5 ms·

> "This research resulted in 4 0day bugs (CVE-2021-30861, CVE-2021-30975, and two without CVEs), 2 of which were used in the camera hack. I reported this chain

> "This research resulted in 4 0day bugs (CVE-2021-30861, CVE-2021-30975, and two without CVEs), 2 of which were used in the camera hack. I reported this chain to Apple and was awarded $100,500 as a bounty." Writing a secure browser for today's web appears to be a technological challenge comparable to a level 5 self-driving car. It has not been shown to be feasible. So such cars are not permitted to be deployed on the world's roads. Today's web sites and browsers should similarly not be deployed on the world's infobahns.

spicybright 5y ago
To be fair level 5 self driving car failing is much more catastrophic than a browser being hijacked. But I generally agree with your sentiment. Unfortunately the only way to find these modes of failure is to have them actually fail. It's impossible to design and release an error free system without real world usage from real people. It doesn't mean we should just give up and go back to HTML1 though. It just means exploits should be fixed as soon as possible to minimize damage.
- throwaway81523 5y ago
  There is no need to fall back to HTML1. Before HTML5 and even before HTML4, there was a web markup language that was much more powerful than HTML1, was widely deployed and used, did everything we needed, and worked fine. It was called HTML3 and it was great. That is where we should be right now.
  - smoldesu 5y ago
    Maybe if vendors were more open to allowing third-party applications on their platform, people wouldn't be so motivated to increasing the capabilities of the web. Instead, app distribution has turned into a living nightmare, so it's unsurprising to see the web evolved into the monster it is today.
  - spicybright 5y ago
    You might be wearing rose colored glasses here... The old web I remember had exploits from flash, java applets, active-x, shockwave, other sketchy plugins people willingly downloaded to access sites, and poorly sandboxed javascript that could take control of your browser window to resize, move, and spam as many popups as it wanted among other worse things. And downloaded "toolbars", https being rarely used, etc. Even ad blockers and other "power user" extensions (if your browser even offered that) were extremely primitive. etc. There were websites that could execute user land code through exploits just by visiting a website depending on your browser. And that wasn't uncommon. It would be completely insane if that was still the case today. But we fixed those issues and evolved. OP's post shows a major issue obviously. But I would absolutely turn off the entire api with a forced update until it was fixed if I had the power to. But these sorts of exploits happened back in the day to a worse degree with HTML3 + 4 (can't speak for 1 or 2 though, maybe someone can chime in). Viewing the bigger picture, the web is way more secure now than back then. And exploits like these are much more rare now.
- Gigachad 5y ago
  And tbh, our browsers today are remarkably secure compared to before. It used to be just common advice to never open weird emails or click weird links, not because they would try to trick you in to handing over info, but because it was realistic that simply clicking the link or opening the email would immediately rootkit your computer. These days unless you are a government most wanted or using a very old system, you are pretty safe. We used to have school kids coming up with highly privileged attacks on systems to it becoming something the top minds spend months on and get paid 6 figures per discovery for.
  - kfarr 5y ago
    Excellent perspective, thanks for the positive and factual viewpoint
- deleted 5y ago
  [deleted]
wyager 5y ago
The frustrating thing is that we know how to write absolutely secure browsers (or other executors/renderers/etc. of untrusted data) using formal methods. Unfortunately, because most of the negative externality falls on users who don't know any better, the economics don't really work out.
- astrange 5y ago
  I'm not sure you can actually prove a TLS implementation is correct. It depends on the system clock being right, OCSP server being online, etc. Even the encryption has to be free of side channels like timing attacks which are left out of what most people think of as a proof.
  - wyager 5y ago
    You can prove a TLS implementation correct up to defined assumptions (e.g. clock consistency). There are already some projects working on this, eg https://project-everest.github.io/ https://project-everest.github.io/
- twox2 5y ago
  Unlikely... these bugs are all logic bugs. They won't be mitigated by using formal methods, because most of these bugs adhere to pre-defined specs. The problem with browses is that these specs are often in conflict with each other for new and/or obscure features.
  - wyager 5y ago
    Logic bugs are the primary category of bugs targeted by heavyweight formal methods. Most JS features don't even have a formal spec which is part of the problem.
1vuio0pswjnm7 5y ago
"Writing a web browser for today's web appears to be a technological challenge comparable to a level 5 self-driving car." Only when the "constraints" are that the browser must support all "standards" produced by some committee where most if not all memebers are employees of the few browser vendors or other "tech" companies heavily invested in the web. Perhaps that is what is meant by "today's web". I use a netcat and similar TCP clients and a text-only browser on today's web and this works quite well for mine own purposes. Non-commercial use. Basic tasks like sending GET and POST requests, downloading pages and other resources and reading them. Using the web as an information source. I would be willing to bet these programs are "more secure" than the "modern web browser". They are certainly less complex.
- PhantomGremlin 5y ago
  I use a netcat and similar TCP clients and a text-only browser on today's web and this works quite well for mine own purposes. For 99% of what I do I use Firefox + NoScript and I think I'm relatively secure. My solution probably provides more functionality than yours, but it's still a hassle to use some sites. Other sites simply don't exist w/o JavaScript. The situation isn't getting better.
  - 1vuio0pswjnm7 5y ago
    Any chance could disclose the ones that "simply don't exist w/o Javascript". (Assuming they are information sources, not online games or otherwise purely interactive.) I have had reasonably consistent success finding workarounds for sites that gratuitously use Javascript to present information.
    - PhantomGremlin 5y ago
      So many sites. For example much of MSN is totally non-functional w/o Javascript. E.g. this brings up a totally blank page: https://www.msn.com/en-us/news/us/they-had-covid-19-once-then-they-got-it-again/ar-AAT65AV?ocid=uxbndlbing https://www.msn.com/en-us/news/us/they-had-covid-19-once-the... And of course Google really really wants JS to make it easier for them to spy on you. Youtube isn't useful w/o JS (but IIRC it used to at least somewhat function): https://www.youtube.com/ https://www.youtube.com/ Fortunately search still works. Twitter are twats and broke all functionality w/o JS, but nitter.net is a workaround! Just replace twitter.com with nitter.net to see the tweet. Fortunately many sites that start out blank are quite functional w/o JS, just need to View -> Page Style -> No Styles. E.g. this one: https://www.politico.com/ https://www.politico.com/ ugly but readable.
unobatbayar 5y ago
> awarded $100,500 as a bounty How does the economy of bug bounty programs work for the company? $100,500 is probably not much for Apple but it's still some engineer's salary. Do the responsible engineer get a pay cut for this bug? Or this kind of 0day bugs are not bugs, but secret features left open from the beginning?
- Sirened 5y ago
  I have not heard of companies who operate bug bounties punishing engineers. Apple certainly does not do this either. Most companies do the math and decide that it's cheaper for them to deal with paying a research than it is to deal with the possible fallout of an in-the-wild exploit or researchers just dumping zero days on twitter.
- laweijfmvo 5y ago
  > This time, the bug gives the attacker full access to every website ever visited by the victim. That means in addition to turning on your camera, my bug can also hack your iCloud, PayPal, Facebook, Gmail, etc. accounts too. Honestly, $100,000 for this is too low.
  - londons_explore 5y ago
    This bug would, in the wrong hands, let someone steal a lot more than $100k.
    - cortexio 5y ago
  - mhoad 5y ago
    Agreed, of all the places you could have sold that information the official channel by FAR pays the worst (Apple in particular being a notoriously terrible company to deal with for security problems but by no means are the only ones) which is a huge problem that people should be making a lot more noise about. I kind of shudder to think of how many of these bugs have been out there for years and only ever ended up in the hands of governments and shady groups like NSO.
hffftz 5y ago
mhoad 5y ago
I think what you have said is in many ways very true, a modern web browser is in many ways comparable to an operating system and even more so with Chrome's push into new APIs that do things like access local file systems for example. It seems that we need a better story for when code inevitably can escape the sandboxing that browsers provide because right now it's a straight up disaster scenario. That means you are going to have to rethink the OS underlying it and none of today's options were built with that kind of a threat model in mind. There is Fuchsia on the horizon which sounds like a MAJOR leap forward but that also seems like it is several years away from ever reaching a desktop for example and it's also really unclear what kind of attacks are going to be possible in the real world against it either.

spicybright 5y ago

To be fair level 5 self driving car failing is much more catastrophic than a browser being hijacked. But I generally agree with your sentiment. Unfortunately the only way to find these modes of failure is to have them actually fail. It's impossible to design and release an error free system without real world usage from real people. It doesn't mean we should just give up and go back to HTML1 though. It just means exploits should be fixed as soon as possible to minimize damage.

throwaway81523 5y ago
There is no need to fall back to HTML1. Before HTML5 and even before HTML4, there was a web markup language that was much more powerful than HTML1, was widely deployed and used, did everything we needed, and worked fine. It was called HTML3 and it was great. That is where we should be right now.
- smoldesu 5y ago
  Maybe if vendors were more open to allowing third-party applications on their platform, people wouldn't be so motivated to increasing the capabilities of the web. Instead, app distribution has turned into a living nightmare, so it's unsurprising to see the web evolved into the monster it is today.
- spicybright 5y ago
  You might be wearing rose colored glasses here... The old web I remember had exploits from flash, java applets, active-x, shockwave, other sketchy plugins people willingly downloaded to access sites, and poorly sandboxed javascript that could take control of your browser window to resize, move, and spam as many popups as it wanted among other worse things. And downloaded "toolbars", https being rarely used, etc. Even ad blockers and other "power user" extensions (if your browser even offered that) were extremely primitive. etc. There were websites that could execute user land code through exploits just by visiting a website depending on your browser. And that wasn't uncommon. It would be completely insane if that was still the case today. But we fixed those issues and evolved. OP's post shows a major issue obviously. But I would absolutely turn off the entire api with a forced update until it was fixed if I had the power to. But these sorts of exploits happened back in the day to a worse degree with HTML3 + 4 (can't speak for 1 or 2 though, maybe someone can chime in). Viewing the bigger picture, the web is way more secure now than back then. And exploits like these are much more rare now.
Gigachad 5y ago
And tbh, our browsers today are remarkably secure compared to before. It used to be just common advice to never open weird emails or click weird links, not because they would try to trick you in to handing over info, but because it was realistic that simply clicking the link or opening the email would immediately rootkit your computer. These days unless you are a government most wanted or using a very old system, you are pretty safe. We used to have school kids coming up with highly privileged attacks on systems to it becoming something the top minds spend months on and get paid 6 figures per discovery for.
- kfarr 5y ago
  Excellent perspective, thanks for the positive and factual viewpoint
deleted 5y ago
[deleted]

wyager 5y ago

The frustrating thing is that we know how to write absolutely secure browsers (or other executors/renderers/etc. of untrusted data) using formal methods. Unfortunately, because most of the negative externality falls on users who don't know any better, the economics don't really work out.

astrange 5y ago
I'm not sure you can actually prove a TLS implementation is correct. It depends on the system clock being right, OCSP server being online, etc. Even the encryption has to be free of side channels like timing attacks which are left out of what most people think of as a proof.
- wyager 5y ago
  You can prove a TLS implementation correct up to defined assumptions (e.g. clock consistency). There are already some projects working on this, eg https://project-everest.github.io/ https://project-everest.github.io/
twox2 5y ago
Unlikely... these bugs are all logic bugs. They won't be mitigated by using formal methods, because most of these bugs adhere to pre-defined specs. The problem with browses is that these specs are often in conflict with each other for new and/or obscure features.
- wyager 5y ago
  Logic bugs are the primary category of bugs targeted by heavyweight formal methods. Most JS features don't even have a formal spec which is part of the problem.

1vuio0pswjnm7 5y ago

"Writing a web browser for today's web appears to be a technological challenge comparable to a level 5 self-driving car." Only when the "constraints" are that the browser must support all "standards" produced by some committee where most if not all memebers are employees of the few browser vendors or other "tech" companies heavily invested in the web. Perhaps that is what is meant by "today's web". I use a netcat and similar TCP clients and a text-only browser on today's web and this works quite well for mine own purposes. Non-commercial use. Basic tasks like sending GET and POST requests, downloading pages and other resources and reading them. Using the web as an information source. I would be willing to bet these programs are "more secure" than the "modern web browser". They are certainly less complex.

PhantomGremlin 5y ago
I use a netcat and similar TCP clients and a text-only browser on today's web and this works quite well for mine own purposes. For 99% of what I do I use Firefox + NoScript and I think I'm relatively secure. My solution probably provides more functionality than yours, but it's still a hassle to use some sites. Other sites simply don't exist w/o JavaScript. The situation isn't getting better.
- 1vuio0pswjnm7 5y ago
  Any chance could disclose the ones that "simply don't exist w/o Javascript". (Assuming they are information sources, not online games or otherwise purely interactive.) I have had reasonably consistent success finding workarounds for sites that gratuitously use Javascript to present information.
  - PhantomGremlin 5y ago
    So many sites. For example much of MSN is totally non-functional w/o Javascript. E.g. this brings up a totally blank page: https://www.msn.com/en-us/news/us/they-had-covid-19-once-then-they-got-it-again/ar-AAT65AV?ocid=uxbndlbing https://www.msn.com/en-us/news/us/they-had-covid-19-once-the... And of course Google really really wants JS to make it easier for them to spy on you. Youtube isn't useful w/o JS (but IIRC it used to at least somewhat function): https://www.youtube.com/ https://www.youtube.com/ Fortunately search still works. Twitter are twats and broke all functionality w/o JS, but nitter.net is a workaround! Just replace twitter.com with nitter.net to see the tweet. Fortunately many sites that start out blank are quite functional w/o JS, just need to View -> Page Style -> No Styles. E.g. this one: https://www.politico.com/ https://www.politico.com/ ugly but readable.

unobatbayar 5y ago

> awarded $100,500 as a bounty How does the economy of bug bounty programs work for the company? $100,500 is probably not much for Apple but it's still some engineer's salary. Do the responsible engineer get a pay cut for this bug? Or this kind of 0day bugs are not bugs, but secret features left open from the beginning?

Sirened 5y ago
I have not heard of companies who operate bug bounties punishing engineers. Apple certainly does not do this either. Most companies do the math and decide that it's cheaper for them to deal with paying a research than it is to deal with the possible fallout of an in-the-wild exploit or researchers just dumping zero days on twitter.
laweijfmvo 5y ago
> This time, the bug gives the attacker full access to every website ever visited by the victim. That means in addition to turning on your camera, my bug can also hack your iCloud, PayPal, Facebook, Gmail, etc. accounts too. Honestly, $100,000 for this is too low.
- londons_explore 5y ago
  This bug would, in the wrong hands, let someone steal a lot more than $100k.
  - cortexio 5y ago
- mhoad 5y ago
  Agreed, of all the places you could have sold that information the official channel by FAR pays the worst (Apple in particular being a notoriously terrible company to deal with for security problems but by no means are the only ones) which is a huge problem that people should be making a lot more noise about. I kind of shudder to think of how many of these bugs have been out there for years and only ever ended up in the hands of governments and shady groups like NSO.

hffftz 5y ago

mhoad 5y ago

I think what you have said is in many ways very true, a modern web browser is in many ways comparable to an operating system and even more so with Chrome's push into new APIs that do things like access local file systems for example. It seems that we need a better story for when code inevitably can escape the sandboxing that browsers provide because right now it's a straight up disaster scenario. That means you are going to have to rethink the OS underlying it and none of today's options were built with that kind of a threat model in mind. There is Fuchsia on the horizon which sounds like a MAJOR leap forward but that also seems like it is several years away from ever reaching a desktop for example and it's also really unclear what kind of attacks are going to be possible in the real world against it either.