7 ms·
Down go all the major browsers at Pwn2Own
- chinpokomon 13y agoHow did ChromeOS fair? I can understand how general purpose OSs can be pwn'd, but I'm more curious about how mobile platforms such as iOS, Windows RT, Android, and ChromeOS hold up to these competitions.
- georgemcbay 13y agoChromeOS/Pwnium 4: https://plus.google.com/+GoogleChromeDevelopers/posts/QbtZ7A8knW7 https://plus.google.com/+GoogleChromeDevelopers/posts/QbtZ7A... Looks like one full-blown exploit (of an unknown nature but serious enough to get the $150,000 award), but maybe specific to a single device (HP Chromebook 11), and one partial exploit on the same device. Unclear from the blog post if the issue is something very specific to that one HP device or if it is ARM-platform related and impacts the Samsung ARM Chromebook as well since AFAIK Pwnium was just focusing specifically on a couple of newer ChromeOS devices.
- fijal 13y agoI wonder when will people realise that writing browsers in a language like C++ is not a good idea if you're semi-serious about security.
- CJefferson 13y agoWhat do you think a sensible alternative is? I have serious problems with C++, but few people (including me) would accept a "security upgrade" which made my browser significantly slower and memory hungry.
- wyager 13y agoRust or Go would be pretty straightforward replacements for C++. Mozilla is actively using Rust to make Servo. I think both Rust and Go are less conducive to bugs than C++. There are other languages that could be used to write very secure browsers, but using them wouldn't necessarily be straightforward.
- CJefferson 13y agoCertainly Rust is aimed in that direction. I'm unconvinced one could (for example) write a high-performance javascript JIT in Go. Also, neither of those languages has been around anywhere near long enough for a browser to be written in this (Rust still isn't finished!), so insulting people for writing browsers in C++ without suggesting a useful alternative doesn't seem very sensible.
- deluvas 13y agoMind if I ask, what's up with these languages, showing up everywhere on (Rust/Go)? Are they that useful? Can you summarize for me what are they good at?
- wyager 13y agoThey're relatively straightforward procedural object-oriented languages. They're not amazing. They won't make you say "Wow, that's awesome!" when you use them. They do have a few practical advantages over C++. For one, they don't allow dangerous things like pointer manipulation. They both support garbage collection. Go has some nice built-in support for multithreading. Both have some nice iteration features. Useful syntactic sugar. Stuff like that. Where C++ is basically just C with random features shoddily spot-welded on in different places, Go and Rust were designed from the ground up to be relatively very simple and straightforward. Like I said, they're not amazing; they're just better than C++.
- pjmlp 13y agoModula-2 was a possible alternative around the early 80's, back when C compilers were still slower than dumb written Assembly language on micro-computers. Sadly UNIX spread into the enterprise and with it brought C to the masses and spread the doom of security we still enjoy. C++ is way safer than C, if one use modern C++ instead of C underpinning that allowed the language to become mainstream. Now, we have to hope languages like Rust and D might recover what Ada, Modula-2 did not managed to become.
- krick 13y agoAda is too complex. It might be acceptable if you are talking about small group of specialists that always produce nice code, but large open-source project in Ada… Well, I'm not sure it's better than C++.
- renox 13y ago> Ada is too complex. Compared to what? C++? You're joking right?? > Well, I'm not sure it's better than C++. I disagree, Ada is complex ok, but its default behaviour is much better for security than C++.
- krick 13y ago> You're joking right?? Not at all. Well, maybe not compared to C++, but still, it doesn't seem like really plausible alternative, that can be recommended and seriously used in a complex application. Dijkstra agrees. ;) > but its default behaviour is much better for security than C++ Oh, sure. But that could be said about pretty much every language out there. Somebody recommends Haskell. Haskell's default behavior is way better than C++. It's not enough. Actually, I never saw big projects in Ada, so I can be wrong, but it seems to me that for typical more or less sane programmer might be even easier to write hard-to-understand code in Ada than in C++, even though Ada is much better designed. The reason is that C++ complexity is well known, many of it's features considered dangerous and most of people seem to avoid them. That's not true for Ada, and it's also very feature-rich. If anything: there are many things about Ada I like. Its data type system, for example. It's really a shame that after C many programmers somehow "forgot" that all that stuff exists.
- lhgaghl 13y agoOff the top of my head, any of these would have been a much more sane choice: Standard ML, Ada, Java, concatenative languages, E, Lisp, Haskell, Erlang, Python. > few people (including me) would accept a "security upgrade" which made my browser significantly slower and memory hungry. I can't tell if this is a joke. You know practically website is constantly running the shittiest JS you can imagine (and sometimes Actionscript), right? Even if the language somehow can't handle implementing a certain task efficiently, you could still make a separate OS process for say, decoding the video stream, and passing it back to the safe code. If you think there is a technical reason that browsers/OS today are written in C/C++ you are wrong. The reasons are purely circumstantial. Also note that most C/C++ coders aren't aware that other languages even exist or are practical, so good luck getting them to switch.
- krick 13y agoGod, I hate that "link expired" stuff. I wrote you a pretty long response and failed to save it in exchange buffer. It was covering every language you mentioned (except Java, which also is pretty horrible), but as I'm not willing to reproduce it, so let's concentrate on what bothers me: Haskell. So, the essential. If Haskell is "better" than someting else, then, by definition, it's easier to write good software in it. I wrote about my personal experience in the lost reply, but it doesn't really matter. The question is, why people who believe that Haskell is better for writing browsers won't prove it themself? By doing, I mean. I haven't seen a popular (lets take it as quality measure) browser, P2P client, feature-full messaging client/service or image editing app written in Haskell. Only pandoc, Xmonad, Yi and countless links to haskell.org success-story page, which isn't working app. Actually, it's true for any language, but nothing is mentioned as often as Haskell.
- lhgaghl 13y ago> God, I hate that "link expired" stuff. Heh, I use tor, and it just took me over 10 tries to login to reply to you (changing exit nodes to find one that isn't blocked, etc). If you don't like Haskell for some reason, replace it with something else. Heck, a browser in pure JS would be preferable to a browser in C (note: it doesn't count if you have 50 libraries implementing audio/visual/crypto/compression written in C and linked into the same address space as the JS). But it takes huge capital to implement a browser, and you'll still have the other issues like CSRF, clickjacking, phishing (each of which have been solved ages ago by waterken btw: http://waterken.sourceforge.net/web-key/ http://waterken.sourceforge.net/web-key/), X.509 (which has been solved by tor hidden addresses and other systems like it), and other mystical issues that arise because of how incoherently-designed the web is. Anyways, why do you think C would be any better for implementing a browser than any of these languages?
- renox 13y ago>What do you think a sensible alternative is? "sensible" is all in the eye of the beholder, once you have your computer hacked your priorities may change.. > but few people (including me) would accept a "security upgrade" which made my browser significantly slower and memory hungry. And THAT is the issue, security CANNOT be an afterthought.. Note that significantly slower doesn't mean slow, PC's CPUs are very, very fast.
- kybernetikos 13y agoThe mozilla guys know this already. They've specifically talked about how many serious security bugs would have been caught by using a language like Rust.
- hdevalence 13y agoI'll just point out this thing over here: https://github.com/mozilla/servo https://github.com/mozilla/servo
- nightski 13y agoIt is an interesting project but they have stated numerous times there are no plans to release it as an actual product.
- deluvas 13y agoCan you explain why that's not a good idea? I have no clue, really, but I'm guessing something about libraries.
- aroman 13y agoNo, it's because writing software in C++ is like riding your bike in the middle lane of a highway with no helmet on. If you're really really careful, it can work fine, and your trip will be efficient and productive. But it's really hard to do it properly -- you could hit a car (buffer overflow), you could get hit by someone (heap overflow), or your brakes might give out (input sanitization fail). It's not that it's impossible or that it's a "bad idea", it's just that it'd be a lot safer to spend the extra resources on a motorcycle (Python) or an SUV (Rust).
- TillE 13y agoC is irreducibly dangerous, but you can do quite a lot with C++ by avoiding legacy C stuff. Build almost everything on top of the STL and Boost, which are safe. And of course there are security bugs (eg, goto fail) that would affect any language.
- pjmlp 13y agoFully agree, mankind would be better without C and C++. But given they are the current mainstream options for the time of applications they are used to, better use modern C++ like you are advocating and stay as far as possible from any pure C constructs. Additionally use static analyser, enable all warnings as errors and turn on pedantic mode.
- munin 13y ago> Build almost everything on top of the STL and Boost, which are safe. this is not really true, you can have temporal memory safety issues using STL and boost.
- jkrems 13y agoThe examples should be the other way around. Very safe and simple to drive but slower and not that powerful: bike an a proper bike lane (Python). Reasonably safe & fast: SUV (Rust). Really fast and you can do crazy things (drive on one wheel at 200km/h) but also enormously dangerous: Motorcycle (C/C++).
- WizzleKake 13y agoMaybe at the same time people realize that writing operating systems in a language like C is not a good idea if you're semi-serious about security. ...
- Pacabel 13y agoIt has been tried before. One example I can think of immediately is Grail, which was implemented in Python: https://en.wikipedia.org/wiki/Grail_%28web_browser%29 https://en.wikipedia.org/wiki/Grail_%28web_browser%29 Another is HotJava, which was implemented in Java by Sun: https://en.wikipedia.org/wiki/HotJava https://en.wikipedia.org/wiki/HotJava The results were less than stellar. Neither browser was really comparable to contemporary browsers written in C or C++ in terms of features and performance. Those factors are just too important to overlook, even in the name of security.
- nly 13y agoEven for C++ we have the language, compiler and runtime features to mitigate the majority of these attacks. The problem is nobody wants to pay the runtime cost and/or risk breaking old binaries.
- thefreeman 13y agoDo they release more technical information on the exploits after the browser makers have had time to produce patches? The things these guys do always blow my mind. At the same time it just reinforces the point that if you are targeted by an entity with enough resources there is pretty much nothing you can do to prevent exploitation. I am pretty sure all browsers get "pwned" at nearly all of these competitions.
- Spittie 13y agoSince the article cite it, I guess I can make a comment too and raise awareness regarding EMET. EMET is a free application published by Microsoft (http://www.microsoft.com/en-us/download/details.aspx?id=39273 http://www.microsoft.com/en-us/download/details.aspx?id=3927...) that enable advanced protections for many applications, such as DEP and ASRL. It comes out of the box with rules that cover many popular applications, so it's an "install and forget" solution for many users. If anyone is interested, this is the article that made me aware of EMET: http://rationallyparanoid.com/articles/microsoft-emet-3.html http://rationallyparanoid.com/articles/microsoft-emet-3.html (slightly outdates as Microsoft has released EMET 4, but it's still an interesting read, especially the "Does EMET make a difference?" part), and there is also an interesting user guide here: http://download.microsoft.com/download/4/E/9/4E9A5137-F73D-4A4C-9192-444810C26F6B/EMET%204.0%20User's%20Guide.pdf http://download.microsoft.com/download/4/E/9/4E9A5137-F73D-4... I suggest to everyone to gave it a try, it's very lightweight and it has yet to cause a single problem on my system.
- skymt 13y agoI'd suggest that EMET users should add the Flash plugin to EMET's list, as it's a common target that isn't protected by default. Unfortunately the Flash exe's name changes with every version, so it's not set-and-forget. Adding an application to EMET is simple for a user with some amount of Windows knowledge. Its main window has a list of running processes. Just right-click the one you want to protect and choose "configure process."
- maaaats 13y agoI've skimmed the links, and have some questions: How does it prevent these things? And why isn't it enabled by default in Windows?
- skymt 13y agoEMET offers a grab-bag of mitigation techniques that are described in some detail in its manual (PDF download): http://download.microsoft.com/download/4/E/9/4E9A5137-F73D-4A4C-9192-444810C26F6B/EMET%204.0%20User%27s%20Guide.pdf http://download.microsoft.com/download/4/E/9/4E9A5137-F73D-4... Some of these techniques are enabled by default or on an opt-in basis in recent versions of Windows, and EMET can be used to enable them on older Windows systems. Other techniques would be too easily triggered by the normal operation of badly-written software, making the software unusably crashy.
- ryandetzel 13y agoI can't find how these are executed. Are they sites that have malicious code on them? Are they required to have a certain plugin install (e.g. flash)?
- dobbsbob 13y agoWould be nice if more information on these exploits were provided, such as would a GrSecurity reinforced sandbox (or SELinux sandbox for that matter) for Chromium have stopped the exploit from gaining a shell, or the OpenBSD priv separation of X Do they release the exploits after patching? I want to run unpatched versions on said above configurations or at least be able to read the code to see if it's yet another javascript problem.
- eliteraspberrie 13y agoThese exploits usually target browsers running on Windows, which until recently did not have ASLR or DEP enabled by default (and still doesn't in the case of some browser plugins). Many Linux distros like Debian or Ubuntu have had RELRO, SSP, PIE, and ASLR enabled by default for browsers for a few years now. PaX and Grsecurity would indeed protect against all of these exploits -- up until one or two years ago. These newest exploits are way out of my league, and I don't know if anything could stop their authors.
- guardian5x 13y agoI love the pwn2own contest, because it shows all the fanboys that their OS/browser is not secure, because they hack pretty much all, every year.
- azakai 13y agoExcept for linux :P I kid, of course. Last I heard they don't even target it in the competition. But maybe neither do hackers ;)
- viraptor 13y agoTo some extent it's true though. If you want to do things the paranoid way, then Linux does offer you many more possibilities of protection. For example setting up different profiles for social networks / banking / random browsing / ... and protecting them externally to the browser using selinux/tomoyo/apparmor/whatever-you-prefer (or even go full virt with qubes!) will give you much more security - no breakout on a random page will be able to touch your sensitive data. And it doesn't even matter what the browser exploit does.
- pfraze 13y agoI'm trying out Qubes on my next install - it just looks too cool not to try.
- marcosdumay 13y agoFunny thing. I looked at my logs, and only today there were 6 attempts of getting into my computer, originating in different countries. And that's because the lamer ones don't get far enough to go into the logs.
- blibble 13y agothis is why I have a hard time believing that cryptocurrencies will achieve mass adoption: eventually everyone gets hit by a 0-day, and then your money is gone forever. (I realise cold storage exists, but most people won't bother...)
- thisiswrong 13y agoSo you think people will prefer to use worthless plastic/paper currencies that are continuously deflated by governments to fund war and oppression? Cryptocurrencies will streamline the new digital economy - which encompasses all of our lives. Hardware wallets will soon allow people to secure their money with ease. Cryptocurrencies will revolutionize the world in ways that we don't yet understand. It's hard to conceptualize, but bitcoin the 'currency' is so insignificant compared to bitcoin the 'invention'.
- mpyne 13y ago> So you think people will prefer to use worthless plastic/paper currencies that are continuously deflated by governments to fund war and oppression? The currencies are continuously inflated, not deflated. But either way, do you seriously think that governments won't simply use cryptocurrencies to fund both war and oppression if those cryptocurrencies ever become popular? Can you possibly be that naïve? At best you'd decouple currency from government to make the concepts orthogonal, but Bitcoin won't get rid of oppression or war, let alone crime like theft and murder-for-hire.
- PeterisP 13y agoThe main way that governments obtain funds for "war and oppression" isn't by disbursing fiat money, but by taxes. If we switch to 100% cryptocurrencies, taxation won't go away, even if it'd have to be done Roman-style, before such things as 'income declarations' existed; and the cryptocurrencies will no more allow people to "secure their money with ease" than gold allows today.
- erikpukinskis 13y agoCash has the same problem, which is why banks and credit cards exist. There's no reason your bank account and your VISA card couldn't be denominated in Bitcoins, affording you exactly the same protections you have now. You might lose $100 out of your smartphone wallet every now and then. But that will hopefully be rare.
- Rizz 13y agoA bit off topic perhaps, but is it fair, as the article does, to call these hackers "white hat"? Especially Vupen which sells to the highest bidder(s), although selected, should be considered black hat, as they don't work with the intention of securing software, they even advertise on their site that they will sell the worst security holes for offensive use only.
- bluefinity 13y agoIf you read their page on offensive 0days, it states they only sell to non-embargoed government agencies. I wouldn't really consider that black-hat.
- meowface 13y agoDepends, do you consider NSA's TAO white hats or black hats? :)
- RoboTeddy 13y agoWere these bugs discovered during the contest, or were part or all of the exploits discovered beforehand?
- letstryagain 13y agoBeforehand. The contestants work on finding exploits before coming to the event.
- contingencies 13y agoMotivated by the same, a couple of days ago I went to the trouble of downloading rust and building Mozilla Servo. Unfortunately, if my build is anything to go by, it won't even render most pages yet, so that practical alternative path is presently closed.
- deleted 13y ago[deleted]
- PhantomGremlin 13y agoI want to see a new contest. I want to see if Firefox can be cracked if JavaScript is disabled. Right now I'm using NoScript and I have exactly 10 sites whitelisted. That list doesn't include common sites such as Google or Yahoo. IMO Google search is eminently usable w/o JavaScript, as is Gmail. But I don't really care about frills like search suggestions. Oh, and get off my lawn.
- meowface 13y agoIt's extremely unlikely. The chances of finding a RCE exploit that can be triggered without any Javascript are much lower. It's not unheard of, of course. A bug in the CSS, HTML, or image parsing/rendering libraries can be exploited in this way.