6 ms·

Nice one, from the video it looks like he chained a browser vuln with a kernel vuln to make his jailbreak. Assuming it's a JIT optimization bug (as browser vuln

by gowery 4y ago

Nice one, from the video it looks like he chained a browser vuln with a kernel vuln to make his jailbreak. Assuming it's a JIT optimization bug (as browser vulns often are, but I'm just guessing here), I wonder if Sony might attempt to mitigate this in future by disabling JIT, as Apple has done with its Lockdown Mode. Looks like the other thing they could do for this particular vector is prevent https requests from being intercepted and replaced - why should the user be permitted to override certificate errors in this case? Doesn't make sense.

pjmlp 4y ago
Microsoft is also exploring the same path with security on Chrome Edge.
- inglor 4y ago
  Reference to the Edge thing called "Super Duper Secure Mode" https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...
  - capableweb 4y ago
    > Most importantly we plan to have fun with this project That seems like the wrong main focus for a security project. I'd have preferred if the "most important" thing was to provide a secure browsing experience, but, to each their own...
    - jefftk 4y ago
      When you're at the exploratory stage having fun is often a key component of making progress.
    - ygjb 4y ago
      Nah; with years of experience in the security space, and a chunk of those working at a browser vendor, watching bug classes vanish (even if it's the expense of some usability) is worth it when I imagine the tears of bad guys who have to work harder, and the users who won't have to go through the charade of credit monitoring services offered by some of the worst companies in the world. They are specifically calling out that it's not ready for prime time, and that it will have an impact on users. In practice, many very effective security controls for browsers (and other software) get tuned down or disabled by default because they break too much of how the web works (SameSite cookies are a good example), or because it creates friction in customer acquisition or growth.
BaculumMeumEst 4y ago
Do you mean a javascript JIT for the system’s web browser? Would the only impact of disabling it be that the system is slower at web browsing?
- encryptluks2 4y ago
  Because that is what JIT does is it speeds up performance at the costs of some security vulnerabilities. Just about every browser vulnerability in existence would have been mitigated by simply disabling JIT. I've disabled it myself and browsing was so slow that I had to re-enable it.
  - BaculumMeumEst 4y ago
    Gotcha, was just making sure I understood correctly. I’m just surprised that console manufacturers would go through the effort of shipping a JIT for a built in web browser. I don’t think I’ve ever opened a web browser on a console except on dreamcast for the novelty of it.
    - doublepg23 4y ago
      They just port WebKit usually.
chc4 4y ago
It's a use-after-free in FontFaceCache (https://wololo.net/2021/10/14/use-after-free-webkit-vulnerability-impacts-ps4-possibly-up-to-firmware-9-00-included/ https://wololo.net/2021/10/14/use-after-free-webkit-vulnerab... and https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit/blob/cafa1527c742118e2b7f15d71ce289aac5c3ee85/document/en/ps5/webkit.js#L27 https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit/blob/...), not a JIT bug. Funnily enough, I think the CVE they're saying it is is wrong? The link to the project zero itw tracking page is for CVE-2021-30858 which is an IndexDB UAF, which is a completely seperate bug; the MITRE tracking page for CVE-2021-30858 just has the boilerplate "a malicious page can cause an exploit" from Apple, and doesn't say if it's for the IndexDB or FontFaceCache bug, so I think the Jailbreak people are just confused on this one.

by gowery 4y ago

pjmlp 4y ago

Microsoft is also exploring the same path with security on Chrome Edge.

inglor 4y ago
Reference to the Edge thing called "Super Duper Secure Mode" https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...
- capableweb 4y ago
  > Most importantly we plan to have fun with this project That seems like the wrong main focus for a security project. I'd have preferred if the "most important" thing was to provide a secure browsing experience, but, to each their own...
  - jefftk 4y ago
    When you're at the exploratory stage having fun is often a key component of making progress.
  - ygjb 4y ago
    Nah; with years of experience in the security space, and a chunk of those working at a browser vendor, watching bug classes vanish (even if it's the expense of some usability) is worth it when I imagine the tears of bad guys who have to work harder, and the users who won't have to go through the charade of credit monitoring services offered by some of the worst companies in the world. They are specifically calling out that it's not ready for prime time, and that it will have an impact on users. In practice, many very effective security controls for browsers (and other software) get tuned down or disabled by default because they break too much of how the web works (SameSite cookies are a good example), or because it creates friction in customer acquisition or growth.

BaculumMeumEst 4y ago

Do you mean a javascript JIT for the system’s web browser? Would the only impact of disabling it be that the system is slower at web browsing?

encryptluks2 4y ago
Because that is what JIT does is it speeds up performance at the costs of some security vulnerabilities. Just about every browser vulnerability in existence would have been mitigated by simply disabling JIT. I've disabled it myself and browsing was so slow that I had to re-enable it.
- BaculumMeumEst 4y ago
  Gotcha, was just making sure I understood correctly. I’m just surprised that console manufacturers would go through the effort of shipping a JIT for a built in web browser. I don’t think I’ve ever opened a web browser on a console except on dreamcast for the novelty of it.
  - doublepg23 4y ago
    They just port WebKit usually.

chc4 4y ago

It's a use-after-free in FontFaceCache (https://wololo.net/2021/10/14/use-after-free-webkit-vulnerability-impacts-ps4-possibly-up-to-firmware-9-00-included/ https://wololo.net/2021/10/14/use-after-free-webkit-vulnerab... and https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit/blob/cafa1527c742118e2b7f15d71ce289aac5c3ee85/document/en/ps5/webkit.js#L27 https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit/blob/...), not a JIT bug. Funnily enough, I think the CVE they're saying it is is wrong? The link to the project zero itw tracking page is for CVE-2021-30858 which is an IndexDB UAF, which is a completely seperate bug; the MITRE tracking page for CVE-2021-30858 just has the boilerplate "a malicious page can cause an exploit" from Apple, and doesn't say if it's for the IndexDB or FontFaceCache bug, so I think the Jailbreak people are just confused on this one.