Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Escaping the Chrome Sandbox Through DevTools

ading.dev

Post reply on HN
Print view View original

11–20 of 85 posts

Re: Escaping the Chrome Sandbox Through DevTools

#11

Post by thrdbndndn »

n2d4 wrote: post #8
thrdbndndn wrote: post #6

Earlier quoted context omitted.

I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market." Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless. To give a straightforward a…

> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

I actually don't believe so.

Not everything is priced on demand and supply -- at least not strictly.

Of course the potential of abuse is part of the equation, but I think Google (or similar large companies) simply has a guideline of how the amount of the bounty is decided, than surveying the market to see what its "actual value" is. It's not exactly a free market, at least not on Google's side.

Re: Escaping the Chrome Sandbox Through DevTools

#12

Post by grokkedit »

TheDong wrote: post #5
Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

If you can trick someone into installing a malicious extension with arbitrary permissions, you can already run arbitrary code on every webpage they visit, including their logged in bank, social media, etc. You think an attacker is right now thinking "Man, I know exactly how to make a lot of victims install an extension, but I can only steal their coinbase wallet and bank accounts, if only there was a way I could run…

that's not entirely true: if you look at the manifest on the github repo you can see that it only requires the `tab` permission, which, when installed, will make the extension seem quite safe, since it should not have access to the content of your pages

Re: Escaping the Chrome Sandbox Through DevTools

#13

Post by luismedel »

n2d4 wrote: post #8
thrdbndndn wrote: post #6

Earlier quoted context omitted.

I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market." Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless. To give a straightforward a…

> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

I know not everyone shares my world-view, but I need to be literally starving to consider selling whatever I discover to a criminal.

principles > wild market

Re: Escaping the Chrome Sandbox Through DevTools

#14

Post by n2d4 »

thrdbndndn wrote: post #11
n2d4 wrote: post #8

Earlier quoted context omitted.

> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

I actually don't believe so. Not everything is priced on demand and supply -- at least not strictly. Of course the potential of abuse is part of the equation, but I think Google (or similar large companies) simply has a guideline of how the amount of the bounty is decided, than surveying the market to see what its "actual value" is. It's not exactly a free market, at least not on Google's side.

I assure you that when Google set those bounties, they thought about how much they would have to pay white hats to make them do the right thing. Of course, it's a highly illiquid market (usually there's just one seller and only a handful of buyers), and so the pricing is super inefficient (hence based on guidelines and not surveying on every individual bug), but the logic remains.

Re: Escaping the Chrome Sandbox Through DevTools

#16

Post by graemep »

luismedel wrote: post #13
n2d4 wrote: post #8

Earlier quoted context omitted.

> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

I know not everyone shares my world-view, but I need to be literally starving to consider selling whatever I discover to a criminal. principles > wild market

I think many people have internalised a purely profit driven world view, and it is what they expect to be the main motivator or themselves and others.

Re: Escaping the Chrome Sandbox Through DevTools

#17

Post by n2d4 »

luismedel wrote: post #13
n2d4 wrote: post #8

Earlier quoted context omitted.

> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

I know not everyone shares my world-view, but I need to be literally starving to consider selling whatever I discover to a criminal. principles > wild market

But you probably wouldn't take the time to write up a nice report and send it to Google either if they didn't pay. Or even try to find the bug in the first place.

(But yea, I think lots of people would sell exploits to criminals for enough money.)

Re: Escaping the Chrome Sandbox Through DevTools

#18

Post by beng-nl »

TheDong wrote: post #5
Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

If you can trick someone into installing a malicious extension with arbitrary permissions, you can already run arbitrary code on every webpage they visit, including their logged in bank, social media, etc. You think an attacker is right now thinking "Man, I know exactly how to make a lot of victims install an extension, but I can only steal their coinbase wallet and bank accounts, if only there was a way I could run…

I actually think escaping the browser is a huge leap and a frequently a primary goal for a black hat. Eg someone trying to install ransomware, or a spy targeting a specific person or org.

From outside the browser they can exploit kernel bugs to elevate their privilege; and they can probe the network to attempt to move laterally in the org.

So while I think your comment is thoughtful, its thoughtfulness made me think of agreeing with the opposite :-)

Re: Escaping the Chrome Sandbox Through DevTools

#20

Post by Etheryte »

alkonaut wrote: post #10
Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

If it had worked for Chrome it should (and maybe would) have been a lot higher. Also: doesn't it use an extension? I was under the impression that extensions were un-sandboxed and basically just executables I trust to run with the same privilege as the browser itself (which is a lot, at least under windows).

No, extensions are tied to the browser sandbox and they also have to specify their permissions beforehand. They can request fairly wide permissions inside the browser sandbox, yes, but they have to explicitly list the permissions they require in the manifest and the browser will ask you if you're fine with those before installing. Outside of the browser itself, the extensions can't do pretty much anything outside of sending messages to applications that explicitly register to receive them from them.
Post reply on HN