16 ms·

Google Chrome Hacked?

450 points by vinhboy 15y ago

Steko 15y ago
"This code and the technical details of the underlying vulnerabilities will not be publicly disclosed. They are shared exclusively with our Government customers" Love the capital G.
- metageek 15y ago
  It's a standard formation in some publications--e.g., the New York Times.
- Niten 15y ago
  "Big government" in the most literal sense :)
JoachimSchipper 15y ago
> This code and the [...] underlying vulnerabilities will not be publicly disclosed. They are shared exclusively with our Government customers And the vendor, I hope? Of course, we know HBGary was developing private exploits, but it wasn't exactly blogging about them.
- trotsky 15y ago
  I'm not too sure that's the business VUPEN is in. Sure, it doesn't hurt them much to share their latest Safari exploit given how slow Apple is on the fix, but with Google their window has the potential to be very short.
  - tlb 15y ago
    Citation needed for such a serious accusation. They claim to be ethical. From their about page: "VUPEN follows a private responsible disclosure policy and reports all discovered vulnerabilities to the affected vendor under contract with VUPEN, and works with them to create a timetable pursuant to which the vulnerability information may be publicly disclosed."
    - ceejayoz 15y ago
      http://www.vupen.com/english/services/ http://www.vupen.com/english/services/ > As the world leader in vulnerability research, VUPEN Security provides weaponized and highly sophisticated exploits specifically designed for Law Enforcement and Intelligence Agencies to help them achieve their offensive missions using tailored and unique codes created in-house by VUPEN for vulnerabilities discovered by our researchers. Note also the "under contract with VUPEN" part of the disclosure bit.
      - chopsueyar 15y ago
        Law Enforcement and Intelligence Agencies Which countries? It does not specifically state US.
        trotsky 15y ago
        I'm pretty sure they limit their customer base to NATO signatories.
        chopsueyar 15y ago
        Link?
        trotsky 15y ago
        Well, I was close... - Gov. and Law Enforcement Agencies in Countries Members or Partners of NATO, ANZUS or ASEAN http://www.vupen.com/english/services/ba-gov.php http://www.vupen.com/english/services/ba-gov.php
        caf 15y ago
        ASEAN includes such well-known liberal democracies as Burma, Vietnam, Laos and Brunei.
    - dsl 15y ago
      "With 20 to 25 binary analysis and private exploits/PoCs released each month, the VUPEN In-Depth Binary Analysis and Exploits service allows organizations and corporations to evaluate and qualify risks, and protect national infrastructures and corporate assets from emerging attacks." If you are interested in protecting your network, patches and workarounds are your first priority, not "proof of concept" exploits.
sdoowpilihp 15y ago
Whether or not this exploit is impressive, using the term "pwnd" comes across as incredibly unprofessional and predisposes me to perceiving this whole article in a negative light.
- milkshakes 15y ago
  like it or not, it's been vernacular for quite some time. how do you feel about pwn2own? the pwnies?
  - ceejayoz 15y ago
    "Whore" is vernacular, but that doesn't mean the FBI uses the word when they announce they've cracked a prostitution ring.
    - trotsky 15y ago
      Only hiring offensive security vendors who won't use the term 'pwned' is roughly equivalent to trying to purchase a hand job from someone who won't use the term 'whore'. Neither is likely to get you very far.
      - ceejayoz 15y ago
        I'd imagine the high-ends of both professions have higher standards of class and behaviour than the lower-ends.
      - chopsueyar 15y ago
        It's called lingerie modeling.
- what-to-do 15y ago
  About 11 yrs ago I was in a chat room talking to someone, he was using this sort of language, was about 16 years old, told me he sold his security company for millions. Of course I wrote him off. Later he sold another company for 35 millions, and today has another one on the market for 100 millions. That's before 30 years old. We're good friends today, and I learned my lesson. Don't write people off because they sound or look "unprofessional".
gchucky 15y ago
Their site seems to be going down, so here's the text: --- Hi everyone, We are (un)happy to announce that we have officially Pwnd Google Chrome and its sandbox. The exploit shown in this video is one of the most sophisticated codes we have seen and created so far as it bypasses all security features including ASLR/DEP/Sandbox, it is silent (no crash after executing the payload), it relies on undisclosed (0day) vulnerabilities discovered by VUPEN and it works on all Windows systems (32-bit and x64). The video shows the exploit in action with Google Chrome v11.0.696.65 on Microsoft Windows 7 SP1 (x64). The user is tricked into visiting a specially crafted web page hosting the exploit which will execute various payloads to ultimately download the Calculator from a remote location and launch it outside the sandbox at Medium integrity level. Note: The Calculator is used here as an example, it can be replaced by any other payload. While Chrome has one of the most secure sandboxes and has always survived the Pwn2Own contest during the last three years, we have now uncovered a reliable way to execute arbitrary code on any installation of Chrome despite its sandbox, ASLR and DEP. This code and the technical details of the underlying vulnerabilities will not be publicly disclosed. They are shared exclusively with our Government customers as part of our vulnerability research services. The video in question is http://www.youtube.com/watch?feature=player_embedded&v=c8cQ0yU89sk http://www.youtube.com/watch?feature=player_embedded&v=c...
adrianp 15y ago
I can understand their joy but the last sentence in the post and the Twitter update: "Sorry Google...we have officially pwned Google Chrome and its sandbox with a 0-Day." [1] seem rather unprofessional for the "world leader in vulnerability research for defensive and offensive security" [2], a company with "Government customers". [1] https://twitter.com/VUPEN https://twitter.com/VUPEN [2] http://www.vupen.com/english/company.php http://www.vupen.com/english/company.php
- burgerbrain 15y ago
  Who cares if they sound unprofessional to you? Very obviously they produce.
  - blocke 15y ago
    "Who cares if they sound unprofessional to you? Very obviously they produce." Sadly we can't verify that in this case. Because you know, we're not the CIA.
    - sswam 15y ago
      VUPEN cracks Chrome for the Government!!!!! On Windoze, even! I would have thought if they really had a US govt / CIA / military / espionage customer, said customer would NOT want them to reveal ANYTHING about the exploit to Google nor the public, especially not its existance. So, they told us that there is an exploit, and now it's top hax0r news, might likely feature in mainstream news. Most sensible people will most likely hear of it, and will disable flash / plugins in chrome until someone fixes it. Any worthy target for netspionage with any money and brain will hear about it immediately, and quit using chrome for lynx, dillo, or something even simpler. Anyone who uses such a large app as a modern over-engineered web HTML5 bugzilla-feeding browser is kissing security goodbye forever. GNU ls(1) may have security bugs FFS, do you think your browser doens't? Do they include Chrome or Firefox in the 'pretty secure' OpenBSD base install? No, no, they do not nor never will do this, although it is a most popular app!! (also because nearly all *BSD boxes become servers, but you get my drift.) Even if Chrome were regarded as an essential system service for every box to run, they would NOT include it! better the system grind to a halt by itself without yielding access. Google will redouble Chrome's general security and sandbox security in a push-patch, and this will most likely break the hack. Or they will rediscover it. LOL at your short-lived hack, your Government _will_ be pleased that you disrespected their payment and trust, boasting about it everywhere, putting Google and their targets on red-alert. The 'secret black ops' part of Government would not only be displeased, they would kick their ass so damn hard for revealing that there is an exploit, that they would not be able to discover more exploits for years due to severe ass damage pain. They pay you to learn stuff so we can do espionage or whatever fuckdoggery they might be intending at poor Arab countries to steal their oil, or suchlike... Then this silly idiot hacker company posts 'woohoo we found an exploit, look at us: but we can't tell you how it works - 'tis just for our pals in the govt'. Then the presumably nasty branch of govt gets out the concrete mixer and applies the concrete slippers - national borders not being much of an obstacle - then tosses the talkative hackers into the middle of the pacific trench (there's deep water there). They are then eaten by those nasty deep-sea fish with big teeth, and lights on stalks to freak us out. So anyway, this 'half-secret hack' business reeks deeply of bullshit to me. For some real bullshit, forget everything else I said. Windows is the utter pinnacle of bullshit for security, full stop. I understand that certain few idiots among the population do use it for playing games, and watching porn, and trying to be hackers, and in offices, but seriously: if you use Windows, any edition of Windows, for your own security, you obviously have not a clue nor give a real fuck about your security at all. Your password is probably 'dog' or 'cat'. OS X and Linux are barely any better for security. If you want real security, throw away all the public and commodity crap operating systems and build your own. Or pay someone smart to build it. If it takes you less than 5 years to debug it before deployment, or it's more than 100KB of code in total size, I guess you failed: it's not secure. I'll give you a hint. Every process in the system should have access to precisely nothing by default. Not even the CPU, not even the time of day. Every single resource that is needed must be introduced to the process's environment by a neighbor or parent process (if possible, and in most cases it should not be). The entire system, especially process / resource structure, privilege and connection must be visible as a nested, nodes-and-arcs graph, for the user / sysop to verify and check what the hell is going on in it. If there's no link from Chrome to your printer, and you've disabled changes to that part of the process structure, Chrome will not ever print anything unless there's a solar storm - or similar stimulus - that miraculously alters everything without crashing it. You ANTICIPATED THAT UNLIKELY EVENT, and made 3 or 4 systems running everying exactly the same, in parallel, in sync at each step. If one screws up due to solar fuckdoggery, throw it in the bin and swap in another (like RAID). They do this shit in planes I believe, not the swap in bit, until it lands. The solar demons won't miraculously pseudo-break them all at once in the SAME WAY. Windows, Microsoft, Security - can you spot the odd one out? Can you see a juxtaposition here folks? Can you feel it? A disturbance ripples through the force, out through the local cluster (of galaxies) and back, because those three words were collected together in one place. No amount of ill-acquired M$ money spent on Windoze security enhancements can break their appallingly bad track record for security holes, loss of privacy, and the happy virus cultivation ecosystems that Microsoft has consistently provided over the years with every version of Windows, almost from before viruses were invented. I think the first well-made and famous exploit came well before windows was conceived, I'd suggest Ken's cc hack. That's the first brilliant exploit I happen to know about - from the vendor himself, sly bastard. It's hard to believe he didn't go to jail for that, anyway, heh. So yeah - VUPEN, Chrome, Windoze, haX0Rz working for the Big-G Government. LOL. Security Jokes all around. Chrome being the more respectable and secure among them in my opinion. And anyone who runs a nuclear reactor that depends for its stability or continued safe operation on a computer is a cow-tipping idiot too. Cars don't even. @stuxnet @.mil
jlgosse 15y ago
Not saying this isn't true, as I'm sure VUPEN is quite legit, but what stops me from creating a keyboard shortcut to calculator.exe, opening a random website which loads for a few seconds, and then pressing ctrl+alt+f6 or something to open calculator?
- ZeSmith 15y ago
  Considering the business they're in, I'm not sure lying about that would be a good idea.
- djb_hackernews 15y ago
  I'm willing to bet any of their Government customers wouldn't be able to confirm the exploit anyhow. Seems like an easy way to keep a lucrative Government contract...
- noodle 15y ago
  nothing; nor does anything stop you from doctoring video. but it doesn't seem like faking this would be very beneficial for anyone involved.
- trotsky 15y ago
  Nothing keeps you from doing it, their reputation keeps them from doing it.
- coliveira 15y ago
  If you're sure it is quite legit, why are you suggesting this? It is similar to what news networks do by adding a quotation mark to something they know is false just to suggest something they want to be true.
thedeuce 15y ago
Lies; Lets see code or it never happened.
lojack 15y ago
its times like these (among others) that makes me happy my browser automatically updates behind the scenes
- llambda 15y ago
  That works as long as the exploit is known. What happens when it's not?
  - trotsky 15y ago
    It gets exploited automatically behind the scenes.
  - lojack 15y ago
    same thing that happens when an exploit is found for a browser that doesn't automatically update
    - llambda 15y ago
      Which I suppose begs the question: Are automatic updates the silver bullet they seem to be sold as? I don't unequivocally disagree with them, or rather I disagree with them, but based on principle. In practice, it seems easy to argue that the benefits outweigh the arguments against. Still it'd be nice if there were at least an option to turn off the updates. (Perhaps there is and I've missed it in the settings?) Nonetheless for the time being I'll stick with my old fashioned browser, just because I'm a kind of a geek that prefers to initiative his own updates.
mef 15y ago
seems odd to me that they don't publicly disclose the vulnerabilities, but they do publicly disclose the software versions affected by their "weaponized exploits", thereby giving the heads up to whomever might be targeted to avoid using that newly compromised software.
- trotsky 15y ago
  If you're selling a product you have to get the word out somehow.
- chromic 15y ago
  I think the version disclosure here was less of a "This version has a bug" and more of a "The latest version has a bug." It's a lot safer to tell people which haystack the needle is in than to give away the needle anyway.
calloc 15y ago
Unless Google is one of their customers it may actually be a little while before this exploit is fixed. VUPEN does security research and doesn't disclose to original vendors unless they happen to be customers. I both love and hate them. They are extremely talented and find absolutely awesome bugs that are hard to discover without a lot of work, and I hate them because they don't disclose their work unless it is for money. While I can understand that they have to make a living too, it just feels wrong to not protect everyone in the world when possible.
- xutopia 15y ago
  The reality is that there is probably no chance that they would ever find these bugs if they weren't funded to do it and the only way to be funded is to have customers. The net result is probably safer software for all.
  - alanh 15y ago
    The net result in this case is the government owning a zero-day root exploit for every Chrome/Win citizen’s computer. It’s worse than zero-day because we have no reason to expect a patch, so the window of attack will stay open.
    - kin 15y ago
      Out of speculation, would this tie in at all to an article I saw on HN a while back about the Government hiring 3rd parties to hack Google for some reason?
      - GrandMasterBirt 15y ago
        Is it wrong for our government to do any security research? I mean can good things not come out of it? Be thankful it was reported.
        kin 15y ago
        I never said if anything was right or wrong, nor did I assume any of it, I just asked if it was related. Good to know curiosity gets flagged around here.
rheide 15y ago
vupen: "Hey Google, your browser has a very nasty bug that allows for potentially horrible things to happen. We thought we'd share that with the world. If you'd like to know where it is though, you'd better give us money."
- lawnchair_larry 15y ago
  Why not? This is highly specialized research that not even well-paid Google employees were able to do. This is actually quite common in recent years for bug hunters and exploit developers. I can think of a dozen or so companies that do the same thing. Immunity is another example. Trying to use a moral argument to get out of compensating someone when you have the resources to do so is shameful. Sorry, but this stuff is worth far more than the (up to) $3133 they are offering. No More Free Bugs, as they say. They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally. Fair is fair. There is no reason this isn't worth compensating but something like pagerank optimizations is.
  - blocke 15y ago
    "They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally." What makes you think they don't already? You make it sound like Google doesn't give a shit about security. That clearly isn't the case.
    - tptacek 15y ago
      Google employs several of the best well-known security researchers in the world, and no doubt many more that we haven't heard much about. That doesn't mean they're going to find everything, though. At the end of the day, private companies are perfectly within their rights to do offensive research against Google products, to be selective about how they disclose their results, and to tell the public whatever they want about those results. As long as they aren't lying, there's nothing unethical about it.
  - 15y ago
deleted 15y ago
[deleted]
- blocke 15y ago
  "Dear Google Employees reading HN: This exploit, along with VUPEN's affiliation to goverment agencies, scared the crap out of me. Having used Chrome since it's earliest days, I'm now forced to switch my main browser to FF4; it remains so until confirmation from either parties of the bug's "fixed" status." I think it's time for you to take your computer out back and set it on fire. Best way to be safe until Google fixes this. Whatever it is. If you think there isn't an active 0-day against Firefox or IE or Safari or... oh boy. This is news because such things are rare against Chrome. Welcome to software.
- ramidarigaz 15y ago
  I doubt FF4 is more secure than Chrome.
  - guelo 15y ago
    On what basis have you formed this doubt?
    - deleted 15y ago
      [deleted]
    - guelo 15y ago
      WTF, I ask someone why they consider one browser more secure than another and I get downvoted, what's wrong with the question?
phaet0n 15y ago
I wonder if this is a sandboxing issue with NaCL, which is I noticed was added (default disabled) in Chrome 11. Considering how non specific VUPEN are, I wouldn't be surprised if they're hiding this.
- tlrobinson 15y ago
  Sounds like it's Windows only, so I'd expect it to be related to the Windows sandboxing.
  - Niten 15y ago
    Well clearly there are two things going on here, assuming VUPEN is on the level: 1) A remote code execution exploit in Chrome 2) A privilege elevation exploit allowing the hijacked browser process to break out of its mandatory access control jail Number 1 is of necessity a bug in Chrome itself (or a plugin). Number 2 is probably a vulnerability in the Windows sandbox, but it could instead be that they found a way to successfully attack the small part of Chrome that runs outside low integrity mode. They weren't specific as to the details. This is, again, at the very least a remote code execution hole in Chrome, and there's no fundamental reason Linux or OS X should be invulnerable to the same hole. That Chrome on Windows is less secure than on Linux or OS X would be the wrong thing to take from this; the point of this demo is that VUPEN accomplished the feat of bypassing all the security mechanisms protecting Chrome on Windows, whereas on the other platforms you have fewer of these mechanisms in the first place (no real ASLR on OS X, no Chrome sandboxing last time I checked on Linux).
vanni 15y ago
Oh my lonely Linux desktop, no 0-day for you as usual :P
krupan 15y ago
"it works on all Windows systems (32-bit and x64)" They didn't say that the exploit didn't work on Mac or Linux, but one can only assume they tested those and weren't successful?
- Niten 15y ago
  I wouldn't assume that. I think the big deal here is that they managed to break out of the Windows sandbox; that's what makes the exploit particularly interesting. The same vulnerability could exist on Linux too, but they just didn't invest the time in developing and demoing an exploit there too. Or maybe not. I'm just saying, we can't assume either way.
jff 15y ago
I'd like to mention something to everyone running around crying about the falling sky because THE GUBBMINT has paid a security company to audit Chrome. Oak Ridge National Labs just recently had to shut down COMPLETELY because an Internet Explorer exploit "pwned" them. Do you maybe see how THE GUBBMINT might be interested in knowing if other browsers, such as Chrome, are as vulnerable? But by all means, put on your tinfoil hats if that's more fun.
SriniK 15y ago
Looking at the video and time it took to launch the calc.exe, it could be pdf/flash exploit that they are using. Process count in process explorer started with 5 and at the end of the demo, it looked like they have 8. That tells there are 2 extra processes that are created (discounting 1 for calc.exe). I tried to see if pdf/flash creates new processes but I couldn't verify. Perhaps a chrome developer could get a clue about what is happening looking at the video.
- Osiris 15y ago
  They are obviously hiding something. When they flip back to Process Explorer, Chrome is perfectly sized to cover everything in the window except the calc.exe. My guess is there are other processes running that they're trying to hide that were used in the exploit.
  - deleted 15y ago
    [deleted]
  - dnewcome 15y ago
    It would have been trivial for them to patch Process Explorer to hide whatever they wanted anyway.
    - est 15y ago
      Nah, the vupen marketing guys are too lazy to patch it.
fragsworth 15y ago
A video of calculator showing up after clicking a link hardly constitutes proof of an exploit. Considering the fact that they aren't going to publish the exploit, I just want to point out that this kind of thing could easily be fabricated. There are plenty of interests that benefit from unfortunate news about their competitors.
- kiiski 15y ago
  What would those "plenty of interests" be in this case?
trololo 15y ago
does anyone know how much vupen charges for their exploits, on average?
flipbrad 15y ago
To what extent is this extortion? I mean, they have admitted to only selling to a government. That means they find and exploit vulnerabilities in software created by a private corporation, disclose the existence of a vulnerability publicly, but don't allow the corporate body the means of fixing it. This news, if publicised, would harm Google's reputation and goodwill, perhaps non-negligibly, and cause users to switch products. Unless, of course, Google outbids a government. Pay up or suffer - would this be extortion?
- sswam 15y ago
  I don't believe this crappy little security firm has more resources than Google, even in the Security Research Dept. They can go find it themselves and fix it. Anyway, it's probably mostly a windows bug. If you line the right bytes up together in windows' RAM, it will void itself and yield 'root' or whatever wiener name they have for it. Who knows, maybe they Govt is trying to screw google, and told them to do a fake release. Their post doesn't make them sound like real pros.
jsprinkles 15y ago
This video is extremely suspicious to the point of probably being an outright lie. I would wager money that this vulnerability is a Flash exploit sold as a Chrome exploit. It is not an accident that they hid Process Explorer after the exploit. They closed it before minimizing everything else intentionally. If you do not believe me follow the mouse pointer. The screencaster moved toward bringing Process Explorer top-level at 0:56 then realized it would show the entire thing and restored Chrome on top of it instead. With that in mind it is obvious that they do not want you to see what changed when it ran so instead we have to work with what is visible: Process Explorer before: http://i.imgur.com/e31Rb.png http://i.imgur.com/e31Rb.png Process Explorer after: http://i.imgur.com/JfPTY.png http://i.imgur.com/JfPTY.png First item of interest is that Chrome shot up to over 400 MB of memory used which indicates that Flash is almost certainly involved. Second, observe how long it takes for Calculator to start. Again, consistent with Flash being involved and Chrome delay-loading it. Third, there are scroll bars on the tab. Big ones. This says there is an invisible item on the page taking up a lot of space which again points to Flash. I saved the exact same content to a file and look how small I can go without scroll bars: http://i.imgur.com/R0eqk.png http://i.imgur.com/R0eqk.png Fourth, flip back side by side through each photo and notice what disappears. The Windows search indexer disappears between screenshot A and B and this is what Vupen is intentionally covering up. You can still observe it indirectly based on the rows and colors at right. It is my understanding that the child processes of SearchIndexer.exe run at all times and not as some kind of cron but I do not use Windows so please correct me if I am wrong. At any rate they do disappear between A and B. It would be very intelligent of them to blog post this as a Chrome sandbox bust (which is sort of newsworthy) and gain that link bait attention but, privately, use the exploit as the Flash and Windows vulnerability it most likely is.
- bonch 15y ago
  > First item of interest is that Chrome shot up to over 400 MB of memory used which indicates that Flash is almost certainly involved. Is this really the basis of your claim? A complete guess that a 400MB increase in memory must be due to a secret use of Flash?
  - jsprinkles 15y ago
ryanclemson 15y ago
The two things I noticed were that 1) The user of the device is named "IAmAdmin", implying that they have admin rights, and 2) The "integrity" of chrome.exe is changed from Low to Medium at somepoint during the attack. Could this somehow be related to breaking out of the sandbox?
watty 15y ago
This seems extremely unethical to me. Now that the world knows there is massive exploit in Chrome, there are bound to be more hackers attempting to abuse it - and have a few hints from the video. By blogging about this and not disclosing it to Google, they are actually increasing the risk of millions of individuals and companies being hacked. Edit: Then again, blogging about it also makes Google aware of the exploit. I'm sure they have tons of resources working on it that wouldn't have otherwise...
comex 15y ago
Impressive, but not surprising. Chrome isn't magical; ASLR and DEP have been bypassed in the past, and even if its own sandbox is perfect, the kernel it's sitting under is a huge attack surface.
- daeken 15y ago
  ASLR and DEP, by and large, have nothing to do with the kernel. ASLR is a function of the binary loader and memory allocators, which are in userland. DEP is a function of userland memory protection flags (they're handled on the bare metal by the kernel, but the kernel just sets what it's told to by the userland). I'd put any amount of money down on the table that there is no kernel vulnerability here at all -- if there was one, I assure you that it'd be more than a Chrome vuln.
  - comex 15y ago
    I know; my comments about ASLR/DEP and the kernel were intended to be separate. As for whether there's a kernel vulnerability, I'll defer to you (although it doesn't have to be full-fledged arbitrary code execution; it can just be a system call that's lax about security tokens), but in general the breadth of kernel code the renderers can access is pretty large.
podperson 15y ago
So assuming this is for real they're going to tell the government so it can pwn us but not tell Google so it can fix it.
bOR_ 15y ago
So, can google put a patch in Chrome that whenever it runs at VUPEN, everything VUPEN has on that computer is shipped over to Google? :-). Google has/had the 'do no evil' in their philosophy, and disabling a scheme that misuses their software for cyber-warfare sounds like a good thing.
mdpm 15y ago
the video is edited, right about when he's showing process explorer post-exploit. the cursor suddenly leaps across the screen, so assuming they're covering up the other child process of the main chrome process is fair. strangely, process explorer's 'process count' only goes up by 1, despite launching calc, and (seemingly) another child process. To be over-zealous, the single row of visible pixels for that other process is consistent with rundll32.exe. That still doesn't mean that it's not a chrome bug - the exploit may use flash to retrieve the payload, make use of flash-js communication, flash-chrome communication quirks etc.

450 points by vinhboy 15y ago

Steko 15y ago

"This code and the technical details of the underlying vulnerabilities will not be publicly disclosed. They are shared exclusively with our Government customers" Love the capital G.

metageek 15y ago
It's a standard formation in some publications--e.g., the New York Times.
Niten 15y ago
"Big government" in the most literal sense :)

JoachimSchipper 15y ago

> This code and the [...] underlying vulnerabilities will not be publicly disclosed. They are shared exclusively with our Government customers And the vendor, I hope? Of course, we know HBGary was developing private exploits, but it wasn't exactly blogging about them.

trotsky 15y ago
I'm not too sure that's the business VUPEN is in. Sure, it doesn't hurt them much to share their latest Safari exploit given how slow Apple is on the fix, but with Google their window has the potential to be very short.
- tlb 15y ago
  Citation needed for such a serious accusation. They claim to be ethical. From their about page: "VUPEN follows a private responsible disclosure policy and reports all discovered vulnerabilities to the affected vendor under contract with VUPEN, and works with them to create a timetable pursuant to which the vulnerability information may be publicly disclosed."
  - ceejayoz 15y ago
    http://www.vupen.com/english/services/ http://www.vupen.com/english/services/ > As the world leader in vulnerability research, VUPEN Security provides weaponized and highly sophisticated exploits specifically designed for Law Enforcement and Intelligence Agencies to help them achieve their offensive missions using tailored and unique codes created in-house by VUPEN for vulnerabilities discovered by our researchers. Note also the "under contract with VUPEN" part of the disclosure bit.
    - chopsueyar 15y ago
      Law Enforcement and Intelligence Agencies Which countries? It does not specifically state US.
      - trotsky 15y ago
        I'm pretty sure they limit their customer base to NATO signatories.
        chopsueyar 15y ago
        Link?
        trotsky 15y ago
        Well, I was close... - Gov. and Law Enforcement Agencies in Countries Members or Partners of NATO, ANZUS or ASEAN http://www.vupen.com/english/services/ba-gov.php http://www.vupen.com/english/services/ba-gov.php
        caf 15y ago
        ASEAN includes such well-known liberal democracies as Burma, Vietnam, Laos and Brunei.
  - dsl 15y ago
    "With 20 to 25 binary analysis and private exploits/PoCs released each month, the VUPEN In-Depth Binary Analysis and Exploits service allows organizations and corporations to evaluate and qualify risks, and protect national infrastructures and corporate assets from emerging attacks." If you are interested in protecting your network, patches and workarounds are your first priority, not "proof of concept" exploits.

sdoowpilihp 15y ago

Whether or not this exploit is impressive, using the term "pwnd" comes across as incredibly unprofessional and predisposes me to perceiving this whole article in a negative light.

milkshakes 15y ago
like it or not, it's been vernacular for quite some time. how do you feel about pwn2own? the pwnies?
- ceejayoz 15y ago
  "Whore" is vernacular, but that doesn't mean the FBI uses the word when they announce they've cracked a prostitution ring.
  - trotsky 15y ago
    Only hiring offensive security vendors who won't use the term 'pwned' is roughly equivalent to trying to purchase a hand job from someone who won't use the term 'whore'. Neither is likely to get you very far.
    - ceejayoz 15y ago
      I'd imagine the high-ends of both professions have higher standards of class and behaviour than the lower-ends.
    - chopsueyar 15y ago
      It's called lingerie modeling.
what-to-do 15y ago
About 11 yrs ago I was in a chat room talking to someone, he was using this sort of language, was about 16 years old, told me he sold his security company for millions. Of course I wrote him off. Later he sold another company for 35 millions, and today has another one on the market for 100 millions. That's before 30 years old. We're good friends today, and I learned my lesson. Don't write people off because they sound or look "unprofessional".

gchucky 15y ago

Their site seems to be going down, so here's the text: --- Hi everyone, We are (un)happy to announce that we have officially Pwnd Google Chrome and its sandbox. The exploit shown in this video is one of the most sophisticated codes we have seen and created so far as it bypasses all security features including ASLR/DEP/Sandbox, it is silent (no crash after executing the payload), it relies on undisclosed (0day) vulnerabilities discovered by VUPEN and it works on all Windows systems (32-bit and x64). The video shows the exploit in action with Google Chrome v11.0.696.65 on Microsoft Windows 7 SP1 (x64). The user is tricked into visiting a specially crafted web page hosting the exploit which will execute various payloads to ultimately download the Calculator from a remote location and launch it outside the sandbox at Medium integrity level. Note: The Calculator is used here as an example, it can be replaced by any other payload. While Chrome has one of the most secure sandboxes and has always survived the Pwn2Own contest during the last three years, we have now uncovered a reliable way to execute arbitrary code on any installation of Chrome despite its sandbox, ASLR and DEP. This code and the technical details of the underlying vulnerabilities will not be publicly disclosed. They are shared exclusively with our Government customers as part of our vulnerability research services. The video in question is http://www.youtube.com/watch?feature=player_embedded&v=c8cQ0yU89sk http://www.youtube.com/watch?feature=player_embedded&v=c...

adrianp 15y ago

I can understand their joy but the last sentence in the post and the Twitter update: "Sorry Google...we have officially pwned Google Chrome and its sandbox with a 0-Day." [1] seem rather unprofessional for the "world leader in vulnerability research for defensive and offensive security" [2], a company with "Government customers". [1] https://twitter.com/VUPEN https://twitter.com/VUPEN [2] http://www.vupen.com/english/company.php http://www.vupen.com/english/company.php

burgerbrain 15y ago
Who cares if they sound unprofessional to you? Very obviously they produce.
- blocke 15y ago
  "Who cares if they sound unprofessional to you? Very obviously they produce." Sadly we can't verify that in this case. Because you know, we're not the CIA.
  - sswam 15y ago
    VUPEN cracks Chrome for the Government!!!!! On Windoze, even! I would have thought if they really had a US govt / CIA / military / espionage customer, said customer would NOT want them to reveal ANYTHING about the exploit to Google nor the public, especially not its existance. So, they told us that there is an exploit, and now it's top hax0r news, might likely feature in mainstream news. Most sensible people will most likely hear of it, and will disable flash / plugins in chrome until someone fixes it. Any worthy target for netspionage with any money and brain will hear about it immediately, and quit using chrome for lynx, dillo, or something even simpler. Anyone who uses such a large app as a modern over-engineered web HTML5 bugzilla-feeding browser is kissing security goodbye forever. GNU ls(1) may have security bugs FFS, do you think your browser doens't? Do they include Chrome or Firefox in the 'pretty secure' OpenBSD base install? No, no, they do not nor never will do this, although it is a most popular app!! (also because nearly all *BSD boxes become servers, but you get my drift.) Even if Chrome were regarded as an essential system service for every box to run, they would NOT include it! better the system grind to a halt by itself without yielding access. Google will redouble Chrome's general security and sandbox security in a push-patch, and this will most likely break the hack. Or they will rediscover it. LOL at your short-lived hack, your Government _will_ be pleased that you disrespected their payment and trust, boasting about it everywhere, putting Google and their targets on red-alert. The 'secret black ops' part of Government would not only be displeased, they would kick their ass so damn hard for revealing that there is an exploit, that they would not be able to discover more exploits for years due to severe ass damage pain. They pay you to learn stuff so we can do espionage or whatever fuckdoggery they might be intending at poor Arab countries to steal their oil, or suchlike... Then this silly idiot hacker company posts 'woohoo we found an exploit, look at us: but we can't tell you how it works - 'tis just for our pals in the govt'. Then the presumably nasty branch of govt gets out the concrete mixer and applies the concrete slippers - national borders not being much of an obstacle - then tosses the talkative hackers into the middle of the pacific trench (there's deep water there). They are then eaten by those nasty deep-sea fish with big teeth, and lights on stalks to freak us out. So anyway, this 'half-secret hack' business reeks deeply of bullshit to me. For some real bullshit, forget everything else I said. Windows is the utter pinnacle of bullshit for security, full stop. I understand that certain few idiots among the population do use it for playing games, and watching porn, and trying to be hackers, and in offices, but seriously: if you use Windows, any edition of Windows, for your own security, you obviously have not a clue nor give a real fuck about your security at all. Your password is probably 'dog' or 'cat'. OS X and Linux are barely any better for security. If you want real security, throw away all the public and commodity crap operating systems and build your own. Or pay someone smart to build it. If it takes you less than 5 years to debug it before deployment, or it's more than 100KB of code in total size, I guess you failed: it's not secure. I'll give you a hint. Every process in the system should have access to precisely nothing by default. Not even the CPU, not even the time of day. Every single resource that is needed must be introduced to the process's environment by a neighbor or parent process (if possible, and in most cases it should not be). The entire system, especially process / resource structure, privilege and connection must be visible as a nested, nodes-and-arcs graph, for the user / sysop to verify and check what the hell is going on in it. If there's no link from Chrome to your printer, and you've disabled changes to that part of the process structure, Chrome will not ever print anything unless there's a solar storm - or similar stimulus - that miraculously alters everything without crashing it. You ANTICIPATED THAT UNLIKELY EVENT, and made 3 or 4 systems running everying exactly the same, in parallel, in sync at each step. If one screws up due to solar fuckdoggery, throw it in the bin and swap in another (like RAID). They do this shit in planes I believe, not the swap in bit, until it lands. The solar demons won't miraculously pseudo-break them all at once in the SAME WAY. Windows, Microsoft, Security - can you spot the odd one out? Can you see a juxtaposition here folks? Can you feel it? A disturbance ripples through the force, out through the local cluster (of galaxies) and back, because those three words were collected together in one place. No amount of ill-acquired M$ money spent on Windoze security enhancements can break their appallingly bad track record for security holes, loss of privacy, and the happy virus cultivation ecosystems that Microsoft has consistently provided over the years with every version of Windows, almost from before viruses were invented. I think the first well-made and famous exploit came well before windows was conceived, I'd suggest Ken's cc hack. That's the first brilliant exploit I happen to know about - from the vendor himself, sly bastard. It's hard to believe he didn't go to jail for that, anyway, heh. So yeah - VUPEN, Chrome, Windoze, haX0Rz working for the Big-G Government. LOL. Security Jokes all around. Chrome being the more respectable and secure among them in my opinion. And anyone who runs a nuclear reactor that depends for its stability or continued safe operation on a computer is a cow-tipping idiot too. Cars don't even. @stuxnet @.mil

jlgosse 15y ago

Not saying this isn't true, as I'm sure VUPEN is quite legit, but what stops me from creating a keyboard shortcut to calculator.exe, opening a random website which loads for a few seconds, and then pressing ctrl+alt+f6 or something to open calculator?

ZeSmith 15y ago
Considering the business they're in, I'm not sure lying about that would be a good idea.
djb_hackernews 15y ago
I'm willing to bet any of their Government customers wouldn't be able to confirm the exploit anyhow. Seems like an easy way to keep a lucrative Government contract...
noodle 15y ago
nothing; nor does anything stop you from doctoring video. but it doesn't seem like faking this would be very beneficial for anyone involved.
trotsky 15y ago
Nothing keeps you from doing it, their reputation keeps them from doing it.
coliveira 15y ago
If you're sure it is quite legit, why are you suggesting this? It is similar to what news networks do by adding a quotation mark to something they know is false just to suggest something they want to be true.

thedeuce 15y ago

Lies; Lets see code or it never happened.

lojack 15y ago

its times like these (among others) that makes me happy my browser automatically updates behind the scenes

llambda 15y ago
That works as long as the exploit is known. What happens when it's not?
- trotsky 15y ago
  It gets exploited automatically behind the scenes.
- lojack 15y ago
  same thing that happens when an exploit is found for a browser that doesn't automatically update
  - llambda 15y ago
    Which I suppose begs the question: Are automatic updates the silver bullet they seem to be sold as? I don't unequivocally disagree with them, or rather I disagree with them, but based on principle. In practice, it seems easy to argue that the benefits outweigh the arguments against. Still it'd be nice if there were at least an option to turn off the updates. (Perhaps there is and I've missed it in the settings?) Nonetheless for the time being I'll stick with my old fashioned browser, just because I'm a kind of a geek that prefers to initiative his own updates.

mef 15y ago

seems odd to me that they don't publicly disclose the vulnerabilities, but they do publicly disclose the software versions affected by their "weaponized exploits", thereby giving the heads up to whomever might be targeted to avoid using that newly compromised software.

trotsky 15y ago
If you're selling a product you have to get the word out somehow.
chromic 15y ago
I think the version disclosure here was less of a "This version has a bug" and more of a "The latest version has a bug." It's a lot safer to tell people which haystack the needle is in than to give away the needle anyway.

calloc 15y ago

Unless Google is one of their customers it may actually be a little while before this exploit is fixed. VUPEN does security research and doesn't disclose to original vendors unless they happen to be customers. I both love and hate them. They are extremely talented and find absolutely awesome bugs that are hard to discover without a lot of work, and I hate them because they don't disclose their work unless it is for money. While I can understand that they have to make a living too, it just feels wrong to not protect everyone in the world when possible.

xutopia 15y ago
The reality is that there is probably no chance that they would ever find these bugs if they weren't funded to do it and the only way to be funded is to have customers. The net result is probably safer software for all.
- alanh 15y ago
  The net result in this case is the government owning a zero-day root exploit for every Chrome/Win citizen’s computer. It’s worse than zero-day because we have no reason to expect a patch, so the window of attack will stay open.
  - kin 15y ago
    Out of speculation, would this tie in at all to an article I saw on HN a while back about the Government hiring 3rd parties to hack Google for some reason?
    - GrandMasterBirt 15y ago
      Is it wrong for our government to do any security research? I mean can good things not come out of it? Be thankful it was reported.
      - kin 15y ago
        I never said if anything was right or wrong, nor did I assume any of it, I just asked if it was related. Good to know curiosity gets flagged around here.

rheide 15y ago

vupen: "Hey Google, your browser has a very nasty bug that allows for potentially horrible things to happen. We thought we'd share that with the world. If you'd like to know where it is though, you'd better give us money."

lawnchair_larry 15y ago
Why not? This is highly specialized research that not even well-paid Google employees were able to do. This is actually quite common in recent years for bug hunters and exploit developers. I can think of a dozen or so companies that do the same thing. Immunity is another example. Trying to use a moral argument to get out of compensating someone when you have the resources to do so is shameful. Sorry, but this stuff is worth far more than the (up to) $3133 they are offering. No More Free Bugs, as they say. They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally. Fair is fair. There is no reason this isn't worth compensating but something like pagerank optimizations is.
- blocke 15y ago
  "They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally." What makes you think they don't already? You make it sound like Google doesn't give a shit about security. That clearly isn't the case.
  - tptacek 15y ago
    Google employs several of the best well-known security researchers in the world, and no doubt many more that we haven't heard much about. That doesn't mean they're going to find everything, though. At the end of the day, private companies are perfectly within their rights to do offensive research against Google products, to be selective about how they disclose their results, and to tell the public whatever they want about those results. As long as they aren't lying, there's nothing unethical about it.
- 15y ago

deleted 15y ago

[deleted]

blocke 15y ago
"Dear Google Employees reading HN: This exploit, along with VUPEN's affiliation to goverment agencies, scared the crap out of me. Having used Chrome since it's earliest days, I'm now forced to switch my main browser to FF4; it remains so until confirmation from either parties of the bug's "fixed" status." I think it's time for you to take your computer out back and set it on fire. Best way to be safe until Google fixes this. Whatever it is. If you think there isn't an active 0-day against Firefox or IE or Safari or... oh boy. This is news because such things are rare against Chrome. Welcome to software.
ramidarigaz 15y ago
I doubt FF4 is more secure than Chrome.
- guelo 15y ago
  On what basis have you formed this doubt?
  - deleted 15y ago
    [deleted]
  - guelo 15y ago
    WTF, I ask someone why they consider one browser more secure than another and I get downvoted, what's wrong with the question?

phaet0n 15y ago

I wonder if this is a sandboxing issue with NaCL, which is I noticed was added (default disabled) in Chrome 11. Considering how non specific VUPEN are, I wouldn't be surprised if they're hiding this.

tlrobinson 15y ago
Sounds like it's Windows only, so I'd expect it to be related to the Windows sandboxing.
- Niten 15y ago
  Well clearly there are two things going on here, assuming VUPEN is on the level: 1) A remote code execution exploit in Chrome 2) A privilege elevation exploit allowing the hijacked browser process to break out of its mandatory access control jail Number 1 is of necessity a bug in Chrome itself (or a plugin). Number 2 is probably a vulnerability in the Windows sandbox, but it could instead be that they found a way to successfully attack the small part of Chrome that runs outside low integrity mode. They weren't specific as to the details. This is, again, at the very least a remote code execution hole in Chrome, and there's no fundamental reason Linux or OS X should be invulnerable to the same hole. That Chrome on Windows is less secure than on Linux or OS X would be the wrong thing to take from this; the point of this demo is that VUPEN accomplished the feat of bypassing all the security mechanisms protecting Chrome on Windows, whereas on the other platforms you have fewer of these mechanisms in the first place (no real ASLR on OS X, no Chrome sandboxing last time I checked on Linux).

vanni 15y ago

Oh my lonely Linux desktop, no 0-day for you as usual :P

krupan 15y ago

"it works on all Windows systems (32-bit and x64)" They didn't say that the exploit didn't work on Mac or Linux, but one can only assume they tested those and weren't successful?

Niten 15y ago
I wouldn't assume that. I think the big deal here is that they managed to break out of the Windows sandbox; that's what makes the exploit particularly interesting. The same vulnerability could exist on Linux too, but they just didn't invest the time in developing and demoing an exploit there too. Or maybe not. I'm just saying, we can't assume either way.

jff 15y ago

I'd like to mention something to everyone running around crying about the falling sky because THE GUBBMINT has paid a security company to audit Chrome. Oak Ridge National Labs just recently had to shut down COMPLETELY because an Internet Explorer exploit "pwned" them. Do you maybe see how THE GUBBMINT might be interested in knowing if other browsers, such as Chrome, are as vulnerable? But by all means, put on your tinfoil hats if that's more fun.

SriniK 15y ago

Looking at the video and time it took to launch the calc.exe, it could be pdf/flash exploit that they are using. Process count in process explorer started with 5 and at the end of the demo, it looked like they have 8. That tells there are 2 extra processes that are created (discounting 1 for calc.exe). I tried to see if pdf/flash creates new processes but I couldn't verify. Perhaps a chrome developer could get a clue about what is happening looking at the video.

Osiris 15y ago
They are obviously hiding something. When they flip back to Process Explorer, Chrome is perfectly sized to cover everything in the window except the calc.exe. My guess is there are other processes running that they're trying to hide that were used in the exploit.
- deleted 15y ago
  [deleted]
- dnewcome 15y ago
  It would have been trivial for them to patch Process Explorer to hide whatever they wanted anyway.
  - est 15y ago
    Nah, the vupen marketing guys are too lazy to patch it.

fragsworth 15y ago

A video of calculator showing up after clicking a link hardly constitutes proof of an exploit. Considering the fact that they aren't going to publish the exploit, I just want to point out that this kind of thing could easily be fabricated. There are plenty of interests that benefit from unfortunate news about their competitors.

kiiski 15y ago
What would those "plenty of interests" be in this case?

trololo 15y ago

does anyone know how much vupen charges for their exploits, on average?

flipbrad 15y ago

To what extent is this extortion? I mean, they have admitted to only selling to a government. That means they find and exploit vulnerabilities in software created by a private corporation, disclose the existence of a vulnerability publicly, but don't allow the corporate body the means of fixing it. This news, if publicised, would harm Google's reputation and goodwill, perhaps non-negligibly, and cause users to switch products. Unless, of course, Google outbids a government. Pay up or suffer - would this be extortion?

sswam 15y ago
I don't believe this crappy little security firm has more resources than Google, even in the Security Research Dept. They can go find it themselves and fix it. Anyway, it's probably mostly a windows bug. If you line the right bytes up together in windows' RAM, it will void itself and yield 'root' or whatever wiener name they have for it. Who knows, maybe they Govt is trying to screw google, and told them to do a fake release. Their post doesn't make them sound like real pros.

jsprinkles 15y ago

This video is extremely suspicious to the point of probably being an outright lie. I would wager money that this vulnerability is a Flash exploit sold as a Chrome exploit. It is not an accident that they hid Process Explorer after the exploit. They closed it before minimizing everything else intentionally. If you do not believe me follow the mouse pointer. The screencaster moved toward bringing Process Explorer top-level at 0:56 then realized it would show the entire thing and restored Chrome on top of it instead. With that in mind it is obvious that they do not want you to see what changed when it ran so instead we have to work with what is visible: Process Explorer before: http://i.imgur.com/e31Rb.png http://i.imgur.com/e31Rb.png Process Explorer after: http://i.imgur.com/JfPTY.png http://i.imgur.com/JfPTY.png First item of interest is that Chrome shot up to over 400 MB of memory used which indicates that Flash is almost certainly involved. Second, observe how long it takes for Calculator to start. Again, consistent with Flash being involved and Chrome delay-loading it. Third, there are scroll bars on the tab. Big ones. This says there is an invisible item on the page taking up a lot of space which again points to Flash. I saved the exact same content to a file and look how small I can go without scroll bars: http://i.imgur.com/R0eqk.png http://i.imgur.com/R0eqk.png Fourth, flip back side by side through each photo and notice what disappears. The Windows search indexer disappears between screenshot A and B and this is what Vupen is intentionally covering up. You can still observe it indirectly based on the rows and colors at right. It is my understanding that the child processes of SearchIndexer.exe run at all times and not as some kind of cron but I do not use Windows so please correct me if I am wrong. At any rate they do disappear between A and B. It would be very intelligent of them to blog post this as a Chrome sandbox bust (which is sort of newsworthy) and gain that link bait attention but, privately, use the exploit as the Flash and Windows vulnerability it most likely is.

bonch 15y ago
> First item of interest is that Chrome shot up to over 400 MB of memory used which indicates that Flash is almost certainly involved. Is this really the basis of your claim? A complete guess that a 400MB increase in memory must be due to a secret use of Flash?
- jsprinkles 15y ago

ryanclemson 15y ago

The two things I noticed were that 1) The user of the device is named "IAmAdmin", implying that they have admin rights, and 2) The "integrity" of chrome.exe is changed from Low to Medium at somepoint during the attack. Could this somehow be related to breaking out of the sandbox?

watty 15y ago

This seems extremely unethical to me. Now that the world knows there is massive exploit in Chrome, there are bound to be more hackers attempting to abuse it - and have a few hints from the video. By blogging about this and not disclosing it to Google, they are actually increasing the risk of millions of individuals and companies being hacked. Edit: Then again, blogging about it also makes Google aware of the exploit. I'm sure they have tons of resources working on it that wouldn't have otherwise...

comex 15y ago

Impressive, but not surprising. Chrome isn't magical; ASLR and DEP have been bypassed in the past, and even if its own sandbox is perfect, the kernel it's sitting under is a huge attack surface.

daeken 15y ago
ASLR and DEP, by and large, have nothing to do with the kernel. ASLR is a function of the binary loader and memory allocators, which are in userland. DEP is a function of userland memory protection flags (they're handled on the bare metal by the kernel, but the kernel just sets what it's told to by the userland). I'd put any amount of money down on the table that there is no kernel vulnerability here at all -- if there was one, I assure you that it'd be more than a Chrome vuln.
- comex 15y ago
  I know; my comments about ASLR/DEP and the kernel were intended to be separate. As for whether there's a kernel vulnerability, I'll defer to you (although it doesn't have to be full-fledged arbitrary code execution; it can just be a system call that's lax about security tokens), but in general the breadth of kernel code the renderers can access is pretty large.

podperson 15y ago

So assuming this is for real they're going to tell the government so it can pwn us but not tell Google so it can fix it.

bOR_ 15y ago

So, can google put a patch in Chrome that whenever it runs at VUPEN, everything VUPEN has on that computer is shipped over to Google? :-). Google has/had the 'do no evil' in their philosophy, and disabling a scheme that misuses their software for cyber-warfare sounds like a good thing.

mdpm 15y ago

the video is edited, right about when he's showing process explorer post-exploit. the cursor suddenly leaps across the screen, so assuming they're covering up the other child process of the main chrome process is fair. strangely, process explorer's 'process count' only goes up by 1, despite launching calc, and (seemingly) another child process. To be over-zealous, the single row of visible pixels for that other process is consistent with rundll32.exe. That still doesn't mean that it's not a chrome bug - the exploit may use flash to retrieve the payload, make use of flash-js communication, flash-chrome communication quirks etc.