Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

31–40 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#32

Post by dontdoxxme »

colbyn wrote: post #22

Suppose someone wanted to dive into other projects with the ambition of finding high value bugs. Besides chromium what would you recommend or consider? What would be your thought process for deciding what projects to look into?

Bugs are "High value" in different ways, you have to find the companies willing to pay highly. Most of the high payers are on bug bounty programs (like hackerone.com) and don't always give you ability to talk about bugs later.

Google is quite unique here, particularly given Chrome is paying easily 10x what Mozilla would for a sandbox escape. Apple is in the middle -- per [1] a "WebContent sandbox escape" would be $50k, but to get $250k on their scale you need to combine that with a kernel bug.

So if you want to optimise for "value", you have to pick the targets that are easier (still not easy, obviously).

[1]: https://security.apple.com/bounty/categories/

Re: The Chrome VRP Panel has decided to award $250k for this report

#33

Post by qcnguy »

OutOfHere wrote: post #30

It is unfortunate that there is no web browser in a memory safe language. As I understand, both Chromium and Firefox use C++, although Firefox partly uses Rust. This has put billions of people at risk.

This bug is a logic error iiuc so language wouldn't help.

Re: The Chrome VRP Panel has decided to award $250k for this report

#34

Post by matsemann »

Is there somewhere explaining this bug in terms understandable for someone not dabbling in this?

I don't really understand how this works to "escape the sandbox". Normally it's like a website you visit that get access it shouldn't have. But this talk about renderers and native apis make it seem like it's stuff another process on the computer would do?

Re: The Chrome VRP Panel has decided to award $250k for this report

#35

Post by [deleted] »

matsemann wrote: post #34

Is there somewhere explaining this bug in terms understandable for someone not dabbling in this? I don't really understand how this works to "escape the sandbox". Normally it's like a website you visit that get access it shouldn't have. But this talk about renderers and native apis make it seem like it's stuff another process on the computer would do?

[deleted]

Re: The Chrome VRP Panel has decided to award $250k for this report

#36

Post by sour-taste »

ad-astra wrote: post #5

Impressive. Feel like finding issues like this in such a large project is like looking for a needle in a haystack

I feel like it's the opposite. In a huge project there's bound to be many weird interactions between components, and it's about picking the important/security relevant ones and finding edge cases. In this case the focus was on the interaction between the renderer process and the broker. That forms a security boundary so it makes sense to focus your efforts there - google will pay for such exploits since they can in theory, when combined with other exploits in the renderer process, lead directly to exploits that can be triggered just by opening a web page. So, yes, chrome is a huge project but the list of security-relevant locations to probe actually isn't actually all that long. That's not to diminish the researchers work, it still takes an insane amount of skill to find these issues.

Re: The Chrome VRP Panel has decided to award $250k for this report

#37

Post by mosselman »

dig1 wrote: post #31

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/

Have you looked at the financial health of the one company vs the other? I am pretty sure Google is making more than 10x the money Mozilla is making.

Re: The Chrome VRP Panel has decided to award $250k for this report

#38

Post by acer4666 »

OutOfHere wrote: post #30

It is unfortunate that there is no web browser in a memory safe language. As I understand, both Chromium and Firefox use C++, although Firefox partly uses Rust. This has put billions of people at risk.

This post is about a logic bug that could have happened in any language

Re: The Chrome VRP Panel has decided to award $250k for this report

#39

Post by Retr0id »

matsemann wrote: post #34

Is there somewhere explaining this bug in terms understandable for someone not dabbling in this? I don't really understand how this works to "escape the sandbox". Normally it's like a website you visit that get access it shouldn't have. But this talk about renderers and native apis make it seem like it's stuff another process on the computer would do?

First you compromise the renderer process via e.g. a bug in the JS engine. But even if you have native code execution in the context of the renderer process, you're still in a sandbox.

The bug in the OP is for the second stage - breaking out of the sandbox.

The referenced `patch.diff` is basically for simulating a compromised renderer.

Re: The Chrome VRP Panel has decided to award $250k for this report

#40

Post by MrGilbert »

dig1 wrote: post #31

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/

According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying.

Sounds fine to me.

[0]: https://en.wikipedia.org/wiki/Mozilla_Corporation

//Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percentage.

Post reply on HN