Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pwn2Own owned all major browsers

h30499.www3.hp.com

Post reply on HN
Print view View original

41–50 of 67 posts

Re: Pwn2Own owned all major browsers

#41

Post by pyre »

TheAnimus wrote: post #26
omgtehlion wrote: post #7

Interesting how Java was pwned thee times in spite of the lowest reward.

We've seen Java bugs in the news lately for use in co-ordinated attacks against large companies. A nameless firm (not the one I'm working with now) that happens to be one of Europes largest banks has insainly locked down versions windows, everything disabled, some custom thing that has hooked NT kernel functiosn to check which image is being loaded to be executed. And then it has Java. A very old, un-patched version…

IIRC, the instances in the news were attacks on the Java applet, not necessarily the runtime. Even if it was against the runtime, without the applet, it would have to be a trojan.

Re: Pwn2Own owned all major browsers

#42

Post by martinced »

TheAnimus wrote: post #26
omgtehlion wrote: post #7

Interesting how Java was pwned thee times in spite of the lowest reward.

We've seen Java bugs in the news lately for use in co-ordinated attacks against large companies. A nameless firm (not the one I'm working with now) that happens to be one of Europes largest banks has insainly locked down versions windows, everything disabled, some custom thing that has hooked NT kernel functiosn to check which image is being loaded to be executed. And then it has Java. A very old, un-patched version…

Do these "insanely locked down" Windows have a browser and does that browser enable Java applets?

The 0-days affecting Java lately have all been using Java applets and drive-by exploits. I'm not saying it's not pathetic and lame for Java's security track records but it's not either as if your company was vulnerable to remote exploits in the case Java applets are not allowed in browsers.

I'm running Java webapp servers and I've been really pissed off that I needed to patch to remote Denial of Service exploits (the hashmap / URL query parameters degenerating to O(n) instead of O(1) SNAFU and the "endless loop" while parsing a certain floating-point number) in late 2011 / early 2012 IIRC but basically that's it.

The JVM is still incredibly secure on the server side (and can be installed on Unx systems in a user account, without needing to be root -- meaning that you can then lock down like mad that user account and have an even more secure setup).

Now to be honest if your company was truly paranoid they wouldn't be using old version of Windows with in-house brittle hacks supposedly bringing "more security".

I know that all too well (at Dexxia for example): some people somewhere decide on a shitty technology (Dexxia was at one point using shitty Java applets to allow clients to do online banking) and then says "We're going to have the most secure system ever".

So these guys think* they're paranoid but they're using: a) Windows and b) Java applets.

And at this point you have to wonder if you should laugh or cry at their definition of "paranoid".

People really paranoid about security ain't letting Windows in (unless they like NSA backdoors and consider patch-tuesday to be a reliable way to execute) and ain't letting Java applets in.

Re: Pwn2Own owned all major browsers

#43

Post by martinced »

raesene2 wrote: post #10
andrewchoi wrote: post #8

I don't really understand the competiton. Do people come to these with just the intention of finding exploits, or do they come with the exploit ready, waiting to collect a reward?

They have the exploits ready to go, the challenge is whether they can exploit the target system (which is fully patched) within their time slot. It's a useful excercise, I think, in that it demonstrates that even the most hardened of codebases still has security bugs and it also serves as a cautionary tale for people who think they don't need multiple layers of defence..

"...it demonstrates that even the most hardened of codebases still has security bugs"

Browsers the most hardened codebase? I nearly spilled my coffee ; )

Every single browsers out there (including Chrome) was designed with security as an after-thought.

As for me I browse the Web from Linux, using a throwaway user account which doesn't have Java installed. And that user account is itself "hardened" (e.g. no login shell, specific per user-id firewalling rules, etc.). At this point seen the state of insecurity the Web is in I'll probably go back to the VM route (a browser in a locked down separate user account, but itself running inside a KVM VM).

My definition of an hardened codebase would be something like OpenBSD or OpenSSH or esL4 (in esL4 the code has been verified (using formal provers) to be free of buffer overrun/overflow and whatnots).

What I don't like about your comment is that you consider the current situation to be "acceptable". You apparently do really believe current browsers are "hardened" and that there are people thinking like you is precisely part of the problem.

We can do much better than that.

For a start I'd love to read a rant from Theo de Raadt about what should be done to conceive more secure web browsers.

Re: Pwn2Own owned all major browsers

#44

Post by kriro »

Are any vendors offering no questions asked X$/0day rewards all year long instead of dedicated events? Seems like it would be a decent move. If the going rate is really in the 50k ballpark why can't say Google offer 10-20k per Chrome exploit?

Their engineers don't make peanuts and the attacks on the software happen regardless. After a year or two you'd probably have a pretty secure system for a reasonable cost.

I don't think there's much negative press involved either if you spin it a la "we have the best security experts in the world attack our software and fix it asap".

+You might pull off a decent talent grab or two as long as you understand how the people would like to work (probably not from a google office)

Re: Pwn2Own owned all major browsers

#45

Post by notdrunkatall »

fulafel wrote: post #36
ghshephard wrote: post #29

Earlier quoted context omitted.

I have a friend who tells me that good (windows) zero days, with remote execution, are worth about $50K on the market that transacts these things, with a contract to increase that value if their is no open disclosure. I.E. If your zero day remains a zero day for another six months, there is an opportunity to see further reward. I've always wondered if it's intelligence agencies, criminal organizations, police organiz…

people have ethics.

They also have to eat.

Re: Pwn2Own owned all major browsers

#47

Post by jonknee »

pimentel wrote: post #33
ars wrote: post #22

Earlier quoted context omitted.

What's wrong with that? Seems perfectly fine to me.

If I didn't know my computer stuff, I would say it's a virus website. What's that h30499? www3? Why not communities.hp.com? (this actually redirects to h30507.www3.hp.com). h30500 asks for httpauth. It's just ugly, is it not?

> If I didn't know my computer stuff, I would say it's a virus website.

If you didn't know your computer stuff you wouldn't have ever noticed the URL.

Re: Pwn2Own owned all major browsers

#48

Post by justinschuh »

TheAnimus wrote: post #31

Considering Chrome had a last minuite patch applied http://nakedsecurity.sophos.com/2013/03/06/last-minute-pre-p... It's good to know it still got taken down, because I had a horrible fear they where going to try and advertise they were 100% safe because they weren't exploited.

There's no last minute patch. We push security and stability updates every 2-3 weeks. Just go look at our release history to verify. As for your other claim, it's so absurdly off base that it doesn't warrant an explicit response.

Re: Pwn2Own owned all major browsers

#49

Post by pavs »

verbophobe wrote: post #46
pavs wrote: post #14

woah! whats with the hp site permalink/URI/url formatting? http://h30499.www3.hp.com/

http://daringfireball.net/linked/2010/03/09/hp-license-plate...

Thanks for the link. This is crazy. SquareWheel was right. This is an absolutely brain-dead way of doing this, by a very incompetent IT admin.

Re: Pwn2Own owned all major browsers

#50

Post by vellum »

kriro wrote: post #44

Are any vendors offering no questions asked X$/0day rewards all year long instead of dedicated events? Seems like it would be a decent move. If the going rate is really in the 50k ballpark why can't say Google offer 10-20k per Chrome exploit? Their engineers don't make peanuts and the attacks on the software happen regardless. After a year or two you'd probably have a pretty secure system for a reasonable cost. I don…

Google's bug bounty is $3,133.70 (elite). The black market can pay $80k-200k+[1]. Why doesn't Google pay more? Well, like you said, "attacks on the software happen regardless". Their objective is to maximize shareholder value. People adopt browsers for other reasons besides maximum security. You hear about critical vulnerabilities all the time, to the point where you get desensitized to it. I don't think there's been a bug out there that caused people to dump a browser en masse.

[1] - http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...

Post reply on HN