Google Chrome Hacked? • Hacker News Board

Re: Google Chrome Hacked?

#101

Post by orblivion » Mon, May 09, 2011, 9:38 PM UTC

rheide wrote: post #23

vupen: "Hey Google, your browser has a very nasty bug that allows for potentially horrible things to happen. We thought we'd share that with the world. If you'd like to know where it is though, you'd better give us money."

I think you'd be biting off the hand that feeds you. If you eliminate what is arguably a distasteful arrangement here, you also eliminate the incentive to continue doing it. You might get this bug for free, but you get a hidden loss, a bunch of future bugs that you'll never hear about.

Think about the audacity of farmers, who make a profit for food, which you need to live. But nobody thinks like that for some reason.

Earning profit just means you've done something for someone who really wanted it done. It's a necessary signal.

Re: Google Chrome Hacked?

#102

Post by CGamesPlay » Mon, May 09, 2011, 9:40 PM UTC

lukeschlather wrote: post #88

schrototo wrote: post #63

Earlier quoted context omitted.

Wouldn't "the government" keep quiet about even having found an exploit? Why let VUPEN publicize this if they intend to use it?

The government is generally more worried about keeping foreign governments out of high-tech firms like Google than about their ability to hack high-tech firms like Google.

Which government are you referring to?

Re: Google Chrome Hacked?

#103

Post by coliveira » Mon, May 09, 2011, 9:45 PM UTC

jlgosse wrote: post #11

Not saying this isn't true, as I'm sure VUPEN is quite legit, but what stops me from creating a keyboard shortcut to calculator.exe, opening a random website which loads for a few seconds, and then pressing ctrl+alt+f6 or something to open calculator?

If you're sure it is quite legit, why are you suggesting this? It is similar to what news networks do by adding a quotation mark to something they know is false just to suggest something they want to be true.

Re: Google Chrome Hacked?

#104

Post by ericd » Mon, May 09, 2011, 9:48 PM UTC

adrianp wrote: post #42

burgerbrain wrote: post #32

Earlier quoted context omitted.

Who cares if they sound unprofessional to you? Very obviously they produce.

I am still waiting for that obvious evidence. That includes more details and also tests on the latest dev version of Chrome (Chromium). I am not defending Google in any way, but some claim with no real evidence shouldn't convince anybody.

Given that at least some of their customers will probably ask for this vulnerability, you have to judge whether this is a reputable company that would have a reputation to lose if they started spewing out false reports about their capabilities. It appears to be, so I would default to believing it.

Re: Google Chrome Hacked?

#105

Post by probablyrobots » Mon, May 09, 2011, 9:49 PM UTC

rsoto wrote: post #49

xutopia wrote: post #24

Earlier quoted context omitted.

The reality is that there is probably no chance that they would ever find these bugs if they weren't funded to do it and the only way to be funded is to have customers. The net result is probably safer software for all.

I'm confused. Why would the government want to break Chrome? Also, if they are not going to release the exploit soon (especially to Google), why are you saying 'safer software for all'?

Maybe I'm naive but it could simply be because they are evaluating it for internal use. The FBI and CIA don't want to use vulnerable browsers any more than we do.

Re: Google Chrome Hacked?

#106

Post by [deleted] » Mon, May 09, 2011, 9:49 PM UTC

calloc wrote: post #22

Unless Google is one of their customers it may actually be a little while before this exploit is fixed. VUPEN does security research and doesn't disclose to original vendors unless they happen to be customers. I both love and hate them. They are extremely talented and find absolutely awesome bugs that are hard to discover without a lot of work, and I hate them because they don't disclose their work unless it is for m…

[deleted]

Re: Google Chrome Hacked?

#107

Post by SkyMarshal » Mon, May 09, 2011, 9:52 PM UTC

AndrewMoffat wrote: post #58

alanh wrote: post #31

Earlier quoted context omitted.

The net result in this case is the government owning a zero-day root exploit for every Chrome/Win citizen’s computer. It’s worse than zero-day because we have no reason to expect a patch, so the window of attack will stay open.

On an exploit like this, I expect a patch. I'm sure people at Google and abroad (if the exploit exists in Chromium) are scrambling to find it, both for the e-cred and just to make other people safer.

Agreed, no need to freak out, the sky's not falling. I expect Google will either find the spoit on their own, or pay what to them is a pitance to become a customer and acquire it that way. Sounds like a good company to have on the payroll anyway, doing what three years of Pwn2own hasn't managed to.

Re: Google Chrome Hacked?

#108

Post by shpxnvz » Mon, May 09, 2011, 9:56 PM UTC

forensic wrote: post #77

eli wrote: post #56

Earlier quoted context omitted.

That's a poor example. Policeman get paid to protect everyone; police protection is not (usually) a subscription service.

Do police protect inner city poverty-stricken people victimized by gangs? It's pretty easy to argue that police only protect those who pay them.

Police don't really "protect" anyone, their job is to cleanup the mess and investigate after the fact.

Re: Google Chrome Hacked?

#109

Post by Osiris » Mon, May 09, 2011, 9:56 PM UTC

SriniK wrote: post #97

Looking at the video and time it took to launch the calc.exe, it could be pdf/flash exploit that they are using. Process count in process explorer started with 5 and at the end of the demo, it looked like they have 8. That tells there are 2 extra processes that are created (discounting 1 for calc.exe). I tried to see if pdf/flash creates new processes but I couldn't verify. Perhaps a chrome developer could get a clue…

They are obviously hiding something. When they flip back to Process Explorer, Chrome is perfectly sized to cover everything in the window except the calc.exe. My guess is there are other processes running that they're trying to hide that were used in the exploit.

Re: Google Chrome Hacked?

#110

Post by syllogism » Mon, May 09, 2011, 9:58 PM UTC

orblivion wrote: post #101

rheide wrote: post #23

vupen: "Hey Google, your browser has a very nasty bug that allows for potentially horrible things to happen. We thought we'd share that with the world. If you'd like to know where it is though, you'd better give us money."

I think you'd be biting off the hand that feeds you. If you eliminate what is arguably a distasteful arrangement here, you also eliminate the incentive to continue doing it. You might get this bug for free, but you get a hidden loss, a bunch of future bugs that you'll never hear about. Think about the audacity of farmers, who make a profit for food, which you need to live . But nobody thinks like that for some reason…

I felt the same way until this comment below:

> http://www.vupen.com/english/services/ > As the world leader in vulnerability research, VUPEN Security provides weaponized and highly sophisticated exploits specifically designed for Law Enforcement and Intelligence Agencies to help them achieve their offensive missions using tailored and unique codes created in-house by VUPEN for vulnerabilities discovered by our researchers. Note also the "under contract with VUPEN" part of the disclosure bit.