Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome zero-day released on GitHub – fixed on V8 but still works on latest

github.com

Post reply on HN
Print view View original

71–80 of 160 posts

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#71

Post by throwbacktictac »

rasz wrote: post #62
varenc wrote: post #59

Earlier quoted context omitted.

How do you have uBlock do this?

Check "I am an advanced user (required reading)", enter advanced-settings.html, last line is where you define your own uBlock scriptlets. Then in My Filters define *##+js(myscript) this will inject into every(1) executable context of every page. You still need to hotpatch workers/sharedworkers/webworkers(I disable the last one entirely). This way you get some of the control over Chrome browser back. Not so fun fact -…

I have uBlock disable all javascript and make permanent and temporary exceptions when I need to. It's really made browsing the web cumbersome. The more I'm aware of new 0-days the more I appreciate the tar I've laid before myself.

Thanks for the info about 'delete WebAssembly'

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#72

Post by 8128js8121 »

CyberRabbi wrote: post #56

Do not casually browse the web with JavaScript enabled. The idea of trustless secure computing is compelling but it’s ultimately not reality. There is a new browser engine rce vulnerability on a regular basis, whether it’s chrome or mobilesafari

yeah k, ill use my notepad

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#73

Post by CyberRabbi »

8128js8121 wrote: post #72
CyberRabbi wrote: post #56

Do not casually browse the web with JavaScript enabled. The idea of trustless secure computing is compelling but it’s ultimately not reality. There is a new browser engine rce vulnerability on a regular basis, whether it’s chrome or mobilesafari

yeah k, ill use my notepad

You don’t have to use your notepad. You can just disable JavaScript. Vast majority of text content sites work fine. You always have the option to use JavaScript for sites you explicitly trust.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#74

Post by chews »

saurik wrote: post #38
kentonv wrote: post #35

Earlier quoted context omitted.

> which patched the bug in the V8 code last week This does not appear to be true. AFAICT the first patch was merged today: https://chromium-review.googlesource.com/c/v8/v8/+/2820971 (It was then rapidly cherry-picked into release branches, after which our automation picked it up.) > I am curious about this because I want to better understand the mitigations in place by a service such as Cloudflare, as I am interested…

Thanks; FWIW, I'd definitely read that blog post, and watched the talk you gave a while back (paying careful attention to the Q&A, etc. ;P). (I had had a back/forth with you a while back, actually, surrounding how you limit the memory usage of workers, and in the end sam still unsure what strategy you went with.) https://news.ycombinator.com/item?id=23975152 BTW: if there is any hope you can help put me in touch with…

We should continue our Ethereum discussion good human. L2 is a cray.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#75

Post by nominated1 »

rasz wrote: post #44

my patch: delete WebAssembly injected with uBlock into every browser context before page loads.

For Chrome you can also run:

chrome --js-flags=--noexpose_wasm

More info for other browsers and platforms:

https://github.com/stevespringett/disable-webassembly

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#76

Post by saurik »

coolspot wrote: post #55
saurik wrote: post #38

Earlier quoted context omitted.

Thanks; FWIW, I'd definitely read that blog post, and watched the talk you gave a while back (paying careful attention to the Q&A, etc. ;P). (I had had a back/forth with you a while back, actually, surrounding how you limit the memory usage of workers, and in the end sam still unsure what strategy you went with.) https://news.ycombinator.com/item?id=23975152 BTW: if there is any hope you can help put me in touch with…

“The author of Cydia” is probably more striking introduction for you :) HN post on Orchid Protocol for curious: https://news.ycombinator.com/item?id=15576457

Haha, yeah... but that's mostly just "why I'm a bit famous" and not "why I care about this" ;P.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#77

Post by dang »

lights0123 wrote: post #24
mappu wrote: post #20

Earlier quoted context omitted.

I converted it to binary with a pack("L", ...) loop and loaded it in Ghidra as a raw x86_64 binary. I don't fully understand it, but i think it's searching the address space for some kind of function entry point and then calling it with "calc.exe". So probably the standard PoC shellcode.

For anyone else wanting to analyze this: echo '\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48 \x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48 \x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9 \x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b \x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\…

I had to put some whitespace in your echo because it was borking the page layout. Sorry—it's our bug.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#79

Post by saagarjha »

danielyaa5 wrote: post #30

Im just curious on thoughts about sharing these on twitter. Shouldn't they be shared directly with Google. Since its web people can create exploits pretty quickly.

Google knows about (and has patched) the bug already. The exploit code has been shared wholesale.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#80

Post by z3t4 »

bassdropvroom wrote: post #43
kentonv wrote: post #7

Earlier quoted context omitted.

This is what happens: Within an hour of V8 pushing the fix for this, our build automation alerted me that it had picked up the patch and built a new release of the Workers Runtime for us. I clicked a button to start rolling it out. After quick one-click approvals from EM and SRE, the release went to canary. After running there for a short time to verify no problems, I clicked to roll it out world-wide, which is in pr…

> Within an hour of V8 pushing the fix for this, our build automation alerted me that it had picked up the patch and built a new release of the Workers Runtime for us. I clicked a button to start rolling it out. After quick one-click approvals from EM and SRE, the release went to canary. After running there for a short time to verify no problems, I clicked to roll it out world-wide, which is in progress now. It will…

Look for a company who's business model includes uptime, security and scalability. And is big enough to not outsource those parts. And in a mature market where customers can tell the difference.
Post reply on HN