Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Google Chrome hole plugged in 24 hours

arstechnica.com

Post reply on HN
Print view View original

11–20 of 26 posts

Re: Critical Google Chrome hole plugged in 24 hours

#11

Post by fpgeek »

Scaevolus wrote: post #10
jrockway wrote: post #5

Earlier quoted context omitted.

A real security hole, or one like "if someone watches you type your PIN code, they'll know your PIN code"?

Security holes that render the permissions system completely useless, since even a no-permissions app can end up doing anything.

Do you have an example?

The cases I've read about were of the form "app A asks app B to do something it can't via the Intent system". That sounds scary until you realize that a standard example of this is an app that can't access the network sharing something via email. In other words, app A has transferred control to app B and what the user does (or doesn't) decide to do with app B is their choice, not app A's.

Re: Critical Google Chrome hole plugged in 24 hours

#12

Post by silon4 »

semenko wrote: post #8
palish wrote: post #7

Earlier quoted context omitted.

Well... They would hopefully be smarter than committing the fix to the public SVN. By committing the fix, they would effectively be releasing a step-by-step guide on how to exploit the vulnerability.

But it's still an open source project -- perhaps the commits are more evident in their git repo? http://git.chromium.org/gitweb/ Certainly if you build Chromium from git/SVN now, the bug is fixed. I just find it a little strange that their changelog / list of commits in each version is not true.

If it's a flash problem, I don't think Chromium has flash at all.

Re: Critical Google Chrome hole plugged in 24 hours

#13

Post by jamesr »

semenko wrote: post #6

The Chrome Release blog says it's fixed: http://googlechromereleases.blogspot.com/2012/03/chrome-stab... And that the SVN commit history is available: http://build.chromium.org/f/chromium/perf/dashboard/ui/chang... But I don't see any commit that look even remotely related to this exploit. What's up?

The commits are all there, the fixes just might not look completely obvious. We (chromium) commit all fixes to the chromium repository before pushing them to users, always.

Re: Critical Google Chrome hole plugged in 24 hours

#14

Post by vinhboy »

jamesr wrote: post #13
semenko wrote: post #6

The Chrome Release blog says it's fixed: http://googlechromereleases.blogspot.com/2012/03/chrome-stab... And that the SVN commit history is available: http://build.chromium.org/f/chromium/perf/dashboard/ui/chang... But I don't see any commit that look even remotely related to this exploit. What's up?

The commits are all there, the fixes just might not look completely obvious. We (chromium) commit all fixes to the chromium repository before pushing them to users, always.

Do you guys ever do write-ups about the bugs? I would be interested in reading that.

Re: Critical Google Chrome hole plugged in 24 hours

#15

Post by jamesr »

vinhboy wrote: post #14
jamesr wrote: post #13

Earlier quoted context omitted.

The commits are all there, the fixes just might not look completely obvious. We (chromium) commit all fixes to the chromium repository before pushing them to users, always.

Do you guys ever do write-ups about the bugs? I would be interested in reading that.

I don't think we do that as a general habit, but that may happen in this case.

Re: Critical Google Chrome hole plugged in 24 hours

#16

Post by bishamon »

silon4 wrote: post #12
semenko wrote: post #8

Earlier quoted context omitted.

But it's still an open source project -- perhaps the commits are more evident in their git repo? http://git.chromium.org/gitweb/ Certainly if you build Chromium from git/SVN now, the bug is fixed. I just find it a little strange that their changelog / list of commits in each version is not true.

If it's a flash problem, I don't think Chromium has flash at all.

As the original article points out, this is not a flash related issue.

Re: Critical Google Chrome hole plugged in 24 hours

#17

Post by gcp »

kevs wrote: post #3

With a response time like that it seems like antivirus software is becoming increasingly irrelevant.

With exploits like that, it seems like sandboxing is becoming increasingly irrelevant.

I don't think it's a good argument - what about defense in depth? Don't antivirus packages have heuristic protections? Or are those, in general, useless?

Re: Critical Google Chrome hole plugged in 24 hours

#18

Post by gcp »

That's only the Pwnium hack, though. The Pwn2Own vulnerability remains undisclosed and unfixed.

Which leads me to the question: why aren't companies like Google customers of companies like Vupen? Too many of them to make it cost-effective? Or does Vupen (for example) prefer if those holes are not fixed? You can sell a vulnerability many times, after all.

Re: Critical Google Chrome hole plugged in 24 hours

#20

Post by throwaway3823 »

gcp wrote: post #18

That's only the Pwnium hack, though. The Pwn2Own vulnerability remains undisclosed and unfixed. Which leads me to the question: why aren't companies like Google customers of companies like Vupen? Too many of them to make it cost-effective? Or does Vupen (for example) prefer if those holes are not fixed? You can sell a vulnerability many times, after all.

Vupen sells 0day exploits so that they can be used to attack people: http://www.vupen.com/english/services/lea-index.php

A patched vulnerability would not be worth nearly as much to them and their customers.

P.S. Vupen sells to ASEAN. ASEAN includes Burma (Myanmar). Burma is not a happy place.

Post reply on HN