4 ms·

What can a unsandboxed javascript engine do? can you read files? read data from my computer's memory? Send my credit card info to the internet? Is this reading

What can a unsandboxed javascript engine do? can you read files? read data from my computer's memory? Send my credit card info to the internet? Is this reading my chrome's profile data or running Node in any way? Access my camera/microphone/keyboard? I fail to see how this is a problema and I've been programming with javascript for 8 years...

hibbelig 7y ago
> What can a unsandboxed javascript engine do? It can do everything that the user could do, and the user in this case is SYSTEM. I understand SYSTEM can do everything. It could install a keylogger, for instance.
giantDinosaur 7y ago
This runs as SYSTEM, which is the highest privilege set in Windows. Yes, a vulnerability will result in absolutely everything you asked about.
- jaclaz 7y ago
  To be picky, not the highest privilege, System is prevented from doing things that TrestedInstaller can do. Hence the existence of a number of Windows tools to get TrustedInstaller privileges, some examples listed in this thread: https://msfn.org/board/topic/181190-how-to-overwrite-dll-file-in-system32/ https://msfn.org/board/topic/181190-how-to-overwrite-dll-fil...
jeltz 7y ago
If the js engine has no bugs it cannot do anything harmful, but since this is Avast's own custom engine it likely has security bugs which allow malicious JS code to escape the engine, and if it does it can do virtually anything with your machine since the engine runs as SYSTEM. Writing your own JS engine and then running it as SYSTEM is terrible engineering and very dangerous. There is no reason for why they have to run it as SYSTEM.
- tgtweak 7y ago
  Has anyone confirmed it is their own? I'd be surprised if it wasn't a shaved-down v8 or similar. Lastly have we confirmed there's no memory or thread protection in place? Most AV reputable AV companies have strong proprietary sandbox code (especially in the scan engine process) which is on par with virtualization in terms of isolation.
  - saagarjha 7y ago
    It doesn't look like V8.
gitgud 7y ago
Chrome and Firefox have both continually developed a secure JS engine for over 10 years, and there's still vulnerabilities found in them all the time... Now imagine a company's internal JS implementation without all that engineering effort... vulnerabilities will become apparent immediately
- blattimwind 7y ago
  An engine like this would likely not implement the hardest bits - JIT and optimization. Many, if not most, vulnerabilities in modern JS engines arise from performance optimizations.
MertsA 7y ago
If there is no vulnerability in the javascript engine or any of the API they exposed to it in order to mockup a web browser then it can't do anything. The problem here is that that's not exactly a tiny attack surface, and modern web browsers implement defense in depth and sandboxing untrusted code for very good reasons. If there was some RCE for a part of this javascript engine, you're not just executing inside of some locked down environment, you're not just executing code as an untrusted user, you're executing code in a process with SYSTEM level permissions. This is like putting a 2 meter wide thermal exhaust port on your death star. On the off chance someone manages to hit it, game over. This process runs untrusted code so if you can get a file opened on the target computer, or even just get the user to go to a malicious website, you can try to attack this. Once you get some payload running yeah you could use bog standard crimeware to sniff out any credit card details entered, export your saved passwords from your web browser, look for any wallet.dat equivalents and run a keylogger waiting for you to decrypt it, drop some ransomware on the system, etc. This gives full control over the system if you find an exploit to it. But yeah, this isn't immediately a vulnerability, just a poor design decision and a very juicy target.
- saagarjha 7y ago
  > This is like putting a 2 meter wide thermal exhaust port on your death star. Except it's probably more like the second Death Star because it's unfinished and there's a gaping hole in the side of it that you can just fly in.
  - MertsA 7y ago
    Nah, that was Chromodo. https://bugs.chromium.org/p/project-zero/issues/detail?id=704 https://bugs.chromium.org/p/project-zero/issues/detail?id=70...

hibbelig 7y ago

> What can a unsandboxed javascript engine do? It can do everything that the user could do, and the user in this case is SYSTEM. I understand SYSTEM can do everything. It could install a keylogger, for instance.

giantDinosaur 7y ago

This runs as SYSTEM, which is the highest privilege set in Windows. Yes, a vulnerability will result in absolutely everything you asked about.

jaclaz 7y ago
To be picky, not the highest privilege, System is prevented from doing things that TrestedInstaller can do. Hence the existence of a number of Windows tools to get TrustedInstaller privileges, some examples listed in this thread: https://msfn.org/board/topic/181190-how-to-overwrite-dll-file-in-system32/ https://msfn.org/board/topic/181190-how-to-overwrite-dll-fil...

jeltz 7y ago

If the js engine has no bugs it cannot do anything harmful, but since this is Avast's own custom engine it likely has security bugs which allow malicious JS code to escape the engine, and if it does it can do virtually anything with your machine since the engine runs as SYSTEM. Writing your own JS engine and then running it as SYSTEM is terrible engineering and very dangerous. There is no reason for why they have to run it as SYSTEM.

tgtweak 7y ago
Has anyone confirmed it is their own? I'd be surprised if it wasn't a shaved-down v8 or similar. Lastly have we confirmed there's no memory or thread protection in place? Most AV reputable AV companies have strong proprietary sandbox code (especially in the scan engine process) which is on par with virtualization in terms of isolation.
- saagarjha 7y ago
  It doesn't look like V8.

gitgud 7y ago

Chrome and Firefox have both continually developed a secure JS engine for over 10 years, and there's still vulnerabilities found in them all the time... Now imagine a company's internal JS implementation without all that engineering effort... vulnerabilities will become apparent immediately

blattimwind 7y ago
An engine like this would likely not implement the hardest bits - JIT and optimization. Many, if not most, vulnerabilities in modern JS engines arise from performance optimizations.

MertsA 7y ago

If there is no vulnerability in the javascript engine or any of the API they exposed to it in order to mockup a web browser then it can't do anything. The problem here is that that's not exactly a tiny attack surface, and modern web browsers implement defense in depth and sandboxing untrusted code for very good reasons. If there was some RCE for a part of this javascript engine, you're not just executing inside of some locked down environment, you're not just executing code as an untrusted user, you're executing code in a process with SYSTEM level permissions. This is like putting a 2 meter wide thermal exhaust port on your death star. On the off chance someone manages to hit it, game over. This process runs untrusted code so if you can get a file opened on the target computer, or even just get the user to go to a malicious website, you can try to attack this. Once you get some payload running yeah you could use bog standard crimeware to sniff out any credit card details entered, export your saved passwords from your web browser, look for any wallet.dat equivalents and run a keylogger waiting for you to decrypt it, drop some ransomware on the system, etc. This gives full control over the system if you find an exploit to it. But yeah, this isn't immediately a vulnerability, just a poor design decision and a very juicy target.

saagarjha 7y ago
> This is like putting a 2 meter wide thermal exhaust port on your death star. Except it's probably more like the second Death Star because it's unfinished and there's a gaping hole in the side of it that you can just fly in.
- MertsA 7y ago
  Nah, that was Chromodo. https://bugs.chromium.org/p/project-zero/issues/detail?id=704 https://bugs.chromium.org/p/project-zero/issues/detail?id=70...