT's prerogative to sell the exploit to oppressive governments? If this is the case, which I can see how it could be, then this is the bigger story for those outside of Tech circles to understand.
  - deleted 8y ago
    [deleted]
  - exikyut 8y ago
    Both tweets were deleted - but Google still had them cached! \o/ 1st link -> http://archive.is/8xh4z http://archive.is/8xh4z 2nd link -> http://archive.is/KGyCf http://archive.is/KGyCf
- berns 8y ago
  > I don't want to work in IT security anymore. All the industry bullshit ruined it for me. I can't even motivate myself anymore to bug hunt. But I have no other skills to make money with, I'm so screwed. and > Will sell to people in the eastern hemisphere too. I just want money so I can travel.
  - jasonlfunk 8y ago
    It seems that anyone who knows enough to find this level of 0day vulnerability has skills that people would pay for.
    - chelmzy 8y ago
      Yes but not many companies will put up with someone who does this shit.
      - Rotdhizon 8y ago
        I can sympathize with her strife, but she is on the path to seriously burn bridges. I can't imagine many security focused companies would touch her with a 10 foot pole now that she publicly admitted that she is willing to sell a 0day for profit. Sure she is going through a rough time, but even when angry, you have to not say things you regret, especially online. EDIT: Did not realize selling bugs outside of bug bounty programs and related bug programs was a normal thing. Now I know.
        prolikewh0a 8y ago
        >but she is on the path to seriously burn bridges As a transgender person, this is all that happens in our lives to be honest. It's very tough to have anything but a 'rough time' when the general public views you weirdly, and your family/friends have completely abandoned you.
        Gargeemel 8y ago
        No one is interested in your perverted lifestyle. A majority believe that gender is not a choice.
- deleted 8y ago
  [deleted]
- zdragnar 8y ago
  Reading through the author's blog (links found further below) it would seem that on more than one occasion the author didn't receive credit, which presumably makes it harder to find new jobs. The author's blog is also full of anti-social comments, which would sound awfully melodramatic if I didn't have personal experience with depression. Regardless, it is a public expression that she's going to be a fairly toxic person to work with, which is almost certainly working against her in the job hunt.
- lima 8y ago
  Sounds like she had a frustrating experience while trying to responsibly report it to Microsoft.
  - lawnchair_larry 8y ago
    For what it’s worth, even Microsoft famously disavowed the use of the term “responsible” in this context.
- strictnein 8y ago
  If I recall correctly, she has an "interesting" relationship with MS. Finds lot of stuff, gets really frustrated with their process.
  - mintplant 8y ago
    I'm not surprised. For me, the process of reporting to MS has gone: 1) Jump through a surprising number of hoops to set up a Windows 10 Insider channel machine, reproduction on which is required for their security program. 2) Email a write-up and PoCs to their security address. 3) Get back two emails naming a point of contact and dumping a pile of legal agreements they expect me to follow just for reaching out to them. 4) Receive no further contact or indications of progress.
- mzs 8y ago
  It satisfies a profile that hostile intelligence services take advantage of.
trollied 8y ago
Here's the exploit description from the writeup .doc file that is included in the .rar file that's hosted on GitHub: The task scheduler service has an alpc endpoint, supporting the method “SchRpcSetSecurity”. The prototype looks like this: long _SchRpcSetSecurity( [in][string] wchar_t* arg_1, //Task name [in][string] wchar_t* arg_2, //Security Descriptor string [in]long arg_3); Tasks created by the task scheduler will create a corresponding folder/file in c:\windows\system32\tasks. This function seems to be designed to write the DACL of tasks located there, and will do so while impersonating. However, for some reason it will also check if a .job file exists under c:\windows\tasks and try to set the DACL while not impersonating. Since a user, and even a user belonging to the guests group can create files in this folder, we can simply create a hardlink to another file (all we need is read access). Because of the hardlink, we can let the task scheduler write an arbitrary DACL (see second parameter of SchRpcSetSecurity) to a file of our choosing. So any file that we have read access over as a user and that system has the write DACL permission for, we can pivot into full control and overwrite it.
- gboudrias 8y ago
  Thank you for the description, I was hesitant to download a .rar just to read something... > So any file that we have read access over as a user and that system has the write DACL permission for, we can pivot into full control and overwrite it. Doesn't this imply we can use guest access to install any kind of backdoor, since we'll have "read access" to a bunch of programs that start on boot? Seems really bad, maybe I'm misinterpreting (I haven't been on Windows for a while).
  - tomashertus 8y ago
    Yeah, the docs files in the archive seems to be clean based on the multiscan results. Some AVs are already flagging the hash of the rar as an exploit. Metadefender: https://metadefender.opswat.com/results#!/file/YTE4MDgyOHJrWE9GZkFHRDdIMTZiNnZ2YlhQWA/regular/overview https://metadefender.opswat.com/results#!/file/YTE4MDgyOHJrW... VT: https://www.virustotal.com/#/file/0c2cbb5eba3ae0765b1674891262146f57cf177e9e5e0b17f2e78b43dbcac571/detection https://www.virustotal.com/#/file/0c2cbb5eba3ae0765b16748912... Edit: Fixing grammar
draw_down 8y ago
Many of the responses are more positive than I would have expected, a pleasant surprise.
billpg 8y ago
Exactly how terrified should I be right now?
- newsbinator 8y ago
  7
- luch 8y ago
  Not terribly terrified. At best it seem to be a Medium IL to SYSTEM. In other words a slightly better UAC bypass than most, but I don't think you can use it to escape from a browser sandbox for example.
  - dmix 8y ago
    People always seem to overlook this distinction... escalating admin privileges is typically one of the easier things for a hacker to do. Getting in is the harder part (ie, remote/browser exploits, etc).
    - 3pt14159 8y ago
      (Hey dmix; hangs soon?) I'm not really sure if that is true. Adobe exploits are pretty cheap and unless your target is in software you can usually get a click on a link one way or another. Really, to me, the hard part is getting in without needing to have the user consciously do anything since then you're in and nobody could even have noticed you doing something.
      - dmix 8y ago
        > Really, to me, the hard part is getting in without needing to have the user consciously do anything That's why I said remote/browser, everything else is noisy and therefore the 'easy' route. Usually this is sufficient for low tech nation states because they attack organizations not individuals, so all you need is a weak human link where noisey isn't a big deal. Then moving horizontally across the organization. But more importantly OS are terribly insecure and privesc bugs are a dime a dozen. You don't need zero days to achieve that the vast majority of the time.
smpetrey 8y ago
Yikes, that's a nasty one. Sad MSFT didn't want to pay bounty on this.
pwaai 8y ago
I'm always curious about the individuals discovering these zero day vulnerabilities. What framework do they use to find it? Is it just educated trial and error until you hit something?
- ChrisLomont 8y ago
  A good place to start is learning how to poke at some API, and fizzers are a good way to do that. Pick some API that you think is complex (often places with previous bugs still have bugs), find a way to bang on it with all sorts of malformed data until something happens (crash, fault, or such). When you find that, you now have a set of inputs that the API is not sanitized against. Then you can try to disassemble, using tools like IdaPRO (best, but expensive), free reversing tools, kernel debuggers, etc. to get a handle on what is going wrong. At some point you might find the precise error at the assembly level. Then you may try to craft your inputs to bypass checks and affect the underlying system in a way you control. Here there are an astounding number of tricks and ways to bypass various security features, and you will have to read extensively to get a large bag of tricks for this step. Now you have a decent exploit. Each of these steps takes learning through just doing it and reading. You'll learn tools for various pieces of the game. But it's doable with decent effort.
  - pwaai 8y ago
    wow...you piqued my interest now... what API or software should I start with? Also, @SandboxEscaper mentions logic based exploits vs memory based ones which are disappearing (?), what is she referring to? also any good resources on starting this journey. I'm very serious about this because it potentially could be a dream job for me.
    - ChrisLomont 8y ago
      Start by looking up an exploit that has details published, and recreate it. Do that a few times, and you will begin to understand how it works without the frustration of not finding anything. As you get better you'll both get better at finding things and at dealing with the long periods of not feeling like you're making progress. I suspect there's sites that help you walk through this, and I know I've seen ones that walk you through prepared exploits. You really just have to start putting in legwork consistently.
scottydelta 8y ago
Quote from blog post[1] dated 14th June: I really did not get anything for this bug, and I know I'm probably forfeiting an acknowledgement too right now. But I wasted alot of time on this bug, and nobody but me should be able to decide what to do with it. People who criticize this type of behavior I find frankly annoying. I used to be one of those self-righteous types, but I'm also pretty annoying, so perhaps there is a correlation. Besides, this bug is way to silly in its complexity to be of any use to anyone. I would not drop a full 0day exploit, which I can assure you, I have totally sitting on my hard drive (not referring to this bug :). For the people wondering why she released the exploit instead of claiming bounty on it, in the blog post[1] dated 14th June, she said she would not drop a full 0day exploit. I guess that changed when she did not get credit for her last bug (cve-2018-8314) according to her another blog post[2] from Aug 17th. [1] https://sandboxescaper.blogspot.com/2018/06/using-filepickers-to-escape-sandboxes.html https://sandboxescaper.blogspot.com/2018/06/using-filepicker... [2] https://sandboxescaper.blogspot.com/2018/08/all-good-things-must-come-to-end.html https://sandboxescaper.blogspot.com/2018/08/all-good-things-...
- jplayer01 8y ago
  Man, code blocks are insufferable to read on a phone.
- nailer 8y ago
  Fixed: > I really did not get anything for this bug, and I know I'm probably forfeiting an acknowledgement too right now. But I wasted alot of time on this bug, and nobody but me should be able to decide what to do with it. People who criticize this type of behavior I find frankly annoying. I used to be one of those self-righteous types, but I'm also pretty annoying, so perhaps there is a correlation. > Besides, this bug is way to silly in its complexity to be of any use to anyone. I would not drop a full 0day exploit, which I can assure you, I have totally sitting on my hard drive (not referring to this bug :).
polishedcat 8y ago
Ah, the old "trick a system process into overwriting a link destination" ploy. That used to be a popular exploit method on UNIX in the 1980s.
- lima 8y ago
  It still is a common vulnerability on *NIX

332 points by tzury 8y ago

"Here is the alpc bug as 0day: https://github.com/SandboxEscaper/randomrepo/blob/master/PoC-LPE.rar https://github.com/SandboxEscaper/randomrepo/blob/master/PoC... … I don't fucking care about life anymore. Neither do I ever again want to submit to MSFT anyway. Fuck all of this shit." So is this person upset because Microsoft wouldn't patch the bug? Or that they didn't want to pay for the information? Comments seem to reference Apple pays 25k for this type of info. Can anyone with background give some context here?

qeternity 8y ago
Earlier tweets from this account seem to indicate they believe MS intentionally sabotaged the process so that they could sell the bugs, including to oppressive governments: https://twitter.com/SandboxEscaper/status/1034116189373521920 https://twitter.com/SandboxEscaper/status/103411618937352192... https://twitter.com/SandboxEscaper/status/1034112926045622274 https://twitter.com/SandboxEscaper/status/103411292604562227... EDIT as @dixie_land points out, it appears the author is open to selling indiscriminately.
- dixie_land 8y ago
  I don't know how you reached that conclusion. The tweets read to me that the author is willing to sell to the highest bidder.
  - qeternity 8y ago
    Yeah, fair point. I think the thread that tweet is part of reads better the way you read it. Will edit my comment.
  - deleted 8y ago
    [deleted]
- Rotdhizon 8y ago
  I'm not understanding. Is this lady mad because she wants to get out of bug hunting, so she found a major MSFT bug and tried to sell it, and they patched it and thwarted her attempt at that?
  - ghostbrainalpha 8y ago
    Definitely not that. Microsoft has not patched the issue. That's why its a big deal that she is posting it on Twitter.
- mockingbirdy 8y ago
  Please see https://news.ycombinator.com/item?id=17860480 https://news.ycombinator.com/item?id=17860480 before downvoting. From her website - http://sandboxescaper.blogspot.com http://sandboxescaper.blogspot.com: > I'm also transgender. But my transition so far has been really difficult (social isolation, lack of support.. etc), my voice is still really manly and I don't really pass at all (which probably weirds people out.. so I would rather say it upfront so I don't need to have anxiety about it, I have alot of anxiety issues). I also have not been able to change my name yet, legally its still "Thomas". - - - w.r.t. the 0-day release: Well that's some seriously irresponsible stuff right there. I think she has a tough time (she's transgender and doesn't have support from her peers). It's sad that she hasn't found a way to live a happy life although she clearly has serious skills. I hope she'll be fine. It's just annoying that a lot of users are now at risk, I hope the patches will be installed ASAP.
  - daxorid 8y ago
    Full disclosure is not "irresponsible", and plenty of researchers do it even in the absence of armchair psychoanalysis by the Internet.
    - mockingbirdy 8y ago
      Most of them follow specific timelines for those disclosures which are communicated with the affected vendor.
      - throwawayjava 8y ago
        And also don't follow up a disclosure with an offer to sell exploits to the highest bidder. Is selling an exploit to a foreign government even 100% legal? (Serious question; that seems like the sort of thing that could get one in trouble.)
        LinuxBender 8y ago
        If you sold to a country with standing sanctions, that could be an issue. 0-day's can also be considered munitions in some interpretations of law, though I am not a lawyer nor a weapons dealer.
- samstave 8y ago
  Are you saying that MSFT wanted to be sure to maintain MSFT's prerogative to sell the exploit to oppressive governments? If this is the case, which I can see how it could be, then this is the bigger story for those outside of Tech circles to understand.
- deleted 8y ago
  [deleted]
- exikyut 8y ago
  Both tweets were deleted - but Google still had them cached! \o/ 1st link -> http://archive.is/8xh4z http://archive.is/8xh4z 2nd link -> http://archive.is/KGyCf http://archive.is/KGyCf
berns 8y ago
> I don't want to work in IT security anymore. All the industry bullshit ruined it for me. I can't even motivate myself anymore to bug hunt. But I have no other skills to make money with, I'm so screwed. and > Will sell to people in the eastern hemisphere too. I just want money so I can travel.
- jasonlfunk 8y ago
  It seems that anyone who knows enough to find this level of 0day vulnerability has skills that people would pay for.
  - chelmzy 8y ago
    Yes but not many companies will put up with someone who does this shit.
    - Rotdhizon 8y ago
      I can sympathize with her strife, but she is on the path to seriously burn bridges. I can't imagine many security focused companies would touch her with a 10 foot pole now that she publicly admitted that she is willing to sell a 0day for profit. Sure she is going through a rough time, but even when angry, you have to not say things you regret, especially online. EDIT: Did not realize selling bugs outside of bug bounty programs and related bug programs was a normal thing. Now I know.
      - prolikewh0a 8y ago
        >but she is on the path to seriously burn bridges As a transgender person, this is all that happens in our lives to be honest. It's very tough to have anything but a 'rough time' when the general public views you weirdly, and your family/friends have completely abandoned you.
        Gargeemel 8y ago
        No one is interested in your perverted lifestyle. A majority believe that gender is not a choice.
deleted 8y ago
[deleted]
zdragnar 8y ago
Reading through the author's blog (links found further below) it would seem that on more than one occasion the author didn't receive credit, which presumably makes it harder to find new jobs. The author's blog is also full of anti-social comments, which would sound awfully melodramatic if I didn't have personal experience with depression. Regardless, it is a public expression that she's going to be a fairly toxic person to work with, which is almost certainly working against her in the job hunt.
lima 8y ago
Sounds like she had a frustrating experience while trying to responsibly report it to Microsoft.
- lawnchair_larry 8y ago
  For what it’s worth, even Microsoft famously disavowed the use of the term “responsible” in this context.
strictnein 8y ago
If I recall correctly, she has an "interesting" relationship with MS. Finds lot of stuff, gets really frustrated with their process.
- mintplant 8y ago
  I'm not surprised. For me, the process of reporting to MS has gone: 1) Jump through a surprising number of hoops to set up a Windows 10 Insider channel machine, reproduction on which is required for their security program. 2) Email a write-up and PoCs to their security address. 3) Get back two emails naming a point of contact and dumping a pile of legal agreements they expect me to follow just for reaching out to them. 4) Receive no further contact or indications of progress.
mzs 8y ago
It satisfies a profile that hostile intelligence services take advantage of.

trollied 8y ago

Here's the exploit description from the writeup .doc file that is included in the .rar file that's hosted on GitHub: The task scheduler service has an alpc endpoint, supporting the method “SchRpcSetSecurity”. The prototype looks like this: long _SchRpcSetSecurity( [in][string] wchar_t* arg_1, //Task name [in][string] wchar_t* arg_2, //Security Descriptor string [in]long arg_3); Tasks created by the task scheduler will create a corresponding folder/file in c:\windows\system32\tasks. This function seems to be designed to write the DACL of tasks located there, and will do so while impersonating. However, for some reason it will also check if a .job file exists under c:\windows\tasks and try to set the DACL while not impersonating. Since a user, and even a user belonging to the guests group can create files in this folder, we can simply create a hardlink to another file (all we need is read access). Because of the hardlink, we can let the task scheduler write an arbitrary DACL (see second parameter of SchRpcSetSecurity) to a file of our choosing. So any file that we have read access over as a user and that system has the write DACL permission for, we can pivot into full control and overwrite it.

gboudrias 8y ago
Thank you for the description, I was hesitant to download a .rar just to read something... > So any file that we have read access over as a user and that system has the write DACL permission for, we can pivot into full control and overwrite it. Doesn't this imply we can use guest access to install any kind of backdoor, since we'll have "read access" to a bunch of programs that start on boot? Seems really bad, maybe I'm misinterpreting (I haven't been on Windows for a while).
- tomashertus 8y ago
  Yeah, the docs files in the archive seems to be clean based on the multiscan results. Some AVs are already flagging the hash of the rar as an exploit. Metadefender: https://metadefender.opswat.com/results#!/file/YTE4MDgyOHJrWE9GZkFHRDdIMTZiNnZ2YlhQWA/regular/overview https://metadefender.opswat.com/results#!/file/YTE4MDgyOHJrW... VT: https://www.virustotal.com/#/file/0c2cbb5eba3ae0765b1674891262146f57cf177e9e5e0b17f2e78b43dbcac571/detection https://www.virustotal.com/#/file/0c2cbb5eba3ae0765b16748912... Edit: Fixing grammar

draw_down 8y ago

Many of the responses are more positive than I would have expected, a pleasant surprise.

billpg 8y ago

Exactly how terrified should I be right now?

newsbinator 8y ago
7
luch 8y ago
Not terribly terrified. At best it seem to be a Medium IL to SYSTEM. In other words a slightly better UAC bypass than most, but I don't think you can use it to escape from a browser sandbox for example.
- dmix 8y ago
  People always seem to overlook this distinction... escalating admin privileges is typically one of the easier things for a hacker to do. Getting in is the harder part (ie, remote/browser exploits, etc).
  - 3pt14159 8y ago
    (Hey dmix; hangs soon?) I'm not really sure if that is true. Adobe exploits are pretty cheap and unless your target is in software you can usually get a click on a link one way or another. Really, to me, the hard part is getting in without needing to have the user consciously do anything since then you're in and nobody could even have noticed you doing something.
    - dmix 8y ago
      > Really, to me, the hard part is getting in without needing to have the user consciously do anything That's why I said remote/browser, everything else is noisy and therefore the 'easy' route. Usually this is sufficient for low tech nation states because they attack organizations not individuals, so all you need is a weak human link where noisey isn't a big deal. Then moving horizontally across the organization. But more importantly OS are terribly insecure and privesc bugs are a dime a dozen. You don't need zero days to achieve that the vast majority of the time.

smpetrey 8y ago

Yikes, that's a nasty one. Sad MSFT didn't want to pay bounty on this.

pwaai 8y ago

I'm always curious about the individuals discovering these zero day vulnerabilities. What framework do they use to find it? Is it just educated trial and error until you hit something?

ChrisLomont 8y ago
A good place to start is learning how to poke at some API, and fizzers are a good way to do that. Pick some API that you think is complex (often places with previous bugs still have bugs), find a way to bang on it with all sorts of malformed data until something happens (crash, fault, or such). When you find that, you now have a set of inputs that the API is not sanitized against. Then you can try to disassemble, using tools like IdaPRO (best, but expensive), free reversing tools, kernel debuggers, etc. to get a handle on what is going wrong. At some point you might find the precise error at the assembly level. Then you may try to craft your inputs to bypass checks and affect the underlying system in a way you control. Here there are an astounding number of tricks and ways to bypass various security features, and you will have to read extensively to get a large bag of tricks for this step. Now you have a decent exploit. Each of these steps takes learning through just doing it and reading. You'll learn tools for various pieces of the game. But it's doable with decent effort.
- pwaai 8y ago
  wow...you piqued my interest now... what API or software should I start with? Also, @SandboxEscaper mentions logic based exploits vs memory based ones which are disappearing (?), what is she referring to? also any good resources on starting this journey. I'm very serious about this because it potentially could be a dream job for me.
  - ChrisLomont 8y ago
    Start by looking up an exploit that has details published, and recreate it. Do that a few times, and you will begin to understand how it works without the frustration of not finding anything. As you get better you'll both get better at finding things and at dealing with the long periods of not feeling like you're making progress. I suspect there's sites that help you walk through this, and I know I've seen ones that walk you through prepared exploits. You really just have to start putting in legwork consistently.

scottydelta 8y ago

Quote from blog post[1] dated 14th June: I really did not get anything for this bug, and I know I'm probably forfeiting an acknowledgement too right now. But I wasted alot of time on this bug, and nobody but me should be able to decide what to do with it. People who criticize this type of behavior I find frankly annoying. I used to be one of those self-righteous types, but I'm also pretty annoying, so perhaps there is a correlation. Besides, this bug is way to silly in its complexity to be of any use to anyone. I would not drop a full 0day exploit, which I can assure you, I have totally sitting on my hard drive (not referring to this bug :). For the people wondering why she released the exploit instead of claiming bounty on it, in the blog post[1] dated 14th June, she said she would not drop a full 0day exploit. I guess that changed when she did not get credit for her last bug (cve-2018-8314) according to her another blog post[2] from Aug 17th. [1] https://sandboxescaper.blogspot.com/2018/06/using-filepickers-to-escape-sandboxes.html https://sandboxescaper.blogspot.com/2018/06/using-filepicker... [2] https://sandboxescaper.blogspot.com/2018/08/all-good-things-must-come-to-end.html https://sandboxescaper.blogspot.com/2018/08/all-good-things-...

jplayer01 8y ago
Man, code blocks are insufferable to read on a phone.
nailer 8y ago
Fixed: > I really did not get anything for this bug, and I know I'm probably forfeiting an acknowledgement too right now. But I wasted alot of time on this bug, and nobody but me should be able to decide what to do with it. People who criticize this type of behavior I find frankly annoying. I used to be one of those self-righteous types, but I'm also pretty annoying, so perhaps there is a correlation. > Besides, this bug is way to silly in its complexity to be of any use to anyone. I would not drop a full 0day exploit, which I can assure you, I have totally sitting on my hard drive (not referring to this bug :).

polishedcat 8y ago

Ah, the old "trick a system process into overwriting a link destination" ploy. That used to be a popular exploit method on UNIX in the 1980s.

lima 8y ago
It still is a common vulnerability on *NIX