Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google apps whitelist hardcoded into Chromium open source project

code.google.com

Post reply on HN
Print view View original

11–20 of 61 posts

Re: Google apps whitelist hardcoded into Chromium open source project

#11

Post by mwill »

Throwing some more info here, this is the NaCl whitelist, looks like it was originally added Feb last year [1]. There's a discussion on Chromium Code Reviews here [2], and an issue on the project itself here [3]

The original commit includes the comment 'We should remove this code when PNaCl ships' which got removed somewhere along the way.

[1] http://src.chromium.org/viewvc/chrome/trunk/src/chrome/rende...

[2] https://codereview.chromium.org/9368046

[3] https://code.google.com/p/chromium/issues/detail?id=113668

Re: Google apps whitelist hardcoded into Chromium open source project

#12

Post by RyanZAG »

rurounijones wrote: post #2

What whitelist? JS Execution? No popup blocking? Something else?

Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox.

In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.

Re: Google apps whitelist hardcoded into Chromium open source project

#13

Post by est »

RyanZAG wrote: post #12
rurounijones wrote: post #2

What whitelist? JS Execution? No popup blocking? Something else?

Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.

With DNS hijack, everyone can remote execute.

Re: Google apps whitelist hardcoded into Chromium open source project

#14

Post by darren_ »

RyanZAG wrote: post #12
rurounijones wrote: post #2

What whitelist? JS Execution? No popup blocking? Something else?

Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.

> Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox.

Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/p...? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.

Re: Google apps whitelist hardcoded into Chromium open source project

#15

Post by RyanZAG »

est wrote: post #13
RyanZAG wrote: post #12

Earlier quoted context omitted.

Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.

With DNS hijack, everyone can remote execute.

No, HTTPS only. So probably only Google or the NSA, I guess.

Re: Google apps whitelist hardcoded into Chromium open source project

#16

Post by RyanZAG »

darren_ wrote: post #14
RyanZAG wrote: post #12

Earlier quoted context omitted.

Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.

> Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/p... ? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.

Well there is

https://code.google.com/p/chromium/codesearch#chromium/src/p...

and

https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions...

I haven't looked deeply, but both seem to allow for access outside the sandbox. Maybe a chromium committer could give more detail on the safety of the dev interfaces. They are blocked from public usage for a reason though.

Re: Google apps whitelist hardcoded into Chromium open source project

#17

Post by psionski »

RyanZAG wrote: post #15
est wrote: post #13

Earlier quoted context omitted.

With DNS hijack, everyone can remote execute.

No, HTTPS only. So probably only Google or the NSA, I guess.

Well, it's not like you can't buy a valid certificate for google.com from a turkish CA that is trusted by all browsers... This has happened before, the only question is how much you're willing to pay.

Re: Google apps whitelist hardcoded into Chromium open source project

#18

Post by Aissen »

psionski wrote: post #17
RyanZAG wrote: post #15

Earlier quoted context omitted.

No, HTTPS only. So probably only Google or the NSA, I guess.

Well, it's not like you can't buy a valid certificate for google.com from a turkish CA that is trusted by all browsers... This has happened before, the only question is how much you're willing to pay.

There's also hardcoded HSTS pining for Google certificates, preventing this.

Re: Google apps whitelist hardcoded into Chromium open source project

#20

Post by rmac »

RyanZAG wrote: post #16
darren_ wrote: post #14

Earlier quoted context omitted.

> Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/p... ? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.

Well there is https://code.google.com/p/chromium/codesearch#chromium/src/p... and https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions... I haven't looked deeply, but both seem to allow for access outside the sandbox. Maybe a chromium committer could give more detail on the safety of the dev interfaces. They are blocked from public usage for a reason though.

which parts of the above code/api allow access outside of the sandbox?
Post reply on HN