Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VirtualBox E1000 Guest-to-Host Escape

github.com

Post reply on HN
Print view View original

31–40 of 118 posts

Re: VirtualBox E1000 Guest-to-Host Escape

#31

Post by Nerdfest »

cthor wrote: post #19
TheSpiceIsLife wrote: post #6

Earlier quoted context omitted.

With regard to this, maybe there’s an opportunity for a market maker to step in. An “Uber for vulnerabilities”. Having said that, I do tend to think “slap a market on it” can often lead to perverse outcome.

These already exist. There are darknet firms that independently verify that an exploit is real (staking their reputation that they won't take it and run once shown), and then open it to the market. The main trouble is that for it to fully work, you need to have the big corps bidding against black hats in this market. I can't see that happening. It'd have big corps dirtying their hands too openly. The other trouble is…

"The amount they'd be have to pay is at most what a black hat can profit from the bug, which is necessarily less than the real damages because the black hat has to cost for fungibility."

So basically, their value.

Re: VirtualBox E1000 Guest-to-Host Escape

#32

Post by TheSpiceIsLife »

auslander wrote: post #13
TheSpiceIsLife wrote: post #6

Earlier quoted context omitted.

With regard to this, maybe there’s an opportunity for a market maker to step in. An “Uber for vulnerabilities”. Having said that, I do tend to think “slap a market on it” can often lead to perverse outcome.

It is called darknet :)

Sorry, I should have been clearer. I meant a non-darknet market.

Like somehow being able to have a third party negotiate payout rates for bug bounties.

I have no idea what the might look like.

Re: VirtualBox E1000 Guest-to-Host Escape

#33

Post by Nerdfest »

freedomben wrote: post #7
paulie_a wrote: post #5

Not to discount the work done here. Big high five. But I am surprised hundreds more of these bugs haven't found every week. It's Oracle. Their mission statement might as well be "we make security vulnerabilities and charge you a shitload" I would never trust any Oracle product in any form in production environment.

I hate Oracle and consider them among the most evil of companies out there. However, I don't think that's a very fair characterization of their mission statement.

True, I think it's actually Adobe's.

Re: VirtualBox E1000 Guest-to-Host Escape

#34

Post by metildaa »

xupybd wrote: post #23
metildaa wrote: post #3

Earlier quoted context omitted.

The author has a number of great points, with an overarching theme that how we handle security bugs is ridiculous.

You don't think there is a place for giving vendors time to fix the exploit before handing it over to everyone who can use it maliciously?

Not at the cost of leaving end users vulnerable and in the dark, vendors can deal with the consequences of their choices.

Hard lessons are needed, having attempted to disclose serious vulnerabilities in T-Mobile USA's APIs by reaching out repeatedly, most vendors will not patch in an urgent manner, and some (like T-Mobile) are content to leak customer info indefinitely.

It is a culture problem, and it will take (financial and reputational) pain to alter the existing corporate cultures.

Re: VirtualBox E1000 Guest-to-Host Escape

#35

Post by metildaa »

nur0n wrote: post #30
xupybd wrote: post #23

Earlier quoted context omitted.

You don't think there is a place for giving vendors time to fix the exploit before handing it over to everyone who can use it maliciously?

The security of the product is the responsibility of the vendors. If they want to control how exploits are handled, then they should compensate security researchers for that service, just like anything else. The poster of the exploit outlined some reasonable steps to that end. I'm no security expert, but the feeling I get from other discussions is that big players have acted dishonestly with regards to proper compens…

Most companies and organizations react terribly to being made aware of security issues, sometimes landing the messenger in prison. Prevailing practices are to sweep vulnerabilities under the rug, or quietly acknowledge them and hope no one notices.

Re: VirtualBox E1000 Guest-to-Host Escape

#36

Post by metildaa »

artursapek wrote: post #20
metildaa wrote: post #3

Earlier quoted context omitted.

The author has a number of great points, with an overarching theme that how we handle security bugs is ridiculous.

Especially the websites/branding of bugs, like Heartbleed, SHAttered, etc. It seems like researchers do this to propel their own fame, for probably financial motives. I imagine it's pretty lucrative to have been the "co-founder" of Heartbleed just like it is lucrative to be the co-founder of a well-known startup.

There are better outcomes from doing these kinds of bug brandings, it creates awareness of sometimes serious vulnerabilities and gives us something more friendly to reference a bug by than its CVE #. Who remembers the CVE # for Blueborne or Heartbleed?

Re: VirtualBox E1000 Guest-to-Host Escape

#37

Post by exikyut »

ehsankia wrote: post #24
jiveturkey wrote: post #16

huh. is the author a known “security researcher”? i agree more or less with his 3 points.

The author here just blindly assumes a lot of things about VirtualBox's bug bounty program. Many, like Google, put a very strict limit, and they will release the details when that time is over. I think it's more respectful to at least give them a chance, rather than throwing a hot shit on their lap and making hundreds of people's life a living hell for a week. The engineers in charge quickly patching this up aren't t…

OK, so a bunch of engineers have been told to drop everything to patch this. Maybe work weekends, (hopefully not) provide hourly updates on their work, etc. I don't see fixing this as entirely tricky; the patch looks to be a few lines of code. Then it's over to testing for a short run, and the release team will be running around informing vendors in order of importance and then updating https://www.virtualbox.org/wiki/Changelog, which incidentally hasn't changed yet (it will be interesting to see when this happens / how long it takes).

So that's the on-the-ground mess that's been made. It's annoying, but not the end of the world, so concentrating only on the lowest level is arguably a distraction from the bigger picture - which is impacted by all such events as this.

Re: VirtualBox E1000 Guest-to-Host Escape

#38

Post by exikyut »

ChickeNES wrote: post #21

Oh, this might explain how I managed to cause the host OS to crash while running my homebrew OS when I was in college...

Homebrew OS? Interesting. What did it do? Can I see it anywhere?

What VM were you using?

Host OS crashes like what you describe are no-trust-me-it's-really-not-the-compiler unlikely.

I did have X crash on me once while figuring out the X11 protocol specification, but that's because X is widely known to be less than perfectly stable :D and also because the actual graphics driver I was using was a little flaky.

Re: VirtualBox E1000 Guest-to-Host Escape

#39

Post by sitepodmatt »

xupybd wrote: post #23
metildaa wrote: post #3

Earlier quoted context omitted.

The author has a number of great points, with an overarching theme that how we handle security bugs is ridiculous.

You don't think there is a place for giving vendors time to fix the exploit before handing it over to everyone who can use it maliciously?

It depends on the vendor. I once followed responsible disclosure with the clowns at cPanel. They downplayed the report and never notified their own customers. I wont follow responsible disclosure with clowns.

Re: VirtualBox E1000 Guest-to-Host Escape

#40

Post by Too »

Nerdfest wrote: post #31
cthor wrote: post #19

Earlier quoted context omitted.

These already exist. There are darknet firms that independently verify that an exploit is real (staking their reputation that they won't take it and run once shown), and then open it to the market. The main trouble is that for it to fully work, you need to have the big corps bidding against black hats in this market. I can't see that happening. It'd have big corps dirtying their hands too openly. The other trouble is…

"The amount they'd be have to pay is at most what a black hat can profit from the bug, which is necessarily less than the real damages because the black hat has to cost for fungibility." So basically, their value.

I wouldn't put it that way. The potential value lost (reputation, downtime, etc) for the vendor could be more than the value an attacker might gain.

It's not a slice of cake that is exchanging hands. The attacker might only be interested in the cherry on the top but he could also destroy the rest of the cake in the process.

Post reply on HN