41–50 of 118 posts
Is qemu affected?
Specifically, the write primitive exploits the way the E1000's EEPROM is emulated, and you can see the read primitive exploits VirtualBox's ACPI implementation.
From the article: "Elevated privileges are required to load a driver in both OSs. It's common and isn't considered an insurmountable obstacle. Look at Pwn2Own contest where researcher use exploit chains: a browser opened a malicious website in the guest OS is exploited, a browser sandbox escape is made to gain full ring 3 access, an operating system vulnerability is exploited to pave a way to ring 0 from where there are anything you need to attack a hypervisor from the guest OS."
Defense in depth means caring about every link of the chain.
I'm paraphrasing his 3 reasons for disclosing immediately:
1. It's unacceptable to wait half a year until a vulnerability is patched.
2. Bug bounties are riddled with tricks to delay you, shenanigans as to whether they'll pay you or not, and games to low ball the price.
3. It's arrogant to wait months while meanwhile preparing for a big boastful disclosure.
I'm thinking that we could add to this list as follows:
4. The vulnerability might already be well-known and being used by black hats and secret government agencies. Releasing the details immediately puts all of us on an equal footing.
5. Punish the vendors for having such awful security. Just the other day, HN had an article[1] about Crucial SSDs that encrypt the drive with a key that doesn't depend on the password; you can decrypt the drive without the password just by patching the firmware. Is Crucial going to get punished for such an outrageous lie about their encryption? The marketplace mechanisms that force vendors to pay proper attention to security are trust in the brand, independent security reviews (thank you security researchers!), government regulation (no thank you), and immediately naming and shaming them without giving them time to cover it up or downplay it.
6. Punish the users for not demanding higher security. Of course, we could suffer as result, but it's not the security researcher who caused the bug and it's not the security researcher who would be exploiting it. There needs to be demand from users for higher security in their purchases.
7. We get to see all the details if the vulnerability is disclosed immediately. If the vulnerability is disclosed after "responsible disclosure", plenty of times you don't get the raw details. I wouldn't be surprised if many security researchers are signed to NDAs (or simply threatened by lawyers), so we don't hear about the bugs at all. Having the full details published immediately advances our knowledge in the security field more than a partial disclosure months later (or a non-disclosure).
Earlier quoted context omitted.
It is called darknet :)
Sorry, I should have been clearer. I meant a non-darknet market. Like somehow being able to have a third party negotiate payout rates for bug bounties. I have no idea what the might look like.
Sequence looks something like: Security researcher submits exploit to the union. Union verifies it and decides it's worth $x. They inform software firm of the exploit and a deadline for payment. If payment is received before deadline, they get full, private disclosure. If not, then exploit is made public. Union takes a cut.
Security researchers don't really need a market maker. (It's not a real market: Actually converting exploits into money is typically antisocial and illegal.) They need someone to negotiate for them.
Not to discount the work done here. Big high five. But I am surprised hundreds more of these bugs haven't found every week. It's Oracle. Their mission statement might as well be "we make security vulnerabilities and charge you a shitload" I would never trust any Oracle product in any form in production environment.
Earlier quoted context omitted.
Sorry, I should have been clearer. I meant a non-darknet market. Like somehow being able to have a third party negotiate payout rates for bug bounties. I have no idea what the might look like.
Probably would look like a union (a dirty word in software), where their collective bargaining allows them to have leverage on software firms and have policies to punish non-payment in an ethical way. Sequence looks something like: Security researcher submits exploit to the union. Union verifies it and decides it's worth $x. They inform software firm of the exploit and a deadline for payment. If payment is received b…
"I have remote code execution in your product, pay me XXX or I'll tell everyone".
I don't actually know if it is blackmail, but if it is, hiding behind a union isn't enough to make it not-blackmail.
huh. is the author a known “security researcher”? i agree more or less with his 3 points.
The author here just blindly assumes a lot of things about VirtualBox's bug bounty program. Many, like Google, put a very strict limit, and they will release the details when that time is over. I think it's more respectful to at least give them a chance, rather than throwing a hot shit on their lap and making hundreds of people's life a living hell for a week. The engineers in charge quickly patching this up aren't t…
Well really, Oracle threw the hot shit in customers’ laps. The author just had the gall to point it out.
> making hundreds of people's life a living hell for a week
> Making them pay for it seems like a pretty shitty move.
It sounds like you assume Oracle is going to abuse its staff in the process of getting this fixed. I don’t know why you assume that, nor why the author ought to be blamed if Oracle does.
The pricing of / evaluation of bug bounties seems to be a problem. Going begging to the vendor of course results in reduced value. Everything tends to be undervalued when there is only one buyer. Also purchase processes tend to be slow when there is only one buyer. It's almost as if there needs to be competition for the sale of the disclosure ... although that would have its own issues of course. Another idea is a pu…
Problem with that is that it might be taken to be extortion / blackmailing / racketeering. (Though, not a lawyer and this isn't legal advice)
“We reported this vulnerability to Oracle, the latest update from them is that they are still looking into it, while in fact the latest version of Oracle VirtualBox version 5.2.18 has silently introduced a patch without giving credit or mentioning of the vulnerability report.”