4 ms·

> Compromised machines are an even bigger pain. And one that most people never deal with? At least from a browser exploit…

walterbell 5y ago
Hundreds of millions of people are installing the most recent iOS 15.3.1 security update with one fix, https://support.apple.com/en-us/HT213093 https://support.apple.com/en-us/HT213093 > WebKit: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- saagarjha 5y ago
  Sure, but the update doesn't install a VM on their iPhone.
  - walterbell 5y ago
    Yes, which is why iPhones/iPads get compromised. Apple's update process may be able to restore some integrity to the system. IF the attacker gained persistent access, your only recourse is to wipe the phone and start over.
    - zamadatix 5y ago
      But that's an enormous "if" that the vast vast vast majority of that big scary number getting patched don't actually have to deal with. The point isn't getting compromised is a minor inconvenience it's that what the VM protects against is such a rare major inconvenience it's multitudes of times more inconvenient over time to constantly deal with the smaller inconvenience of running browsing through a VM instead.
      - walterbell 5y ago
        YOLO works until it doesn't. It's usually self-correcting. In business, it may be corrected by involuntary regulation. Browser VMs are not the only option. Regular OS wipe/install is another, e.g. rotate between two dedicated browsing devices with native performance. One indicator of a compromised device is a reduction in perceived performance. HP SureClick or MS AppGuard Edge is another level of complexity: every network connection and browser tab is a separate stateless micro-VM whose output is dynamically composited into a single display, with optional analytics of traffic and malware within each isolated micro-VM. As for "I'm not important enough to be a target", some humans are on education or career paths to change that calculation. Some adversaries may see value in early access to up-and-coming targets. As the cost of targeting falls, the bar for "important enough" also falls.
        exikyut 5y ago
        > One indicator of a compromised device is a reduction in perceived performance. That doesn't work because of the hilariously wide performance swings induced by antivirus software overhead. :( IMHO the tab-isolation model you describe is the solution for the top-level comment - something something Firecracker...
        oarsinsync 5y ago
        > As the cost of targeting falls, the bar for "important enough" also falls. Just want to highlight this point, as this is important and probably not given enough conscious thought.
        zamadatix 5y ago
        You can't just say it could be bad one day therefore everyone should do <x> now - that's just fear mongering not supportive reasoning. For instance it could be everyone falls victim to a hypervisor security bug so nobody should trust VM browsing. It could be everyone falls victim to a firmware big so nobody should trust reusing a device. At some point you have to accept that having the possibility of a bad scenario isn't enough on its own, it needs to be actually weighed and compared. Sure, there are e.g. certain high security businesses or certain high risk individuals that should consider higher security options (or in some cases regulation therefore). That it's certain conditions is precisely why it isn't for the vast majority though, if it were you wouldn't need to specify corner cases. Security is about judging how to stay as far up the curve as you can without it costing you more than you'd realistically lose to do so. It is not about closing every conceivable hole in your attack surface to achieve minimal risk. I'd also add there is a counter to the always increasing cost/reward ratio of targeting: the always decreasing amount of complexity of implementing the security mitigations for the "next level" of security. In a decade browsing via VM may be commonplace for the average user (though probably more persistently for that use case) and not require a thought to use. That doesn't make it any different for today but it points out there is more than "threats have increased" that can change what's a reasonable place to be on the security curve.
  - lostlogin 5y ago
    It’s also not an install most users are hunting down, it’s pretty much automagic. It mostly supports your point though, as this is why auto update exists.

walterbell 5y ago

Hundreds of millions of people are installing the most recent iOS 15.3.1 security update with one fix, https://support.apple.com/en-us/HT213093 https://support.apple.com/en-us/HT213093 > WebKit: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

saagarjha 5y ago
Sure, but the update doesn't install a VM on their iPhone.
- walterbell 5y ago
  Yes, which is why iPhones/iPads get compromised. Apple's update process may be able to restore some integrity to the system. IF the attacker gained persistent access, your only recourse is to wipe the phone and start over.
  - zamadatix 5y ago
    But that's an enormous "if" that the vast vast vast majority of that big scary number getting patched don't actually have to deal with. The point isn't getting compromised is a minor inconvenience it's that what the VM protects against is such a rare major inconvenience it's multitudes of times more inconvenient over time to constantly deal with the smaller inconvenience of running browsing through a VM instead.
    - walterbell 5y ago
      YOLO works until it doesn't. It's usually self-correcting. In business, it may be corrected by involuntary regulation. Browser VMs are not the only option. Regular OS wipe/install is another, e.g. rotate between two dedicated browsing devices with native performance. One indicator of a compromised device is a reduction in perceived performance. HP SureClick or MS AppGuard Edge is another level of complexity: every network connection and browser tab is a separate stateless micro-VM whose output is dynamically composited into a single display, with optional analytics of traffic and malware within each isolated micro-VM. As for "I'm not important enough to be a target", some humans are on education or career paths to change that calculation. Some adversaries may see value in early access to up-and-coming targets. As the cost of targeting falls, the bar for "important enough" also falls.
      - exikyut 5y ago
        > One indicator of a compromised device is a reduction in perceived performance. That doesn't work because of the hilariously wide performance swings induced by antivirus software overhead. :( IMHO the tab-isolation model you describe is the solution for the top-level comment - something something Firecracker...
      - oarsinsync 5y ago
        > As the cost of targeting falls, the bar for "important enough" also falls. Just want to highlight this point, as this is important and probably not given enough conscious thought.
      - zamadatix 5y ago
        You can't just say it could be bad one day therefore everyone should do <x> now - that's just fear mongering not supportive reasoning. For instance it could be everyone falls victim to a hypervisor security bug so nobody should trust VM browsing. It could be everyone falls victim to a firmware big so nobody should trust reusing a device. At some point you have to accept that having the possibility of a bad scenario isn't enough on its own, it needs to be actually weighed and compared. Sure, there are e.g. certain high security businesses or certain high risk individuals that should consider higher security options (or in some cases regulation therefore). That it's certain conditions is precisely why it isn't for the vast majority though, if it were you wouldn't need to specify corner cases. Security is about judging how to stay as far up the curve as you can without it costing you more than you'd realistically lose to do so. It is not about closing every conceivable hole in your attack surface to achieve minimal risk. I'd also add there is a counter to the always increasing cost/reward ratio of targeting: the always decreasing amount of complexity of implementing the security mitigations for the "next level" of security. In a decade browsing via VM may be commonplace for the average user (though probably more persistently for that use case) and not require a thought to use. That doesn't make it any different for today but it points out there is more than "threats have increased" that can change what's a reasonable place to be on the security curve.
- lostlogin 5y ago
  It’s also not an install most users are hunting down, it’s pretty much automagic. It mostly supports your point though, as this is why auto update exists.