5 ms·

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit har

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

TheDong 2y ago
If you can trick someone into installing a malicious extension with arbitrary permissions, you can already run arbitrary code on every webpage they visit, including their logged in bank, social media, etc. You think an attacker is right now thinking "Man, I know exactly how to make a lot of victims install an extension, but I can only steal their coinbase wallet and bank accounts, if only there was a way I could run calc.exe on their machine too..." who's going to pay more than $20k to upgrade from "steal all their money" to "steal all their money and run calc.exe"?
- grokkedit 2y ago
  that's not entirely true: if you look at the manifest on the github repo you can see that it only requires the `tab` permission, which, when installed, will make the extension seem quite safe, since it should not have access to the content of your pages
- beng-nl 2y ago
  I actually think escaping the browser is a huge leap and a frequently a primary goal for a black hat. Eg someone trying to install ransomware, or a spy targeting a specific person or org. From outside the browser they can exploit kernel bugs to elevate their privilege; and they can probe the network to attempt to move laterally in the org. So while I think your comment is thoughtful, its thoughtfulness made me think of agreeing with the opposite :-)
- webXL 2y ago
  Correct me if I’m wrong, but remote code execution has the advantage of being able to access information without the user being involved at all. Sure the user needs to install and trigger the exploit, but whatever code the attacker runs doesn’t require the user to interact with certain urls. If you can launch arbitrary programs, you can probably install all sorts of nasty things that are potentially more lucrative than the victim’s bank or coinbase accounts.
  - therein 2y ago
    It breaks the assumption that Chrome is sandboxed and something I do as a user including installing an extension will not have an impact outside of Chrome. A new process outside Chrome to call your own and do whatever you want with. You're on Windows? Download a binary, create some WMI triggers and get executed at every boot as the same user (requires no elevation for same user, if Admin, you can get NT_AUTHORITY). If you find something to elevate to Administrator you could also patch the beginning of some rarely used syscall and then invoke it and get a thread to yourself in the kernel. These things tend to almost chain themselves sometimes. At least on Windows it feels that way. Also the user doesn't have to navigate to a specific URL in the final form, just needs to open devtools after installing the extension.
- TeMPOraL 2y ago
  No, "calc.exe upgrade" is definitely worth more than $20k to criminals, as it's a huge qualitative jump in capabilities. A full-privileged browser extension can only mess with things you actively visit in your browser. But give it "calc.exe privileges", and it now can mess with anything that touches your computer, with or without your involvement. Private keys on your hard drive, photos on your phone that you plugged in via USB to transfer something, IoT devices on your LAN - all are fair game. And so many, many other things.
- scotty79 2y ago
  Run calc.exe actually means steal money of everybody in their entire organization or blackmail the entire organization by encypting all the data they need to function.
  - echoangle 2y ago
    If compromising a single machine of a user already compromises your entire orgs IT, you’re doing something wrong, right? Shouldn’t a normal user lack privileges to do this much damage to the network?
    - scotty79 2y ago
      Everybody is doing something wrong.
thrdbndndn 2y ago
I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market." Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless. To give a straightforward answer: no, I don’t think $20k is underpaid. The severity of a bug isn't based on how it could theoretically affect people but on how it actually does. There's no evidence this is even in the wild, and based on the description, it seems complicated to exploit for attacks.
- n2d4 2y ago
  > The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.
  - thrdbndndn 2y ago
    I actually don't believe so. Not everything is priced on demand and supply -- at least not strictly. Of course the potential of abuse is part of the equation, but I think Google (or similar large companies) simply has a guideline of how the amount of the bounty is decided, than surveying the market to see what its "actual value" is. It's not exactly a free market, at least not on Google's side.
    - n2d4 2y ago
      I assure you that when Google set those bounties, they thought about how much they would have to pay white hats to make them do the right thing. Of course, it's a highly illiquid market (usually there's just one seller and only a handful of buyers), and so the pricing is super inefficient (hence based on guidelines and not surveying on every individual bug), but the logic remains.
  - luismedel 2y ago
grokkedit 2y ago
they say: `This also means that, unfortunately, the bug will not work on stable builds of Google Chrome since the release channel is set to the proper value there` So it's only working on Chromium, a way smaller attack surface than the whole Chrome users
- Thorrez 2y ago
  Slight correction: it worked on Chromium and on Google Chrome canary.
alkonaut 2y ago
If it had worked for Chrome it should (and maybe would) have been a lot higher. Also: doesn't it use an extension? I was under the impression that extensions were un-sandboxed and basically just executables I trust to run with the same privilege as the browser itself (which is a lot, at least under windows).
- Etheryte 2y ago
  No, extensions are tied to the browser sandbox and they also have to specify their permissions beforehand. They can request fairly wide permissions inside the browser sandbox, yes, but they have to explicitly list the permissions they require in the manifest and the browser will ask you if you're fine with those before installing. Outside of the browser itself, the extensions can't do pretty much anything outside of sending messages to applications that explicitly register to receive them from them.
londons_explore 2y ago
"what percentage of grandmas would lose their life savings if they stumble across this bug" is the metric I use to determine severity. And in this case, it requires a chain of unlikely events. The user tricked into installing an extension (probably not one from the store, which is now particularly hard on windows). The user tricked into opening devtools. It's gonna be sub-1%. Certainly still worth fixing, but nowhere near as bad as a universal XSS bug.
- gardenmud 2y ago
  Not only that, but it doesn't work on Google Chrome releases, only the (upstream) Chromium, and Google Chrome canary. Very few people use raw Chromium all by its lonesome and I would guess only for testing/development, not downloading random extensions.
  - TRiG_Ireland 2y ago
    I use Chromium, because I'm on Ubuntu. (Admittedly, I don't use it very often. I tend to be loyal to Firefox most of the time.)
edent 2y ago
> sell these on the black market. How? I always see this mentioned but it seem impractical to me. I've discovered bugs which have paid out a few thousand dollars - big corporates have well publicised schemes, but I've no idea how I would go about selling it to a criminal. Even if I did know where to find them - how would I trust them? Can I tell they're not really the police doing a sting? If they paid me, how would I explain my new wealth to the tax authorities? Once the criminal knows they've paid me, what's to stop them blackmailing me? Or otherwise threatening me? Oh, and I won't be able to publish a kudos-raising blog post about it. How much would a criminal have to pay me to take on that level of risk? Should Google pay out more for this? Probably. Is the average security researcher really going to take the risk of dealing with criminals in the hope that they pay a bit more? Unlikely.
- spyder 2y ago
  > How? Huh... First result in google for "selling exploits" shows it's not only criminals who are buying exploits: https://zerodium.com/program.html https://zerodium.com/program.html (up to $500K for Chrome RCE, but probably not for this since requires extension install) Another result is the Wikipedia article, which also talks about these gray markets: "Gray markets buyers include clients from the private sector, governments and brokers who resell vulnerabilities."
  - rafram 2y ago
    Zerodium sells to government intelligence agencies, so I guess it depends on your definition of “criminals.”
- scotty79 2y ago
  I think maintaining anonimity is the key. Ensuring getting paid is the next thing. I'm not sure how you can achieve this in practice.
- z3phyr 2y ago
  Sell it to governments. Biggest good guys bad guys.
faangguyindia 2y ago
Chrome needs to be rewritten in Rust asap
- z3phyr 2y ago
  Malwares are going to be written in rust; What difference does it make? Also Its not memory based vulnerability but policy based vulnerability.
  - echoangle 2y ago
    But at least the vulnerability would be blazingly fast
- gsck 2y ago
  No it doesn't? This has nothing to do with memory safety. Its a logical error, which Rust physically cannot prevent.
- j0hnyl 2y ago
  Did you even read the post?
- kernal 2y ago
  This had nothing to do with Chrome, but rather Chromium. >Considering that I'm using plain Chromium and not the branded Google Chrome, the channel will always be Channel::UNKNOWN. This also means that, unfortunately, the bug will not work on stable builds of Google Chrome since the release channel is set to the proper value there.
billy99k 2y ago
I've made lots of money with bug bounties over the years and mostly stopped this year in favor of private consulting. Companies will try anything to get out of paying, even through the major platforms. I once found a bug where I could access all of the names, addresses, emails, and phone numbers of all users for this new contest this company was running. I even found public announcements on Twitter. They told me this was a staging environment and wouldn't pay me. It clearly wasn't as the urls were linked directly to the announcement. Another time, a company had an application that allowed other companies to run internal corporate training. I was able to get access to all accounts, information, and private rooms of all fortune 500 companies using it. They initially tried to get out of it by telling me they didn't own the application anymore (and immediately removed it from scope). I had proof it was in scope at the time I found the bugs (and even confirmed it before-hand with the platform). Luckily, the platform I went through fought this and I got my payout...6 months later. Even now, I have 50+ bugs that were triaged over the past year and the companies just sit on them and won't respond or pay out. Major platforms like Hackerone and Bug crowd don't seem to protect their researchers at all.
- alt227 2y ago
  If they make excuses, sit on it, or dont pay out, release those bugs into the public domain, thats how this system works!
  - billy99k 2y ago
    While I would love to do that, I still enjoy making a living in security.
    - alt227 2y ago
      Im genuinely interested here. If you made some security bugs public due to the company not cooperating properly, would that damage your reputation in the community to the point it would jeopardise your career opportunities? From the outside looking in, it seems that the community would applaud that behavoir, but I am not familier.
deleted 2y ago
[deleted]

TheDong 2y ago

If you can trick someone into installing a malicious extension with arbitrary permissions, you can already run arbitrary code on every webpage they visit, including their logged in bank, social media, etc. You think an attacker is right now thinking "Man, I know exactly how to make a lot of victims install an extension, but I can only steal their coinbase wallet and bank accounts, if only there was a way I could run calc.exe on their machine too..." who's going to pay more than $20k to upgrade from "steal all their money" to "steal all their money and run calc.exe"?

grokkedit 2y ago
that's not entirely true: if you look at the manifest on the github repo you can see that it only requires the `tab` permission, which, when installed, will make the extension seem quite safe, since it should not have access to the content of your pages
beng-nl 2y ago
I actually think escaping the browser is a huge leap and a frequently a primary goal for a black hat. Eg someone trying to install ransomware, or a spy targeting a specific person or org. From outside the browser they can exploit kernel bugs to elevate their privilege; and they can probe the network to attempt to move laterally in the org. So while I think your comment is thoughtful, its thoughtfulness made me think of agreeing with the opposite :-)
webXL 2y ago
Correct me if I’m wrong, but remote code execution has the advantage of being able to access information without the user being involved at all. Sure the user needs to install and trigger the exploit, but whatever code the attacker runs doesn’t require the user to interact with certain urls. If you can launch arbitrary programs, you can probably install all sorts of nasty things that are potentially more lucrative than the victim’s bank or coinbase accounts.
- therein 2y ago
  It breaks the assumption that Chrome is sandboxed and something I do as a user including installing an extension will not have an impact outside of Chrome. A new process outside Chrome to call your own and do whatever you want with. You're on Windows? Download a binary, create some WMI triggers and get executed at every boot as the same user (requires no elevation for same user, if Admin, you can get NT_AUTHORITY). If you find something to elevate to Administrator you could also patch the beginning of some rarely used syscall and then invoke it and get a thread to yourself in the kernel. These things tend to almost chain themselves sometimes. At least on Windows it feels that way. Also the user doesn't have to navigate to a specific URL in the final form, just needs to open devtools after installing the extension.
TeMPOraL 2y ago
No, "calc.exe upgrade" is definitely worth more than $20k to criminals, as it's a huge qualitative jump in capabilities. A full-privileged browser extension can only mess with things you actively visit in your browser. But give it "calc.exe privileges", and it now can mess with anything that touches your computer, with or without your involvement. Private keys on your hard drive, photos on your phone that you plugged in via USB to transfer something, IoT devices on your LAN - all are fair game. And so many, many other things.
scotty79 2y ago
Run calc.exe actually means steal money of everybody in their entire organization or blackmail the entire organization by encypting all the data they need to function.
- echoangle 2y ago
  If compromising a single machine of a user already compromises your entire orgs IT, you’re doing something wrong, right? Shouldn’t a normal user lack privileges to do this much damage to the network?
  - scotty79 2y ago
    Everybody is doing something wrong.

thrdbndndn 2y ago

I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market." Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless. To give a straightforward answer: no, I don’t think $20k is underpaid. The severity of a bug isn't based on how it could theoretically affect people but on how it actually does. There's no evidence this is even in the wild, and based on the description, it seems complicated to exploit for attacks.

n2d4 2y ago
> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.
- thrdbndndn 2y ago
  I actually don't believe so. Not everything is priced on demand and supply -- at least not strictly. Of course the potential of abuse is part of the equation, but I think Google (or similar large companies) simply has a guideline of how the amount of the bounty is decided, than surveying the market to see what its "actual value" is. It's not exactly a free market, at least not on Google's side.
  - n2d4 2y ago
    I assure you that when Google set those bounties, they thought about how much they would have to pay white hats to make them do the right thing. Of course, it's a highly illiquid market (usually there's just one seller and only a handful of buyers), and so the pricing is super inefficient (hence based on guidelines and not surveying on every individual bug), but the logic remains.
- luismedel 2y ago

grokkedit 2y ago

they say: `This also means that, unfortunately, the bug will not work on stable builds of Google Chrome since the release channel is set to the proper value there` So it's only working on Chromium, a way smaller attack surface than the whole Chrome users

Thorrez 2y ago
Slight correction: it worked on Chromium and on Google Chrome canary.

alkonaut 2y ago

If it had worked for Chrome it should (and maybe would) have been a lot higher. Also: doesn't it use an extension? I was under the impression that extensions were un-sandboxed and basically just executables I trust to run with the same privilege as the browser itself (which is a lot, at least under windows).

Etheryte 2y ago
No, extensions are tied to the browser sandbox and they also have to specify their permissions beforehand. They can request fairly wide permissions inside the browser sandbox, yes, but they have to explicitly list the permissions they require in the manifest and the browser will ask you if you're fine with those before installing. Outside of the browser itself, the extensions can't do pretty much anything outside of sending messages to applications that explicitly register to receive them from them.

londons_explore 2y ago

"what percentage of grandmas would lose their life savings if they stumble across this bug" is the metric I use to determine severity. And in this case, it requires a chain of unlikely events. The user tricked into installing an extension (probably not one from the store, which is now particularly hard on windows). The user tricked into opening devtools. It's gonna be sub-1%. Certainly still worth fixing, but nowhere near as bad as a universal XSS bug.

gardenmud 2y ago
Not only that, but it doesn't work on Google Chrome releases, only the (upstream) Chromium, and Google Chrome canary. Very few people use raw Chromium all by its lonesome and I would guess only for testing/development, not downloading random extensions.
- TRiG_Ireland 2y ago
  I use Chromium, because I'm on Ubuntu. (Admittedly, I don't use it very often. I tend to be loyal to Firefox most of the time.)

edent 2y ago

> sell these on the black market. How? I always see this mentioned but it seem impractical to me. I've discovered bugs which have paid out a few thousand dollars - big corporates have well publicised schemes, but I've no idea how I would go about selling it to a criminal. Even if I did know where to find them - how would I trust them? Can I tell they're not really the police doing a sting? If they paid me, how would I explain my new wealth to the tax authorities? Once the criminal knows they've paid me, what's to stop them blackmailing me? Or otherwise threatening me? Oh, and I won't be able to publish a kudos-raising blog post about it. How much would a criminal have to pay me to take on that level of risk? Should Google pay out more for this? Probably. Is the average security researcher really going to take the risk of dealing with criminals in the hope that they pay a bit more? Unlikely.

spyder 2y ago
> How? Huh... First result in google for "selling exploits" shows it's not only criminals who are buying exploits: https://zerodium.com/program.html https://zerodium.com/program.html (up to $500K for Chrome RCE, but probably not for this since requires extension install) Another result is the Wikipedia article, which also talks about these gray markets: "Gray markets buyers include clients from the private sector, governments and brokers who resell vulnerabilities."
- rafram 2y ago
  Zerodium sells to government intelligence agencies, so I guess it depends on your definition of “criminals.”
scotty79 2y ago
I think maintaining anonimity is the key. Ensuring getting paid is the next thing. I'm not sure how you can achieve this in practice.
z3phyr 2y ago
Sell it to governments. Biggest good guys bad guys.

faangguyindia 2y ago

Chrome needs to be rewritten in Rust asap

z3phyr 2y ago
Malwares are going to be written in rust; What difference does it make? Also Its not memory based vulnerability but policy based vulnerability.
- echoangle 2y ago
  But at least the vulnerability would be blazingly fast
gsck 2y ago
No it doesn't? This has nothing to do with memory safety. Its a logical error, which Rust physically cannot prevent.
j0hnyl 2y ago
Did you even read the post?
kernal 2y ago
This had nothing to do with Chrome, but rather Chromium. >Considering that I'm using plain Chromium and not the branded Google Chrome, the channel will always be Channel::UNKNOWN. This also means that, unfortunately, the bug will not work on stable builds of Google Chrome since the release channel is set to the proper value there.

billy99k 2y ago

I've made lots of money with bug bounties over the years and mostly stopped this year in favor of private consulting. Companies will try anything to get out of paying, even through the major platforms. I once found a bug where I could access all of the names, addresses, emails, and phone numbers of all users for this new contest this company was running. I even found public announcements on Twitter. They told me this was a staging environment and wouldn't pay me. It clearly wasn't as the urls were linked directly to the announcement. Another time, a company had an application that allowed other companies to run internal corporate training. I was able to get access to all accounts, information, and private rooms of all fortune 500 companies using it. They initially tried to get out of it by telling me they didn't own the application anymore (and immediately removed it from scope). I had proof it was in scope at the time I found the bugs (and even confirmed it before-hand with the platform). Luckily, the platform I went through fought this and I got my payout...6 months later. Even now, I have 50+ bugs that were triaged over the past year and the companies just sit on them and won't respond or pay out. Major platforms like Hackerone and Bug crowd don't seem to protect their researchers at all.

alt227 2y ago
If they make excuses, sit on it, or dont pay out, release those bugs into the public domain, thats how this system works!
- billy99k 2y ago
  While I would love to do that, I still enjoy making a living in security.
  - alt227 2y ago
    Im genuinely interested here. If you made some security bugs public due to the company not cooperating properly, would that damage your reputation in the community to the point it would jeopardise your career opportunities? From the outside looking in, it seems that the community would applaud that behavoir, but I am not familier.

deleted 2y ago

[deleted]