Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serious Chrome zero-day

nakedsecurity.sophos.com

Post reply on HN
Print view View original

111–120 of 377 posts

Re: Serious Chrome zero-day

#111

Post by flukus »

staticassertion wrote: post #77

I'll be that guy. Chrome has probably invested > 1 billion dollars into their codebase at this point. Certainly >100million into security. They sandbox their code aggressively . They build this project with security in mind from day 1 - it's been architected for it. The Chrome security team(s) has a lot of power for a product security org. They fuzz. They invent new fuzzers. They cluster their fuzzers. They have a wo…

> According to the official release notes, this vulnerability involves a memory mismanagement bug in a part of Chrome called FileReader. That’s a programming tool that makes it easy for web developers to pop up menus and dialogs asking you to choose from a list of local files, for example when you want to pick a file to upload or an attachment to add to your webmail.

It sounds like the bug occurs interacting with external code, win32 or equivalent. Even if chrome were written in a "safe" language this section would likely be in unsafe block.

Re: Serious Chrome zero-day

#112

Post by lghh »

Doctor_Fegg wrote: post #54
tcbasche wrote: post #31

Earlier quoted context omitted.

I gave Firefox an honest go, but some web apps just don't work 100% in it. Chrome does not have this issue. Most of us drive cars filled with fuel from evil oil companies, why do we all drive cars?

> why do we all drive cars? ...we don't?

>90% of us do, or at least that's what I'd reasonably guess.

Re: Serious Chrome zero-day

#113

Post by flukus »

gpm wrote: post #94
staticassertion wrote: post #86

Earlier quoted context omitted.

A memory safe one. There are many of them. They could build their own if they chose to - they've built multiple languages in the past. Picking a language for the Chrome team doesn't seem practical - we all know where your question is going to head. The point is they have to not pick C++. Again, they've invested many, many millions of dollars into security. Let's not pretend that they're priced out of using another la…

It doesn't even have to be memory safe, just less memory accident prone. D for example would have been an interesting choice (and I think it was usable back then).

D was released in 2001, KHTML in 1998, it's like suggesting they should have written vim in java.

Re: Serious Chrome zero-day

#114

Post by jlgaddis »

flukus wrote: post #113
gpm wrote: post #94

Earlier quoted context omitted.

It doesn't even have to be memory safe, just less memory accident prone. D for example would have been an interesting choice (and I think it was usable back then).

D was released in 2001, KHTML in 1998, it's like suggesting they should have written vim in java.

... and Chrome in 2008.

Re: Serious Chrome zero-day

#115

Post by busterarm »

kbenson wrote: post #109
arcticfox wrote: post #40

Earlier quoted context omitted.

It was exploited before the vendor was aware; IMO that earns it a permanent "Zero-day" title. Obviously it's not currently a zero-day, given that we're hearing about it from the vendor. The moniker is pretty paradoxical otherwise, the discoverer writing a post about a zero-day would make it no longer a zero-day.

I always thought it was from the patch date. As I understand it there are 1-days, and 2-days, where people rush to make exploits for released patches to capitalize on the lag time between patch availability and wide deployment (and also zero-days which were recently patched), which is why zero-day denotes that there has been no time since a patch is available (since there isn't one). So, I would say this was a zero-d…

You're both wrong for different reasons.

0day refers to vulnerabilities. t0 is when a vulnerability is discovered. t1 is either when the vendor issues a patch OR it is exploited and t2 is when >50% of vulnerable systems have applied the patch.

tl;dr: something is 0day once it's discovered. It is no longer 0day once an action is taken with the vulnerability.

Re: Serious Chrome zero-day

#116

Post by qrbLPHiKpiux »

vortico wrote: post #97
qrbLPHiKpiux wrote: post #92

Earlier quoted context omitted.

Caveat: if something’s “free,” you’re the product. Google wants to pull as much metadata from you as possible. I don’t trust anyone who gives me something for free. I therefore limit how I use it.

What browser do you use then?

Firefox primary on MacOS and windows. Chrome only for work related tasks. Firefox or Safari on iOS, depending what I’m doing. Firefox in Debian.

You can donate to Firefox. Not to chrome.

Re: Serious Chrome zero-day

#117

Post by kllrnohj »

staticassertion wrote: post #86
elorant wrote: post #82

Earlier quoted context omitted.

So what language should they've written it in?

A memory safe one. There are many of them. They could build their own if they chose to - they've built multiple languages in the past. Picking a language for the Chrome team doesn't seem practical - we all know where your question is going to head. The point is they have to not pick C++. Again, they've invested many, many millions of dollars into security. Let's not pretend that they're priced out of using another la…

Back when Chrome was getting started there were no memory safe languages that did not come with huge downsides.

Now one could argue for Rust, but let's not pretend that C++ was a bad choice. C++ was the overwhelmingly best choice at the time.

Re: Serious Chrome zero-day

#118

Post by [deleted] »

kbenson wrote: post #109
arcticfox wrote: post #40

Earlier quoted context omitted.

It was exploited before the vendor was aware; IMO that earns it a permanent "Zero-day" title. Obviously it's not currently a zero-day, given that we're hearing about it from the vendor. The moniker is pretty paradoxical otherwise, the discoverer writing a post about a zero-day would make it no longer a zero-day.

I always thought it was from the patch date. As I understand it there are 1-days, and 2-days, where people rush to make exploits for released patches to capitalize on the lag time between patch availability and wide deployment (and also zero-days which were recently patched), which is why zero-day denotes that there has been no time since a patch is available (since there isn't one). So, I would say this was a zero-d…

[deleted]

Re: Serious Chrome zero-day

#119

Post by busterarm »

city41 wrote: post #95
crushcrashcrush wrote: post #9

Honest question - why do people use Chrome? It’s from an arguably as-evil company as Facebook. Alternatives exist. What’s the draw?

I have made several attempts to switch to Firefox. But for me at least Firefox seems to crash about once a day. I don't think Chrome has ever crashed on me in about a decade of using it, and crashed tabs are extremely rare.

I run Firefox on Arch Linux and OpenBSD with zero crashes. Hundreds of tabs open at once.

Consider that it's possibly the fault of who packaged Firefox and not Firefox itself.

Re: Serious Chrome zero-day

#120

Post by entropie »

Hmm. Is the developer version affected too? Iam running Version 74.0.3717.0 (Official Build) dev (64-bit) compiled at march 5. (gentoo).

Looking for an update in portage right now.

Post reply on HN