3 ms·

Looks like the "Write Once, Run Anywhere" Java mantra is true for malware too. Pretty much any run-of-the-mill Windows PC, Mac or Linux machine is vulnerable to

Looks like the "Write Once, Run Anywhere" Java mantra is true for malware too. Pretty much any run-of-the-mill Windows PC, Mac or Linux machine is vulnerable to this. http://en.wikipedia.org/wiki/Write_once,_run_anywhere http://en.wikipedia.org/wiki/Write_once,_run_anywhere

nivla 14y ago
This is true of any cross platform language, the job of making the exploit work across different OS gets efficiently transferred to the compiler. One of the main reasons I am worried if webkit becomes monolithic, zero day exploits, there will be no running away from it.
- eksith 14y ago
  It's not the language so much the isolation in the VM. Normally, there would be safegards against privilege escalation (since remote code execution is a feature, not a bug). This is just a factor of Oracle not paying attention to a product they bought. When Cisco let Linksys (in the consumer market) stagnate, we ended up with lackluster hardware. Not a big deal. When Oracle ignored Java in the consumer market, the damage is quite a bit more extensive due to its sheer ubiquity.
  - chc 14y ago
    You're talking about something different than nivia was. That comment was in reference to "write once, run anywhere" meaning that malware became cross-platform. A malicious Python app can do malicious things on any platform with Python just like a malicious Java app can do bad things anywhere you have Java. The fact that this is exploitable through a browser plugin makes the risk of infection worse, but doesn't actually make it more cross-platform, per se.
    - eksith 14y ago
      Yes but Python also isn't generally distributed the same way. You could argue the same about the C++ redistributable across Windows and even .Net (I think 4.0 runs on XP), but malware for these are still executables. Silverlight may be the only common ground, but then that's the same as Flash, Acrobat or similar plugin. And as you say it certainly doesn't run in the browser on so many disparate systems making watering hole attacks not nearly as damaging if there were to be Python malware in the wild (and I'm sure there are).
- twistedpair 14y ago
  Look at the exploits over the last few years. JS, JS in Acrobat, Flash, Java. Any sort of VM with sandboxing is fair game. So long for the really low hanging fruit of straight up VB attacks. Further still, there are attacks through even the most apparently harmless types like maliciously formatted images. If the web was my everyday world, I'd be concerned walking down the street that lines on the street would strangle me.
KMag 14y ago
Incorrect. Even malware targeting write-once-run-anywhere systems is rarely write-once-run-anywhere itself. The actual shellcode of the exploit is almost always native code, or a native binary dropped on the filesystem via a directory traversal bug. The attacker typically has to determine the system being attacked and use system-specific shellcode, even for system-independent vulnerabilities. The JIT or bytecode interpreter is rarely directly leveraged by the exploit code itself. In other words, the shellcode is almost never bytecode. Write once run anywhere isn't the problem. Write once run anywhere is just a feature that greatly increases the number of machines with a given piece of vulnerable software installed. VMs also tend to be big complicated pieces of software with a huge attack surface, and tend to be written in unsafe languages (C/C++). If 99% of all browsers used very similar versions of libpng, all with the same vulnerability, we'd see this same problem. Software monoculture combined with poor incentives to write secure software is the problem. Edit: since write-once-run-anywhere languages tend to be more safe, it's a shame that more VMs aren't written in (subsets of) their hosted languages. Jikes RVM, PyPy, and Squeak Smalltalk are some notable exceptions.

nivla 14y ago

This is true of any cross platform language, the job of making the exploit work across different OS gets efficiently transferred to the compiler. One of the main reasons I am worried if webkit becomes monolithic, zero day exploits, there will be no running away from it.

eksith 14y ago
It's not the language so much the isolation in the VM. Normally, there would be safegards against privilege escalation (since remote code execution is a feature, not a bug). This is just a factor of Oracle not paying attention to a product they bought. When Cisco let Linksys (in the consumer market) stagnate, we ended up with lackluster hardware. Not a big deal. When Oracle ignored Java in the consumer market, the damage is quite a bit more extensive due to its sheer ubiquity.
- chc 14y ago
  You're talking about something different than nivia was. That comment was in reference to "write once, run anywhere" meaning that malware became cross-platform. A malicious Python app can do malicious things on any platform with Python just like a malicious Java app can do bad things anywhere you have Java. The fact that this is exploitable through a browser plugin makes the risk of infection worse, but doesn't actually make it more cross-platform, per se.
  - eksith 14y ago
    Yes but Python also isn't generally distributed the same way. You could argue the same about the C++ redistributable across Windows and even .Net (I think 4.0 runs on XP), but malware for these are still executables. Silverlight may be the only common ground, but then that's the same as Flash, Acrobat or similar plugin. And as you say it certainly doesn't run in the browser on so many disparate systems making watering hole attacks not nearly as damaging if there were to be Python malware in the wild (and I'm sure there are).
twistedpair 14y ago
Look at the exploits over the last few years. JS, JS in Acrobat, Flash, Java. Any sort of VM with sandboxing is fair game. So long for the really low hanging fruit of straight up VB attacks. Further still, there are attacks through even the most apparently harmless types like maliciously formatted images. If the web was my everyday world, I'd be concerned walking down the street that lines on the street would strangle me.

KMag 14y ago

Incorrect. Even malware targeting write-once-run-anywhere systems is rarely write-once-run-anywhere itself. The actual shellcode of the exploit is almost always native code, or a native binary dropped on the filesystem via a directory traversal bug. The attacker typically has to determine the system being attacked and use system-specific shellcode, even for system-independent vulnerabilities. The JIT or bytecode interpreter is rarely directly leveraged by the exploit code itself. In other words, the shellcode is almost never bytecode. Write once run anywhere isn't the problem. Write once run anywhere is just a feature that greatly increases the number of machines with a given piece of vulnerable software installed. VMs also tend to be big complicated pieces of software with a huge attack surface, and tend to be written in unsafe languages (C/C++). If 99% of all browsers used very similar versions of libpng, all with the same vulnerability, we'd see this same problem. Software monoculture combined with poor incentives to write secure software is the problem. Edit: since write-once-run-anywhere languages tend to be more safe, it's a shame that more VMs aren't written in (subsets of) their hosted languages. Jikes RVM, PyPy, and Squeak Smalltalk are some notable exceptions.