Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VirtualBox E1000 Guest-to-Host Escape

github.com

Post reply on HN
Print view View original

111–118 of 118 posts

Re: VirtualBox E1000 Guest-to-Host Escape

#111

Post by cantrevealname »

dexen wrote: post #82
cantrevealname wrote: post #43

I think the author brings up a good point about so-called "responsible disclosure" (a self-serving term by the vendors). I'm paraphrasing his 3 reasons for disclosing immediately: 1. It's unacceptable to wait half a year until a vulnerability is patched. 2. Bug bounties are riddled with tricks to delay you, shenanigans as to whether they'll pay you or not, and games to low ball the price. 3. It's arrogant to wait mon…

While you raise very good points overall, this one I have beef with: >SSDs that encrypt the drive with a key that doesn't depend on the password AFAIK, this is the standard practice in software harddrive/filesystem encryption - LUKS, TrueCrypt, etc., for practical reasons, and with no negative impact on security if properly implemented. AFAIK again, this is also how Firefox handles encryption of stored website login/…

> You wrote: user supplies her own password, this key is encrypted with that password

The critical point you're missing is that the Crucial SSD was not doing that step. If the key doesn't depend on the password, then the raw key has to exist somewhere on the Crucial hard drive or in its firmware, so the task becomes an easy hunt for the key with a debugger. No password cracking required.

Re: VirtualBox E1000 Guest-to-Host Escape

#112

Post by epicalex »

zkomp wrote: post #104
skocznymroczny wrote: post #73

Earlier quoted context omitted.

"You need to think of Larry Ellison the way you think of a lawnmower. You don't anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it'll chop it off, the end. You don't think 'oh, the lawnmower hates me' -- lawnmower doesn't give a shit about you, lawnmower can't hate you. Don't anthropomorphize the lawnmower. Don't fall into that trap about Oracle."

It's even better when he slips and say: "Don't anthropomorphize Larry Ellison"

That wasn't a slip

Re: VirtualBox E1000 Guest-to-Host Escape

#113

Post by [deleted] »

bdhess wrote: post #47
ehsankia wrote: post #24

Earlier quoted context omitted.

The author here just blindly assumes a lot of things about VirtualBox's bug bounty program. Many, like Google, put a very strict limit, and they will release the details when that time is over. I think it's more respectful to at least give them a chance, rather than throwing a hot shit on their lap and making hundreds of people's life a living hell for a week. The engineers in charge quickly patching this up aren't t…

> rather than throwing a hot shit on their lap Well really, Oracle threw the hot shit in customers’ laps. The author just had the gall to point it out. > making hundreds of people's life a living hell for a week > Making them pay for it seems like a pretty shitty move. It sounds like you assume Oracle is going to abuse its staff in the process of getting this fixed. I don’t know why you assume that, nor why the autho…

[deleted]

Re: VirtualBox E1000 Guest-to-Host Escape

#114

Post by drivebywanker »

xupybd wrote: post #23
metildaa wrote: post #3

Earlier quoted context omitted.

The author has a number of great points, with an overarching theme that how we handle security bugs is ridiculous.

You don't think there is a place for giving vendors time to fix the exploit before handing it over to everyone who can use it maliciously?

No. The vendor should not have created the shoddy software in the first place.

Why are we protecting them from embarrassment? They are incompetent and they should be embarrassed about it and they should pay the price, up to and including corporate death and the jailing of the executives, engineers and everybody in between who was responsible if the fallout warrants it.

Re: VirtualBox E1000 Guest-to-Host Escape

#115

Post by drivebywanker »

ehsankia wrote: post #24
jiveturkey wrote: post #16

huh. is the author a known “security researcher”? i agree more or less with his 3 points.

The author here just blindly assumes a lot of things about VirtualBox's bug bounty program. Many, like Google, put a very strict limit, and they will release the details when that time is over. I think it's more respectful to at least give them a chance, rather than throwing a hot shit on their lap and making hundreds of people's life a living hell for a week. The engineers in charge quickly patching this up aren't t…

What exactly did they do to earn our respect?

Shit out software I'd have been ashamed of when I was 16? Sell us to advertisers? Build walled gardens to keep us locked in?

Re: VirtualBox E1000 Guest-to-Host Escape

#116

Post by exikyut »

ChickeNES wrote: post #107
exikyut wrote: post #38

Earlier quoted context omitted.

Homebrew OS? Interesting. What did it do? Can I see it anywhere? What VM were you using? Host OS crashes like what you describe are no-trust-me-it's-really-not-the-compiler unlikely. I did have X crash on me once while figuring out the X11 protocol specification, but that's because X is widely known to be less than perfectly stable :D and also because the actual graphics driver I was using was a little flaky.

I took an OS class and wanted to learn more afterwards so I hacked together a small kernel mostly using info from the osdev wiki. I got decently far (managed to have a shell running, had VIM running), but ran out of steam years ago (that and the code needing a massive amount of cleanup and auditing). So I misremembered (it's been 6+ years ago) but it was the AMD PCNET driver I wrote that triggered the crash, not E100…

Interesting. I've been eyeing OS development for a while myself. I have a few high-level ideas about kernel design, and a few years's worth of musings about good UX. I badly need to get on with spending a few years getting my feet wet with actual implementation details and such so I'm not just a pile of unorientated hot air though, haha. Armchair pontificating doesn't count for much. But anyway.

Huh, a shell and Vim. (Alongside multiple architecture support and two filesystems.) That's reasonably developed-out. Not bad!

Can totally understand the problem of running out of steam. (I think that might be why I've been so hesitant about diving in myself - want to pace things so they stay interesting for long enough, and don't want to make too many discouraging mistakes. A couple kernel architecture arguments doesn't produce a good filesystem, adequately future-proof UI model, good vertical "little detail" semantics, etc etc.

A hard crash on multiple platforms? That's almost definitely a bug. Heh, I think all the downvoters might've made a bunch of incorrect presumptions there :)

It might be mildly interesting to see if you can still trigger the crash with the latest version of VirtualBox. (I'd have a go but of course I have no repro details, or info on how to actually build everything for that matter.)

Precedent has just been set on 0daying VB networking hardware, for what that's worth :P but there's also Project Zero (which will accept security vulnerabilities in any software, and imposes a 90-day deadline) if VB's own bug bounty thing proves unappealing. This is of course getting a bit ahead of testing/re-verification. I mention it because I'm now very curious to know if the bug is still there, but of course HN comments are not the right place for a [Y] :)

It's impossible to say if recreating the test environment (host OS version(s), host VirtualBox version) would prove fruitful if the latest VB versions seem (...seem...) immune. Vulnerability research seems to be consist of a lot of "hmm, that seems like it might run a tiny bit slower on months with a Q in them if the computer is leaning 30° to the left at 2:14PM in the afternoon" and then staring at Hex-Rays for 3 months to ultimately prove that your crazy theory is in fact valid (literal example https://ramtin-amin.fr/#nvmedma; very similar example https://bugs.chromium.org/p/chromium/issues/detail?id=648971 - "one byte overflow"!).

In any case, I wouldn't mind getting some more details and seeing the CLUNK in action. It's interesting at face value.

NB. About that nvmedma link - it took me about 4-5 rereads of that article and its prequel (https://ramtin-amin.fr/#nvmepcie) before the bigger picture started to click.

(I also need to check my comments somewhat frequently - and then remember to also actually follow-up after seeing I have replies! Woops. Thanks for the reply!)

Re: VirtualBox E1000 Guest-to-Host Escape

#117

Post by ehsankia »

bdhess wrote: post #47
ehsankia wrote: post #24

Earlier quoted context omitted.

The author here just blindly assumes a lot of things about VirtualBox's bug bounty program. Many, like Google, put a very strict limit, and they will release the details when that time is over. I think it's more respectful to at least give them a chance, rather than throwing a hot shit on their lap and making hundreds of people's life a living hell for a week. The engineers in charge quickly patching this up aren't t…

> rather than throwing a hot shit on their lap Well really, Oracle threw the hot shit in customers’ laps. The author just had the gall to point it out. > making hundreds of people's life a living hell for a week > Making them pay for it seems like a pretty shitty move. It sounds like you assume Oracle is going to abuse its staff in the process of getting this fixed. I don’t know why you assume that, nor why the autho…

> Oracle threw the hot shit

Right, Oracle as an organization did, not necessarily the engineers who will be tasked with fixing this.

> Oracle is going to abuse its staff

Not necessarily abuse, but obviously, having 30 days to fix something is a much more saner experience than when every minute counts.

Post reply on HN