5 ms·

I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been

I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been prevented by using Firefox, (because it relied on a Chrome CVE). It also did not work on Linux and presumably not on Apple's ARM CPUs. But unfortunately we don't get exponential security. Normally, one would expect that n variables (Browser, OS, CPU architecture) with three choices each should give you 3^n required exploits to cover all combinations. But unfortunately, n is rather small nowadays, the number of choices shrinks every year, and -even more worrying- the attack vectors compose extremely well so you actually just need 3n exploits. So I am a little bit at a loss here how we can make such attacks non-economical again.

arnaudsm 6y ago
Exactly how biodiversity protects us from diseases.
- foolmeonce 6y ago
  But this is reversed for a watering hole bug against an organization. They only needed to get into one stack one member of the org uses and stay. Their reason for releasing multiple chains of attack at once instead of whenever their current attack is patched is unclear unless they want to get into multiple organizations where some avoid a diversity of exploitable software.
enkid 6y ago
But these are attacks that worked across multiple systems. Heterogeneity is going to lead to more systems with less overall security work being done per system. Sure, using Firefox would have prevented the attacks we know about, but who's to say Google found all of the attacks. They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them."
- caslon 6y ago
  > They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them." Samsung's browser and Chrome share 100% of attack surface; Safari and Chrome share likely near 70%. Windows and Android have Chrome built-in at the OS layer, iOS has Safari built in at the OS layer. In this case, something like Firefox which shares much less attack surface would in fact solve the problem, because the problem is that other things have Chrome at the OS-level.
  - lozaning 6y ago
    >Windows and Android have Chrome built-in at the OS layer How is Chrome built into Windows at the OS layer? Wouldn't that be IE or Edge?
    - kitsunesoba 6y ago
      Edge is now Chromium based and soon Edge-Chromium webviews will ship with the OS. The old IE/Edge webviews will remain for legacy but they'll eventually get stripped.
    - Alterlife 6y ago
      > Edge I think that's OP's point. Edge uses chromium.
  - deleted 6y ago
    [deleted]
  - modeless 6y ago
    > Safari and Chrome share likely near 70% This is wrong. I'd say it's more like 5%. Blink forked from WebKit 7 years ago and development has been very active on both sides since then. And probably the majority of the attack surface is outside Blink/WebKit proper to start with (e.g. JS engine, font libraries, media decoding, networking, etc).
    - saagarjha 6y ago
dmos62 6y ago
Diversity is a sign of health in an ecosystem. But, increasing diversity directly isn't really viable. Question is, why is diversity low? In my opinion, Web, OSes and CPUs suffer from being overly complicated, closed-source ridden, non-modular systems-within-systems. Basicly, the opposite of what the Unix philosophy advocates.
- qrbLPHiKpiux 6y ago
  Diversity is low because of the massive amounts of capital Google has. Both in terms of money and power.
  - dmos62 6y ago
    If a Web browser were easier to implement, we would have more than ~3 well maintained engines. In other words, why should Web require massive amounts of capital?
    - EVa5I7bHFq9mnYK 6y ago
      Feature creep. Everyone wants to leave a footprint in the world. Same thing with legislation.
- zzo38computer 6y ago
  I agree. They are too complicated. Some more work toward making better one will be helpful. Protocols and instruction sets etc will need to be not too complicated, in addition to being open source and fully documented.
sdeep27 6y ago
>>how we can make such attacks non-econimical again Does it say how they monetized these attacks? Or how would you expect?
tedunangst 6y ago
Pretty sure the iOS exploits worked on Apple CPUs.
wdr1 6y ago
> I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. How does that balance against the thread of each platform/ecosystem having its own variants of security issues?
macspoofing 6y ago
>To counter such threats we need a healthy heterogeneous ecosystem. And how do you get that? >But unfortunately, n is rather small nowadays, the number of choices shrinks every year, and -even more worrying- the attack vectors compose extremely well so you actually just need 3n exploits. Let me tell you about early-to-mid 2000s. Now that was a time of very low 'n'. Compared to then, we live in a heterogenous nirvana.
Ristovski 6y ago
> It also did not work on Linux and presumably not on Apple's ARM CPUs. Hmm, anyone else find this interesting? I haven't looked into the actual exploit itself yet, but having it work on Android, which has SELinux and/or other protections by default, but not on (presumably) a generic Linux distro, is weird. I would have assumed it exploited something present only on mobile builds of Chrome, but it affects Windows as well. Odd.
- Ristovski 6y ago
  Okay, just noticed that the Windows exploits are independent, don't know how I missed that. The Android vs Linux part still stands though.
mike_d 6y ago
It did not rely on a Chrome CVE, it just included a Chrome exploit. What they found was a server that served up the correct exploit for the platform making the request, and were able to coax a bunch of iOS and Chrome exploits out of it. This doesn't mean that the attackers didn't have other browser exploits or that Firefox exploits couldn't have been dropped into the same framework. In fact, if you start trolling around in Tor, you're likely to find a ton of Firefox exploits because Tor Browser is obviously based on Firefox.

arnaudsm 6y ago

Exactly how biodiversity protects us from diseases.

foolmeonce 6y ago
But this is reversed for a watering hole bug against an organization. They only needed to get into one stack one member of the org uses and stay. Their reason for releasing multiple chains of attack at once instead of whenever their current attack is patched is unclear unless they want to get into multiple organizations where some avoid a diversity of exploitable software.

enkid 6y ago

But these are attacks that worked across multiple systems. Heterogeneity is going to lead to more systems with less overall security work being done per system. Sure, using Firefox would have prevented the attacks we know about, but who's to say Google found all of the attacks. They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them."

caslon 6y ago
> They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them." Samsung's browser and Chrome share 100% of attack surface; Safari and Chrome share likely near 70%. Windows and Android have Chrome built-in at the OS layer, iOS has Safari built in at the OS layer. In this case, something like Firefox which shares much less attack surface would in fact solve the problem, because the problem is that other things have Chrome at the OS-level.
- lozaning 6y ago
  >Windows and Android have Chrome built-in at the OS layer How is Chrome built into Windows at the OS layer? Wouldn't that be IE or Edge?
  - kitsunesoba 6y ago
    Edge is now Chromium based and soon Edge-Chromium webviews will ship with the OS. The old IE/Edge webviews will remain for legacy but they'll eventually get stripped.
  - Alterlife 6y ago
    > Edge I think that's OP's point. Edge uses chromium.
- deleted 6y ago
  [deleted]
- modeless 6y ago
  > Safari and Chrome share likely near 70% This is wrong. I'd say it's more like 5%. Blink forked from WebKit 7 years ago and development has been very active on both sides since then. And probably the majority of the attack surface is outside Blink/WebKit proper to start with (e.g. JS engine, font libraries, media decoding, networking, etc).
  - saagarjha 6y ago

dmos62 6y ago

Diversity is a sign of health in an ecosystem. But, increasing diversity directly isn't really viable. Question is, why is diversity low? In my opinion, Web, OSes and CPUs suffer from being overly complicated, closed-source ridden, non-modular systems-within-systems. Basicly, the opposite of what the Unix philosophy advocates.

qrbLPHiKpiux 6y ago
Diversity is low because of the massive amounts of capital Google has. Both in terms of money and power.
- dmos62 6y ago
  If a Web browser were easier to implement, we would have more than ~3 well maintained engines. In other words, why should Web require massive amounts of capital?
  - EVa5I7bHFq9mnYK 6y ago
    Feature creep. Everyone wants to leave a footprint in the world. Same thing with legislation.
zzo38computer 6y ago
I agree. They are too complicated. Some more work toward making better one will be helpful. Protocols and instruction sets etc will need to be not too complicated, in addition to being open source and fully documented.

sdeep27 6y ago

>>how we can make such attacks non-econimical again Does it say how they monetized these attacks? Or how would you expect?

tedunangst 6y ago

Pretty sure the iOS exploits worked on Apple CPUs.

wdr1 6y ago

> I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. How does that balance against the thread of each platform/ecosystem having its own variants of security issues?

macspoofing 6y ago

>To counter such threats we need a healthy heterogeneous ecosystem. And how do you get that? >But unfortunately, n is rather small nowadays, the number of choices shrinks every year, and -even more worrying- the attack vectors compose extremely well so you actually just need 3n exploits. Let me tell you about early-to-mid 2000s. Now that was a time of very low 'n'. Compared to then, we live in a heterogenous nirvana.

Ristovski 6y ago

> It also did not work on Linux and presumably not on Apple's ARM CPUs. Hmm, anyone else find this interesting? I haven't looked into the actual exploit itself yet, but having it work on Android, which has SELinux and/or other protections by default, but not on (presumably) a generic Linux distro, is weird. I would have assumed it exploited something present only on mobile builds of Chrome, but it affects Windows as well. Odd.

Ristovski 6y ago
Okay, just noticed that the Windows exploits are independent, don't know how I missed that. The Android vs Linux part still stands though.

mike_d 6y ago

It did not rely on a Chrome CVE, it just included a Chrome exploit. What they found was a server that served up the correct exploit for the platform making the request, and were able to coax a bunch of iOS and Chrome exploits out of it. This doesn't mean that the attackers didn't have other browser exploits or that Firefox exploits couldn't have been dropped into the same framework. In fact, if you start trolling around in Tor, you're likely to find a ton of Firefox exploits because Tor Browser is obviously based on Firefox.