Critical Google Chrome hole plugged in 24 hours • Hacker News Board

Re: Critical Google Chrome hole plugged in 24 hours

#21

Post by dhbanes » Fri, Mar 09, 2012, 7:48 AM UTC

throwaway3823 wrote: post #20

gcp wrote: post #18

That's only the Pwnium hack, though. The Pwn2Own vulnerability remains undisclosed and unfixed. Which leads me to the question: why aren't companies like Google customers of companies like Vupen? Too many of them to make it cost-effective? Or does Vupen (for example) prefer if those holes are not fixed? You can sell a vulnerability many times, after all.

Vupen sells 0day exploits so that they can be used to attack people: http://www.vupen.com/english/services/lea-index.php A patched vulnerability would not be worth nearly as much to them and their customers. P.S. Vupen sells to ASEAN. ASEAN includes Burma (Myanmar). Burma is not a happy place.

How hard would it be for Google to be a customer of Vupen without representing themselves as Google?

Re: Critical Google Chrome hole plugged in 24 hours

#22

Post by shrikant » Fri, Mar 09, 2012, 9:27 AM UTC

ja27 wrote: post #9

sedev wrote: post #2

"To date, most successful attacks against Chrome exploit Adobe Flash, which is protected by a significantly more porous sandbox." I notice that pretty much every time I read articles about Pwn2Own and similar. It's high time that Flash was abandoned as a ubiquitous part of the web. It is to web development as Outlook Express was to desktop software in the 90s - sure it's everywhere, but it's not doing much good by be…

I keep it disabled in Chrome and selectively enable it for sites I trust or as-needed. I'm glad to see that it's less necessary over time.

A thousand upvotes to you for this information.

If anybody else is looking, this can be done (without addons) under:

[Wrench] > Settings > "Under the Bonnet" Advanced Settings > "Privacy" Content Settings > Scroll down to "Plugins" and select "Click to Play". Manage exceptions as required.

Re: Critical Google Chrome hole plugged in 24 hours

#23

Post by RexRollman » Fri, Mar 09, 2012, 12:54 PM UTC

shrikant wrote: post #22

ja27 wrote: post #9

Earlier quoted context omitted.

I keep it disabled in Chrome and selectively enable it for sites I trust or as-needed. I'm glad to see that it's less necessary over time.

A thousand upvotes to you for this information. If anybody else is looking, this can be done (without addons) under: [Wrench] > Settings > "Under the Bonnet" Advanced Settings > "Privacy" Content Settings > Scroll down to "Plugins" and select "Click to Play". Manage exceptions as required.

This.

I used to use Flashblock with Chrome but this works just as well, not to mention being built in. I use this setting on my CR-48 (Chromebook).

Re: Critical Google Chrome hole plugged in 24 hours

#24

Post by jrockway » Fri, Mar 09, 2012, 8:30 PM UTC

fpgeek wrote: post #11

Scaevolus wrote: post #10

Earlier quoted context omitted.

Security holes that render the permissions system completely useless, since even a no-permissions app can end up doing anything.

Do you have an example? The cases I've read about were of the form "app A asks app B to do something it can't via the Intent system". That sounds scary until you realize that a standard example of this is an app that can't access the network sharing something via email. In other words, app A has transferred control to app B and what the user does (or doesn't) decide to do with app B is their choice, not app A's.

Indeed. Delegation via intents makes things more secure as broken code can be patched in one place rather than in many. And, you get tighter control over what apps can do: if you never want an app to share something via Facebook, simply uninstall the app that provides the "share via Facebook" intent.

Re: Critical Google Chrome hole plugged in 24 hours

#25

Post by emmelaich » Sat, Mar 10, 2012, 1:25 AM UTC

semenko wrote: post #6

The Chrome Release blog says it's fixed: http://googlechromereleases.blogspot.com/2012/03/chrome-stab... And that the SVN commit history is available: http://build.chromium.org/f/chromium/perf/dashboard/ui/chang... But I don't see any commit that look even remotely related to this exploit. What's up?

My wild-arsed guess is: http://src.chromium.org/viewvc/chrome/branches/963/src/conte...

-- a change to kUnreachableWebDataURL

Re: Critical Google Chrome hole plugged in 24 hours

#26

Post by fpgeek » Sat, Mar 10, 2012, 3:36 AM UTC

jrockway wrote: post #24

fpgeek wrote: post #11

Earlier quoted context omitted.

Do you have an example? The cases I've read about were of the form "app A asks app B to do something it can't via the Intent system". That sounds scary until you realize that a standard example of this is an app that can't access the network sharing something via email. In other words, app A has transferred control to app B and what the user does (or doesn't) decide to do with app B is their choice, not app A's.

Indeed. Delegation via intents makes things more secure as broken code can be patched in one place rather than in many. And, you get tighter control over what apps can do: if you never want an app to share something via Facebook, simply uninstall the app that provides the "share via Facebook" intent.

Interesting point. Sometimes I find myself wanting to keep the app, but drop the intent. Usually that is to shorten a list, but not always. I'd love to see low-level intent-blocking (as well as low-level, fine-grained permissions blocking, but that's a whole other story).