4 ms·
This is a terrible idea. The author needs to stop what they're doing right now, from a security context this is really quite dangerous. Arc uses a desktop virt
by iuguy 13y ago
This is a terrible idea. The author needs to stop what they're doing right now, from a security context this is really quite dangerous.
Arc uses a desktop virtualisation tool to run arbitrary code on your system. The manifest provides a set of packages to download and install and a series of commands to execute inside the downloaded Arc VM image. A malicious server could use this to run an app that attacks your network, the host, acts as a bot, anything.
I'm assuming that in order to run native code like this, there's no sandboxing. I've seen no mention of it. There's a reason you can't run native code in the browser without restrictions, and this bypasses all of that.
- hyperion2010 13y agoThere is sandboxing. The native code is not run in the browser or by the host OS. The native code is executed inside a linux guest running on virtual box. The browser itself does not run any native code. Others have pointed out that there are still security concerns having an arbitrary code execution device suddenly appear inside your network.
- iuguy 13y ago> There is sandboxing. I think I missed that. Can you point me to the bit in the source code where the sandboxing is so I can have a look and assuming it's good retract any claims about a lack of sandboxing I may have made?
- AlexanderDhoore 13y agoA lot of comments below recognise this. Most people here probably know... It's doomed to go wrong. This isn't supposed to be anything more than a neat tool. But still quite an interesting experiment, no?
- iuguy 13y agoAs experiments go, it's as interesting as changing genes in foetuses to produce blonde kids. It's stuff that might seem intellectually interesting but falls into the category of things people shouldn't do because of the consequences.
- grun 13y agoAn attacker would have three primary avenues of attack: 1) Escape the virtual machine sandbox. 2) Denial of service of host resources. 3) Attack network services. For 1), virtual machines provide strong, hardware supported isolation of the host. They can't access the filesystem, resources, or hardware of the host, only their own. For 2), virtual machines also provide strong protection from the denial of service of host resources. Virtual machines can be restricted in memory, CPU, and device use while running. This occurs routinely with virtual machines provisioned on servers. Network services, 3), are the largest attack vector not protected by encapsulation within a virtual machine. One weapon virtual machines do posses, however, is complete control over the virtual NIC. Every packet sent or received can be inspected, modified, or discarded. Arc's network policy is not carved in stone. There is nothing preventing Arc from adopting a same-origin policy, like browsers. Perhaps it will.
- rohansingh 13y agoAnother attack vector is to attack the Arc application itself, perhaps with a malformed manifest or something similar. The entire Arc application presents a huge surface area.
- AlexanderDhoore 13y agoHey, I'm the guy being negative in the other comment. I'm sorry about that. Honest question: Do you really think this could be deployed on a large scale? Without reenacting the security nightmare that is Java Applets? You better be very sure about that...
- ori_b 13y agoJava applets aren't isolated from the host OS by the hardware. This is.
- andreasvc 13y agoI don't see the fundamental difference: both run on a virtual machine, and in both cases it is likely that the isolation will be broken by exploits. And just because it's hardware doesn't mean it's less likely to contain bugs...
- Widdershin 13y agoIf this truly has the malicious potential you claim, what would stop someone with bad intents just making it themselves?
- k_swill_utils 13y agoUsers have to download this software in order for an attack to be made. Ideally it would only gain acceptance if it was very secure but Java applets are a great example of that not being the case.