A Tale of Two Pwnies (Part 1) • Hacker News Board

Re: A Tale of Two Pwnies (Part 1)

#31

Post by wizzard » Tue, May 22, 2012, 10:48 PM UTC

Arelius wrote: post #18

adrusi wrote: post #11

Earlier quoted context omitted.

someone's gotta write the kernels though, I can't think of any way to write kernels or compilers where memory corruption is impossible.

In theory, it's possible to use a formally verified approach to ensure this can't happen, and there is a lot of research into that. There is a version of the L4 microkernel that has been formally verified which should prevent memory corruption in kernel space, but I don't know the exact details. This of course won't prevent corruption due to physical sources, such as radiation, but with physical access to a machine y…

L4 was verified to the tune of about $4.6 million dollars, or $500 per line of code. And that's for a microkernel under 10 KLOC. And that's assuming no changes are made. Ever.

Re: A Tale of Two Pwnies (Part 1)

#32

Post by wizzard » Tue, May 22, 2012, 10:55 PM UTC

jorgem wrote: post #3

So crazy. I wonder how long it took to come up with that attack? There must have been a ton of dead ends along the way.

Well, if you start from the last step (I want to load an NPAPI extension because I can gain control from one) and work backwards it seems a little less like stumbling in the dark.

I liked the confirmation prompt bug though, that was icing on the cake.

Re: A Tale of Two Pwnies (Part 1)

#33

Post by rheide » Tue, May 22, 2012, 11:02 PM UTC

xyome wrote: post #14

tptacek wrote: post #9

Earlier quoted context omitted.

I really doubt that we'll be using programming environments where memory corruption is possible in 2040.

Here's a paper describing how to escape from a VM using memory errors. They're causing memory errors by putting a lit light bulb close to the memory chips: http://sip.cs.princeton.edu/pub/memerr.pdf Neat hack :)

This was a fascinating read. Thanks.

Re: A Tale of Two Pwnies (Part 1)

#34

Post by zobzu » Tue, May 22, 2012, 11:05 PM UTC

Natsu wrote: post #12

tptacek wrote: post #4

What's amazing about this bug is that at every step you learn something that makes Pinkie Pie more terrifying while simultaneously making the Chrome security model sound more and more forbidding.

And the worst is yet to come.... --- In an upcoming post, we’ll explain the details of Sergey Glazunov’s exploit, which relied on roughly 10 distinct bugs. While these issues are already fixed in Chrome, some of them impact a much broader array of products from a range of companies. So, we won’t be posting that part until we’re comfortable that all affected products have had an adequate time to push fixes to their us…

The post is great in itself (clear and easy) but the constant marketing speech about how great Chrome is regardless of the bugs gets on my nerves to be honest. Yes Chrome is a very good browser, but I don't have to read that every paragraph in various forms... specially for tech articles.

It also looks like to me that devs commit code in a more lazy way since Chrome has a strong sandbox model for various components. But as a result, it seems easier to find many bugs that, when combined, bypass the sandbox, as show.

Just my 2cts ;-)

Re: A Tale of Two Pwnies (Part 1)

#35

Post by wtracy » Tue, May 22, 2012, 11:07 PM UTC

skeletonjelly wrote: post #17

TheBoff wrote: post #10

Earlier quoted context omitted.

Pay them to find the bugs!

Just don't let them run out of bugs to find, or get bored :P

What's the problem if they run out of bugs to find? Would that not imply that there are no exploits left to be made?

Re: A Tale of Two Pwnies (Part 1)

#36

Post by tptacek » Tue, May 22, 2012, 11:11 PM UTC

zobzu wrote: post #34

Natsu wrote: post #12

Earlier quoted context omitted.

And the worst is yet to come.... --- In an upcoming post, we’ll explain the details of Sergey Glazunov’s exploit, which relied on roughly 10 distinct bugs. While these issues are already fixed in Chrome, some of them impact a much broader array of products from a range of companies. So, we won’t be posting that part until we’re comfortable that all affected products have had an adequate time to push fixes to their us…

The post is great in itself (clear and easy) but the constant marketing speech about how great Chrome is regardless of the bugs gets on my nerves to be honest. Yes Chrome is a very good browser, but I don't have to read that every paragraph in various forms... specially for tech articles. It also looks like to me that devs commit code in a more lazy way since Chrome has a strong sandbox model for various components.…

There is no way to explain how awesome Pinkie Pie's exploit is without simultaneously explaining how intricate Chrome's security model is.

A great way to market a browser is to have a security model so interesting/effective/intricate that any description of a working exploit will also serve as marketing.

Re: A Tale of Two Pwnies (Part 1)

#37

Post by 0xOXO » Tue, May 22, 2012, 11:25 PM UTC

"low level interface to the GPU command buffers"

This sounds cool.

Is this something that will be accessible to an interested Chrome user?

Re: A Tale of Two Pwnies (Part 1)

#38

Post by tptacek » Tue, May 22, 2012, 11:38 PM UTC

jerf wrote: post #30

adrusi wrote: post #11

Earlier quoted context omitted.

someone's gotta write the kernels though, I can't think of any way to write kernels or compilers where memory corruption is impossible.

You don't write them in C. You write them in a not-yet-existing language that allows low-level, but safe, access. (Prototypes of this language certainly already exist, I'm not convinced any are ready for this level of prime time.) You probably also have some additional hardware support not yet existing. And while, yes, deep at the heart of the system there will be something or some set of somethings that, if screwed…

I definitely don't think that eliminating memory corruption vulnerabilities will produce security shangri-la. Most of the vulnerabilities we find every day aren't memory corruption.

Re: A Tale of Two Pwnies (Part 1)

#39

Post by thereason » Tue, May 22, 2012, 11:38 PM UTC

"a low level interface to the GPU command buffer"

This sounds cool. Is this a standard feature in Chrome?

Re: A Tale of Two Pwnies (Part 1)

#40

Post by moldbug » Tue, May 22, 2012, 11:54 PM UTC

tptacek wrote: post #36

zobzu wrote: post #34

Earlier quoted context omitted.

The post is great in itself (clear and easy) but the constant marketing speech about how great Chrome is regardless of the bugs gets on my nerves to be honest. Yes Chrome is a very good browser, but I don't have to read that every paragraph in various forms... specially for tech articles. It also looks like to me that devs commit code in a more lazy way since Chrome has a strong sandbox model for various components.…

There is no way to explain how awesome Pinkie Pie's exploit is without simultaneously explaining how intricate Chrome's security model is. A great way to market a browser is to have a security model so interesting/effective/intricate that any description of a working exploit will also serve as marketing.

Pinkie Pie is a frickin' genius.

But I'm curious about this equation, interesting == effective == intricate. Intricate == complex, right? So, the exploit certainly reveals that Chrome's security model is complex. And this is supposed to be a good thing? Seems like a good thing, if you're Pinkie Pie...