4 ms·

Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interf

by RyanZAG 13y ago

Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.

est 13y ago
With DNS hijack, everyone can remote execute.
- RyanZAG 13y ago
  No, HTTPS only. So probably only Google or the NSA, I guess.
  - psionski 13y ago
    Well, it's not like you can't buy a valid certificate for google.com from a turkish CA that is trusted by all browsers... This has happened before, the only question is how much you're willing to pay.
    - Aissen 13y ago
      There's also hardcoded HSTS pining for Google certificates, preventing this.
      - est 13y ago
        How does HSTS deal with expired certs?
darren_ 13y ago
> Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/dev/&sq=package:chromium&type=cs https://code.google.com/p/chromium/codesearch#chromium/src/p...? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.
- RyanZAG 13y ago
  Well there is https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/dev/ppb_testing_dev.h&sq=package:chromium&type=cs https://code.google.com/p/chromium/codesearch#chromium/src/p... and https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions/dev/ppb_ext_events_dev.h https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions... I haven't looked deeply, but both seem to allow for access outside the sandbox. Maybe a chromium committer could give more detail on the safety of the dev interfaces. They are blocked from public usage for a reason though.
  - rmac 13y ago
    which parts of the above code/api allow access outside of the sandbox?
  - simias 13y ago
    Eh, using structs for namespacing in C. I hadn't seen that in a while.
  - yzshen 13y ago
    They don't enable access outside the sandbox and should be pretty safe. PPB_Testing_Dev is a set of helpers for writing tests: querying status of the plugin; running nested message loop to wait for results of async operations; simulate input events which are received only by the plugin itself. PPB_Ext_Events_Dev is for registering/unregistering events provided by Chrome apps apis (http://developer.chrome.com/apps/api_index.html http://developer.chrome.com/apps/api_index.html). It will only be accessible when the NaCl module is included in a Chrome app. This interface hasn't been implemented yet.
ams6110 13y ago
I only use Chrome to access Google apps/docs/gmail, since it seems to work better than other browsers for this. Looking like it might be worth setting up a VM appliance for this now.
- Benferhat 13y ago
  Firefox is more performant on my Ubuntu box than Chromium, even for things like Gmail and Google Docs.
acdha 13y ago
> In effect, this gives Google remote code execution rights from their domains on anybody running Chromium. If you're running Chrome, you've already given them code execution rights – the only thing this does is make it slightly harder to detect.

by RyanZAG 13y ago

est 13y ago

With DNS hijack, everyone can remote execute.

RyanZAG 13y ago
No, HTTPS only. So probably only Google or the NSA, I guess.
- psionski 13y ago
  Well, it's not like you can't buy a valid certificate for google.com from a turkish CA that is trusted by all browsers... This has happened before, the only question is how much you're willing to pay.
  - Aissen 13y ago
    There's also hardcoded HSTS pining for Google certificates, preventing this.
    - est 13y ago
      How does HSTS deal with expired certs?

darren_ 13y ago

> Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/dev/&sq=package:chromium&type=cs https://code.google.com/p/chromium/codesearch#chromium/src/p...? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.

RyanZAG 13y ago
Well there is https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/dev/ppb_testing_dev.h&sq=package:chromium&type=cs https://code.google.com/p/chromium/codesearch#chromium/src/p... and https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions/dev/ppb_ext_events_dev.h https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions... I haven't looked deeply, but both seem to allow for access outside the sandbox. Maybe a chromium committer could give more detail on the safety of the dev interfaces. They are blocked from public usage for a reason though.
- rmac 13y ago
  which parts of the above code/api allow access outside of the sandbox?
- simias 13y ago
  Eh, using structs for namespacing in C. I hadn't seen that in a while.
- yzshen 13y ago
  They don't enable access outside the sandbox and should be pretty safe. PPB_Testing_Dev is a set of helpers for writing tests: querying status of the plugin; running nested message loop to wait for results of async operations; simulate input events which are received only by the plugin itself. PPB_Ext_Events_Dev is for registering/unregistering events provided by Chrome apps apis (http://developer.chrome.com/apps/api_index.html http://developer.chrome.com/apps/api_index.html). It will only be accessible when the NaCl module is included in a Chrome app. This interface hasn't been implemented yet.

ams6110 13y ago

I only use Chrome to access Google apps/docs/gmail, since it seems to work better than other browsers for this. Looking like it might be worth setting up a VM appliance for this now.

Benferhat 13y ago
Firefox is more performant on my Ubuntu box than Chromium, even for things like Gmail and Google Docs.

acdha 13y ago

> In effect, this gives Google remote code execution rights from their domains on anybody running Chromium. If you're running Chrome, you've already given them code execution rights – the only thing this does is make it slightly harder to detect.