Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Chrome Hacked?

vupen.com

Post reply on HN
Print view View original

201–210 of 223 posts

Re: Google Chrome Hacked?

#201

Post by othermaciej »

tlb wrote: post #7
trotsky wrote: post #4

Earlier quoted context omitted.

I'm not too sure that's the business VUPEN is in. Sure, it doesn't hurt them much to share their latest Safari exploit given how slow Apple is on the fix, but with Google their window has the potential to be very short.

Citation needed for such a serious accusation. They claim to be ethical. From their about page: "VUPEN follows a private responsible disclosure policy and reports all discovered vulnerabilities to the affected vendor under contract with VUPEN, and works with them to create a timetable pursuant to which the vulnerability information may be publicly disclosed."

To the best of my knowledge, VUPEN does not disclose vulnerabilities to the vendor affected unless the vendor is under contract with them and pays them. I have seen them post a public claim of a previously unknown vulnerability in one of my employer's products, and as far as I know they have never reported the details.

Re: Google Chrome Hacked?

#202

Post by forensic »

shpxnvz wrote: post #121
forensic wrote: post #112

Earlier quoted context omitted.

They use intimidation and other tactics to keep crime confined to certain neighborhoods. They have a lot of strategies geared toward prevention. If the police fail to respond to calls in the ghetto then the crime in the ghetto increases, for instance.

I'm curious if you have a link to decent evidence of this. From both personal experience and per city data I've found, police response times are universally pretty dismal but I would be interested to see the same data broken down by neighborhood.

I've read various stuff to this extent, but the most interesting treatment was in the documentary called "Crips and Bloods: Made in America" that examines the origins of those two gangs.

A big part of it was how the LAPD would only enforce laws in certain neighborhoods. The gangs were literally trained by the police that if they commit crimes on one side of a particular street, the laws will be enforced, but if they commit crimes on the ghetto side of the street, they will not be.

Re: Google Chrome Hacked?

#203

Post by nitrogen »

damncabbage wrote: post #194
nitrogen wrote: post #182

Earlier quoted context omitted.

I can get Chrome to chew through all of RAM and swap just by repeatedly changing the src= attribute of an img tag (which, by the way, I'd like suggestions on avoiding). Flash isn't required to eat lots of RAM.

Re: "suggestions on avoiding" Is this for a rollover, animation, or something else? (Mind posting a code snippet up somewhere?)

I've been meaning to ask on Stack Overflow. It's simulating a video stream from a device with no FPU that's probably too slow to encode WebM or H.264. I'm dynamically generating a PNG image on the device and reloading it at regular sub-second intervals in Chrome via JavaScript. [Edit: I had to write a custom Ruby extension that directly calls libpng to get reasonable performance]

I have a hidden tag and a . In the timer callback I set the src= attribute of the tag to the URI of the image plus the current time (e.g. "/image.png?v=123456789"), then in the tag's onLoad I set the tag's background-image style to the same value.

I was going to try using two tags, and alternately hiding/showing them, but I doubt that will solve the caching issue. My current workaround is to keep the Chrome developer panel closed (which seems to store every resource loaded by a page regardless of any cache directives from the server) and have the page reload itself after 60 seconds of no user activity. Unfortunately, Chrome's memory usage still grows, only not quite as fast.

Re: Google Chrome Hacked?

#204

Post by piaskal »

cop359 wrote: post #200
AndrewMoffat wrote: post #58

Earlier quoted context omitted.

On an exploit like this, I expect a patch. I'm sure people at Google and abroad (if the exploit exists in Chromium) are scrambling to find it, both for the e-cred and just to make other people safer.

If if Google does find a serious security flaw, how can they be sure it's the same one?

Just ask vupen if their exploit still works on new version.

Re: Google Chrome Hacked?

#205

Post by djcapelis »

pnathan wrote: post #184
trotsky wrote: post #181

Earlier quoted context omitted.

Chaouki Bekar, VUPEN’s CEO and head of research, confirmed that the company had no plans to share any details about their findings with Google, nor was it aware of any steps users could take to mitigate the threat from this attack. “No, we did not alert Google as we only share our vulnerability research with our Government customers for defensive and offensive security,” Bekar wrote in response to an emailed request…

Oh, nice guys. Sounds to me like VUPEN is a cyberweapons dealer.

That's fairly accurate. A cyberweapons government contractor is more accurate, as they design and build the weapons, not just deal them.

Re: Google Chrome Hacked?

#206

Post by Adrock »

nitrogen wrote: post #203
damncabbage wrote: post #194

Earlier quoted context omitted.

Re: "suggestions on avoiding" Is this for a rollover, animation, or something else? (Mind posting a code snippet up somewhere?)

I've been meaning to ask on Stack Overflow. It's simulating a video stream from a device with no FPU that's probably too slow to encode WebM or H.264. I'm dynamically generating a PNG image on the device and reloading it at regular sub-second intervals in Chrome via JavaScript. [Edit: I had to write a custom Ruby extension that directly calls libpng to get reasonable performance] I have a hidden tag and a . In the ti…

I, and many others, have been anxiously awaiting a fix for this:

http://code.google.com/p/chromium/issues/detail?id=36142

It keeps getting punted. If you care, I recommend starring the issue.

Re: Google Chrome Hacked?

#207

Post by VMG »

masklinn wrote: post #72
timdorr wrote: post #64

Earlier quoted context omitted.

Funny thing is Google does actually pay for reported security bugs. Up to $3133.70: http://dev.chromium.org/Home/chromium-security/vulnerability...

I'm pretty sure VUPEN asks for an order of magnitude or two more. Hell, they don't even provide prices on their website, you can request quotes.

I wonder if this kind of thing will set a precedent. If a security firm can "extort" google, what stops a lone hacker to put up a video of a chrome exploit on youtube and demand some arbitrary amount of money as compensation?

According to Wikipedia it is technically not extortion because the obtained information that is of value to google is not obtained "unlawfully" and doesn't seem to fall under the category "money, property or services". There seem to be some similarities though.

Re: Google Chrome Hacked?

#208

Post by masklinn »

VMG wrote: post #207
masklinn wrote: post #72

Earlier quoted context omitted.

I'm pretty sure VUPEN asks for an order of magnitude or two more. Hell, they don't even provide prices on their website, you can request quotes.

I wonder if this kind of thing will set a precedent. If a security firm can "extort" google, what stops a lone hacker to put up a video of a chrome exploit on youtube and demand some arbitrary amount of money as compensation? According to Wikipedia it is technically not extortion because the obtained information that is of value to google is not obtained "unlawfully" and doesn't seem to fall under the category "money…

> I wonder if this kind of thing will set a precedent.

Erm... it's a traditional business model of security firms on the internets...

> If a security firm can "extort" google, what stops a lone hacker to put up a video of a chrome exploit on youtube and demand some arbitrary amount of money as compensation?

They're not extorting anything. They're not menacing google or anything like that, they have not obtained this information illegally, they've done security research and are releasing their findings to their clients because that's how they make their money. That's it.

Re: Google Chrome Hacked?

#209

Post by Tyrannosaurs »

piaskal wrote: post #204
cop359 wrote: post #200

Earlier quoted context omitted.

If if Google does find a serious security flaw, how can they be sure it's the same one?

Just ask vupen if their exploit still works on new version.

Unless you're a customer of theirs why would you expect an answer to that?

Re: Google Chrome Hacked?

#210

Post by [deleted] »

sswam wrote: post #130
alanh wrote: post #31

Earlier quoted context omitted.

The net result in this case is the government owning a zero-day root exploit for every Chrome/Win citizen’s computer. It’s worse than zero-day because we have no reason to expect a patch, so the window of attack will stay open.

so, avoid .gov and similar :) it's a silly TLD anyway. Did the .gov pwn TPB and put their exploit up there?

[deleted]
Post reply on HN