3 ms·

what would be some security concerns in a situation like this? genuine question

dcsommer 2y ago
Remote code execution + local privilege escalation to own your device. Just last week on the RCE front: https://thehackernews.com/2024/05/new-chrome-zero-day-vulnerability-cve.html?m=1 https://thehackernews.com/2024/05/new-chrome-zero-day-vulner...
- pennybanks 2y ago
  right makes sense, ty
- resource_waste 2y ago
  Is there such a thing as a 'stable' browser that will never have these flaws. (I'm afraid to use the word Stable since Debian-family corrupted the meaning) I really don't need push notifications going to my desktop. HTML, CSS... ughhhh javascript... So if covering javascript is too hard, maybe a HTML/CSS browser, and anytime you need javascript, you open a chrome session.
paulryanrogers 2y ago
Patches introducing buffer overflows, or weakening existing security through ignorance or negligence.
Retr0id 2y ago
Chromium likely has plenty of "dormant" bugs - bugs that exist in the source code, but consistently compile to safe (or unreachable) machine code, more or less due to good luck. This project messes with optimisation flags, which have a good chance of "waking up" those bugs (If you've ever had code work at -O1 but not at -O3, you know what I'm talking about). The same goes for compiler bugs, too. The real Chromium is aggressively fuzz tested, but this project is almost certainly not, or at least, not to the same extent. Turning on features like JPEG-XL also increases attack surface.
- Const-me 2y ago
  OTOH, the original Chromium is so popular that the motivation of finding these bugs is very high. I think zero-day RCE bugs can be sold for tons of money on the black market. However, the motivation to find similar bugs in Thorium is very low, too few users. And because the project messes with compiler flags, there’s chance at least some of the Chromium bugs don’t apply to the fork, because the machine code is different. Or maybe they apply but require adjustments to the exploit, which most attackers won’t do because too few users of the fork.
  - resource_waste 2y ago
    This is one of the interesting parts about owning obscure phones. I cannot imagine having anything important on an iPhone since there is a huge demand to find a bug in the hardware/OS layer. (And we've seen this live in the wild with multiple 0 click exploits) Meanwhile obscure phones could only be targeted by Pegasus by: 1. Go to a website and download an app 2. Change your settings to allow this app to install 3. Change another setting to allow this app to install. I mean... not really elite hackers, I had to do this for my own Android app.
- mmebane 2y ago
  It also usually only gets one release per upstream major version (and sometimes not even that), meaning a lot of Chromium security fixes can take several weeks to show up in a Thorium release. I appreciate the author's effort, but it's definitely riskier than normal Chrome/Chromium.
newshackr 2y ago
Stealing bank account sessions

Remote code execution + local privilege escalation to own your device. Just last week on the RCE front: https://thehackernews.com/2024/05/new-chrome-zero-day-vulnerability-cve.html?m=1 https://thehackernews.com/2024/05/new-chrome-zero-day-vulner...

pennybanks 2y ago
right makes sense, ty
resource_waste 2y ago
Is there such a thing as a 'stable' browser that will never have these flaws. (I'm afraid to use the word Stable since Debian-family corrupted the meaning) I really don't need push notifications going to my desktop. HTML, CSS... ughhhh javascript... So if covering javascript is too hard, maybe a HTML/CSS browser, and anytime you need javascript, you open a chrome session.

paulryanrogers 2y ago

Patches introducing buffer overflows, or weakening existing security through ignorance or negligence.

Retr0id 2y ago

Chromium likely has plenty of "dormant" bugs - bugs that exist in the source code, but consistently compile to safe (or unreachable) machine code, more or less due to good luck. This project messes with optimisation flags, which have a good chance of "waking up" those bugs (If you've ever had code work at -O1 but not at -O3, you know what I'm talking about). The same goes for compiler bugs, too. The real Chromium is aggressively fuzz tested, but this project is almost certainly not, or at least, not to the same extent. Turning on features like JPEG-XL also increases attack surface.

Const-me 2y ago
OTOH, the original Chromium is so popular that the motivation of finding these bugs is very high. I think zero-day RCE bugs can be sold for tons of money on the black market. However, the motivation to find similar bugs in Thorium is very low, too few users. And because the project messes with compiler flags, there’s chance at least some of the Chromium bugs don’t apply to the fork, because the machine code is different. Or maybe they apply but require adjustments to the exploit, which most attackers won’t do because too few users of the fork.
- resource_waste 2y ago
  This is one of the interesting parts about owning obscure phones. I cannot imagine having anything important on an iPhone since there is a huge demand to find a bug in the hardware/OS layer. (And we've seen this live in the wild with multiple 0 click exploits) Meanwhile obscure phones could only be targeted by Pegasus by: 1. Go to a website and download an app 2. Change your settings to allow this app to install 3. Change another setting to allow this app to install. I mean... not really elite hackers, I had to do this for my own Android app.
mmebane 2y ago
It also usually only gets one release per upstream major version (and sometimes not even that), meaning a lot of Chromium security fixes can take several weeks to show up in a Thorium release. I appreciate the author's effort, but it's definitely riskier than normal Chrome/Chromium.

newshackr 2y ago

Stealing bank account sessions