Can someone please explain how this hack works? (I am CS major so I know basic stuff but not a hacker)
It uses WebAssembly VM bug to get arbitrary memory address write/read capability within Chromium sandbox.
Chrome zero-day released on GitHub – fixed on V8 but still works on latest
51–60 of 160 posts
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#52Earlier quoted context omitted.
I converted it to binary with a pack("L", ...) loop and loaded it in Ghidra as a raw x86_64 binary. I don't fully understand it, but i think it's searching the address space for some kind of function entry point and then calling it with "calc.exe". So probably the standard PoC shellcode.
For anyone else wanting to analyze this: echo '\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48 \x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48 \x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9 \x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b \x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\…
Minor nit, but I suppose you mean "echo -ne" ?
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#53Earlier quoted context omitted.
This is what happens: Within an hour of V8 pushing the fix for this, our build automation alerted me that it had picked up the patch and built a new release of the Workers Runtime for us. I clicked a button to start rolling it out. After quick one-click approvals from EM and SRE, the release went to canary. After running there for a short time to verify no problems, I clicked to roll it out world-wide, which is in pr…
> Within an hour of V8 pushing the fix for this, our build automation alerted me that it had picked up the patch and built a new release of the Workers Runtime for us. I clicked a button to start rolling it out. After quick one-click approvals from EM and SRE, the release went to canary. After running there for a short time to verify no problems, I clicked to roll it out world-wide, which is in progress now. It will…
Can you include me too?! I wish I could automate the hell like they do :P
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#54This is so irresponsible to disclose vulnerabilities this way. There is a process that many people have worked hard to create whereby vulnerabilities can be disclosed, patched--you can even be rewarded!--and both fix and bug are eventually made public in proper time. I am just smh over this.
You can't assume good faith on the part of your attacker in building your threat model.
Also: it could have been much worse than this irresponsible disclosure, at least it was disclosed.
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#55Earlier quoted context omitted.
> which patched the bug in the V8 code last week This does not appear to be true. AFAICT the first patch was merged today: https://chromium-review.googlesource.com/c/v8/v8/+/2820971 (It was then rapidly cherry-picked into release branches, after which our automation picked it up.) > I am curious about this because I want to better understand the mitigations in place by a service such as Cloudflare, as I am interested…
Thanks; FWIW, I'd definitely read that blog post, and watched the talk you gave a while back (paying careful attention to the Q&A, etc. ;P). (I had had a back/forth with you a while back, actually, surrounding how you limit the memory usage of workers, and in the end sam still unsure what strategy you went with.) https://news.ycombinator.com/item?id=23975152 BTW: if there is any hope you can help put me in touch with…
“The author of Cydia” is probably more striking introduction for you :)
HN post on Orchid Protocol for curious: https://news.ycombinator.com/item?id=15576457
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#56Do not casually browse the web with JavaScript enabled. The idea of trustless secure computing is compelling but it’s ultimately not reality. There is a new browser engine rce vulnerability on a regular basis, whether it’s chrome or mobilesafari
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#57https://therecord.media/security-researcher-drops-chrome-and... says this isn't a fully weaponizable exploit because you still need to escape the Chrome sandbox after using this. But, the researcher shows a screenshot of having started calc.exe which seems like something that'd happen outside the sandbox?
The pr adding this says that you need to run chrome with —no-sandbox to get the exploit chain (since they don’t have a sandbox buster right now). Kinda feel like the PR to metasploit is more interesting as a link
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#58my patch: delete WebAssembly injected with uBlock into every browser context before page loads.
What's the slowdown like on this? Any stuttering?
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#59my patch: delete WebAssembly injected with uBlock into every browser context before page loads.
How do you have uBlock do this?
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#60my patch: delete WebAssembly injected with uBlock into every browser context before page loads.
Considering that JS is JIT'd (and V8 has had JS based RCEs in the past), is there any reason to believe webasm is a significant security hole?