11 ms·
Chrome 0-day exploit used in Operation WizardOpium
- piiwebtech 7y ago7th habit of Highly Effective People being to continuously Be Proactive http://franklincoveysouthasia.com/TrainingConsulting/TrainingCurriculums/the7habitssolutions/ http://franklincoveysouthasia.com/TrainingConsulting/Trainin...
- yread 7y agoThat analysis must have taken quite a while. Wasn't there any way to notify people earlier
- Evanbenn 7y agoThe analysis was posted when the fix was deployed.
- bureaucrat 7y agoCVE no. was created in July. I wonder whether the fix took that long.
- nwrk 7y agoGood eye and yes
- tambre 7y agoCVEs are typically reserved in blocks by big organizations.
- skunkpocalypse 7y agoIn a certain sense that's kinda sad.
- Buge 7y agoThe CVE number was reserved in July[1]. That doesn't mean the vulnerability was found in July. The vulnerability was reported to Google October 29[2], so between report to fix roll out was only ~2 days. Although the bug tracker entry is hidden[3], you can deduce the time the entry was created by iterating over bug IDs, which indicates it was filed between 8:56 AM PDT[4] and 9:11 AM PDT[5]. The fix was sent for review Oct 29 4:29 PM PDT and submitted at 5:47 PM[6]. It was cherrypicked Oct 30 at 9:51 AM[7]. >Date Entry Created > 20190718 > Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-13720 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-13720 [2] https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html https://chromereleases.googleblog.com/2019/10/stable-channel... [3] https://bugs.chromium.org/p/chromium/issues/detail?id=1019226 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [4] https://bugs.chromium.org/p/chromium/issues/detail?id=1019223 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [5] https://bugs.chromium.org/p/chromium/issues/detail?id=1019228 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [6] https://chromium-review.googlesource.com/c/chromium/src/+/1888103 https://chromium-review.googlesource.com/c/chromium/src/+/18... [7] https://chromium.googlesource.com/chromium/src/+/f1b501721e521a900c37b4f8cce4be8baedae731 https://chromium.googlesource.com/chromium/src/+/f1b501721e5...
- avian 7y agoOperation WizardOpium, Lazarus attacks, DarkHotel, ... The executive summary reads like something out of a Charles Stross novel.
- dstaley 7y agoI wonder if this exploit would be possible if Chrome was packaged using the UWP Desktop Bridge on Windows 10. I doubt the sandbox prevents UAF, but surely it would have prevented executing an EXE file.
- panpanna 7y agoI wonder the same thing with Linux contained executables, such as snap. (not sure if chrome is available as an official snap)
- dstaley 7y agoIt's my understanding that this particular exploit only targeted Windows, but the underlying UAF vulnerability affected all Chrome variants.
- ChrisSD 7y agoDesktop Bridge applications aren't sandboxed.
- dstaley 7y agoAh so it seems. The webpage for Desktop Bridge says that it features "no malware injection", so I took that to mean it was sandboxed.
- anovikov 7y agoTragedy of our generation is that people who are so smart and determined to find and exploit these vulnerabilities, can't find better uses for their talents.
- sfifs 7y agoWell the smartest talents of the previous generations built and exploded hundreds of nuclear weapons including a couple on innocent civilians, created ICBMs that can destroy civilization in a few minutes and created situations that brought the world to a brink several times, drove a massive population explosion anda fossil fuel consumption binge that may yet destroy civilization. So I definitely think the smartest of more recent generations who are employing their skills in these software hacks and ad tracking are perhaps saintly in comparison :-)
- ethanwillis 7y agoOr maybe society isn't providing them an accessible application for their talents.
- dEnigma 7y agoOne good application that comes to mind in this case would be the Google Chrome bug bounty program.
- londons_explore 7y agoThe writer of this exploit was almost certainly paid more than the bug bounty reward.
- malux85 7y agoAgreed, exploits on the deep Web pay 10x what the big bounty programs do, the mismatch is laughable
- jasonlfunk 7y agoYeah, that’s a hard thing. Because the exploit is almost certainly worth more to the buyer than having it fixed is worth to Google.
- kerng 7y agoWell, Chrome is indeed the new Internet Explorer. A new favorite target for threat actors.
- skunkpocalypse 7y agoGood thing we have lots of alternatives to Chrome's rendering engine... Oh wait.
- panpanna 7y agoAfter one 0-day?
- stinos 7y agoThis wasn't literally the first one I think?
- svenfaw 7y agoFar from it. Here's an older one this year: https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html?m=1 https://chromereleases.googleblog.com/2019/03/stable-channel...
- staticassertion 7y ago"Far from it", as you link to literally the only other case.
- kerng 7y agoThey had plenty, its good marketing they do.
- staticassertion 7y agoThere have been two ITW attacks on Chrome ever.
- londons_explore 7y agoAttacking a Korean news website hey? I wonder who might want to do that...
- newguy1234 7y agoJust some guy named Kenneth Osborne probably.
- londons_explore 7y agoThe attack code wasn't in an advert, suggesting the Korean news organisation had either previously been attacked, or had an insider plant this code.
- bureaucrat 7y agoThis attack was done by North Koreans. The site is a North Korean propaganda advertising site, which is visited a lot by South Korean researchers.
- dmix 7y agoThat would explain the strange/weak infrastructure and the economic targets in APAC.
- lovelearning 7y agoAs I understand these RCEs (in general; perhaps not this particular one), a frequent root cause seems to be saving instruction pointer on the stack adjacent to untrustworthy data which may have propagated down the call chain. Are there no initiatives being attempted to change this convention? Like not save the IP on the stack? Perhaps at the CPU architecture level or at the compiler level?
- Karliss 7y agoThere is SafeStack https://clang.llvm.org/docs/SafeStack.html https://clang.llvm.org/docs/SafeStack.html which splits stack in to two parts.
- deleted 7y ago[deleted]
- lawnchair_larry 7y agoThis is completely unrelated to this class of issue. You’re thinking of stack-based buffer overlows. This is all about heap manipulation, and doesn’t involve an overflow. Not in that sense anyway.
- panpanna 7y agoWikipedia ROP article has a whole section on defense techniques https://en.m.wikipedia.org/wiki/Return-oriented_programming https://en.m.wikipedia.org/wiki/Return-oriented_programming Note that this was a heap attack (free after use)
- haecceity 7y agoControl flow integrity is the group of techniques meant to deal with this problem. There are settings for Microsoft’s cpp compiler to enable them but the best way to accomplish this is with a hardware shadow stack. Intel cet does this but I’m not sure when the hardware will be available.
- cjbprime 7y agoThere are already many modern mitigations present to defeat the kind of stack overflow control of the instruction pointer that you're imagining -- stack canaries, DEP, ASLR, NX, and others. Simply gaining control of the instruction pointer through a stack overflow as you describe stopped working a decade or so ago due to these mitigations.
- euph0ria 7y agoHow can I know if I was infected and what can I do about it?
- NullPrefix 7y agoYou should follow the same procedure as you do for any other, disclosed or undisclosed, infections and vulnerabilities.
- euph0ria 7y agoPlease let us know what your procedure is?
- tkifnn 7y agoDo nothing because I am not important enough to be a target of zero days
- ianai 7y agoIt’s checking for chrome versions below the current, 78, so update to that. You also have to be on Windows. On windows, make sure you have your antivirus setup to block random executables from download and execution. I’d also block those hosts at the firewall and dns. It gets more complicated from there if you’re infected. But you probably aren’t. Edit-just realized you actually asked for how to tell if you were infected. Check the windows task scheduler for unknown tasks. It installs items there for persistence. Edit-search your history and hard drive for “behindcorona” domains. That’s where it loads things from. There are more specifics in the page.
- willtim 7y ago> "The exploit used a race condition bug between two threads due to missing proper synchronization between them. It gives an attacker a Use-After-Free (UaF) condition that is very dangerous because it can lead to code execution scenarios" This is why C++ needs to be retired; and why we need to use safer languages. Not even Google can write safe C++. Thankfully Mozilla have already realised this.
- pjmlp 7y agoWe should start by retiring C. It doesn't matter if userspace is fully safe, when the basement looks like a Swiss cheese of security.
- willtim 7y agoMaybe. I'm happy to run any formally verified C as my basement, for example the seL4 kernel, or for C to be used as an intermediate language. Especially as there should be less code at the bottom of the stack. But C++ seems worse, it's a far more complex language, designed and built to try and scale C to building applications. This creates a far larger attack surface.
- zozbot234 7y ago> This is why C++ needs to be retired; and why we need to use safer languages. These problems can easily happen in a language like Go, unfortunately. Go is memory safe for sequential code, but that guarantee does not extend to in-process concurrency - Goroutines can access shared state without synchronization, and create memory unsafety.
- willtim 7y agoWhat do you mean by memory unsafety? A stale read would be bad, but wouldn't lead to arbitrary code execution.
- zozbot234 7y agoA 'stale' read of atomic data may be fine (it wouldn't really be "unsynchronized" in that sense), but as soon as you're dealing with stuff that's not completely atomic in-hardware and need actual synchronization, there's a potential of breaking expected invariants and creating further unsafety as a consequence of that.
- Jyaif 7y agoFunnily enough, looks like the vulnerability was introduced by a (korean?) samsung engineer. fix: https://chromium-review.googlesource.com/c/chromium/src/+/1888103 https://chromium-review.googlesource.com/c/chromium/src/+/18... git blame: https://chromium.googlesource.com/chromium/src.git/+/e1fa6d40966b5eb966feeed6fbe18675e819ff6d%5E%21/#F1 https://chromium.googlesource.com/chromium/src.git/+/e1fa6d4...
- ChrisCinelli 7y agoWhat a coincidence! =)
- deleted 7y ago[deleted]
- baybal2 7y agoIndeed, the first google search gives his Linkedin in the first position
- petjuh 7y agoDidn't the article say the explot is hosted on a Korean portal? I assume this means they target mostly Korean users, which probably means the hackers themselves are Korean.
- tekni5 7y agoIs there anyway to test this on other chrome based browsers? For example current version of Iridium is 2019.04.73.0(based on Chromium 73.0.3683.103), it doesn't get updated that often but a useful and stable browser. Anyway to mitigate this exploit via any setting or extension?
- 0xdeadb00f 7y agoI'll also ask is Chromium affected? And does that mean Chrome-based browsers on Android are affected too?
- sanbor 7y agoThis is why I started disabling js by default using ublock origin. I whitelist the websites that I'm interested in but at least I avoid a lots of exploits that requires js. This is in case if I'm unlucky and I land in one of those websites with malicious js. I discovered duckduckgo doesn't block websites as eagerly as Google and landed in a few tricky places.
- dmos62 7y agoIf you want Google Search without Google, there's Startpage. It acts as a proxy between you and Google, protecting your privacy. I've been using it exclusively for maybe two years now. I am a bit upset at not supporting the more involved privacy-friendly projects, like DuckDuckGo or others (there are a quite a few); but, Startpage gives me the right mix of privacy, efficiency and social awareness at the moment.
- hellcow 7y agoStartpage was recently acquired by an ad company. https://www.reddit.com/r/privacy/comments/di5rn3/startpage_is_now_owned_by_an_advertising_company/ https://www.reddit.com/r/privacy/comments/di5rn3/startpage_i...
- dmos62 7y agoWow. Thanks for the heads up.
- throw55443h 7y agoStartPage was bought by an ad company. Better not use it. https://news.ycombinator.com/item?id=21371577 https://news.ycombinator.com/item?id=21371577
- jbk 7y agoI know this is a bit a pet peeve of mine, (and not a very popular opinion) but I think the browsers are doing too much, and WebAudio is a very good example of that. Instead of standardizing something low-level to input/output audio and query the hardware, like an OS; it standardizes soooo many things and filters, including downmixers, panners, quadfilters and Convolution (for reverbs); which is where the issue is in this exploit. The resulting complexity is huge, almost impossible to implement correctly in a cross-browser way, and a lot more code in C/C++ is written. I do advocate simpler APIs for audio, low-level, and let JS or Wasm do the filtering, using the JS sandboxing model. And, of course, this does not apply only to WebAudio, but I think WebAudio is a good symptom.
- coleifer 7y agoWhere did you see the reference to webaudio? Link to any other relevant details about the vulnerability, specifically?
- jbk 7y agoIf you follow the link, you'll see it is in the webaudio convolver.
- dmos62 7y agoIt's not just you. Browsers are systems-within-systems. They're gigantic, illustrated by the fact that the number of implementations that are well maintained can be counted on one hand. A lot of people take issue with that.
- csande17 7y agoThe Web platform is now so gigantic and complex that even Microsoft has decided it's impossible to write a browser!
- threatofrain 7y agoOr Microsoft did a back of the napkin calculation and realised that the potential increase in user base for Microsoft products wasn’t worth the money. Their users are already on Windows and Microsoft already has telemetry on them. And we’re talking about the browser guts and not the surface, which is where most of UX lives. But none of this means that Microsoft is browser incompetent.
- dajohnson89 7y agothis only affects windows users, right?
- iamasdescribed 7y agoI am rubbing tricks with you.
- iamasdescribed 7y agoHeads, trick heads, up. Let's rub those sh1ts together
- iamasdescribed 7y agoMy nuts are also affected