Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom RCE from Pwn2Own 2021

sector7.computest.nl

Post reply on HN
Print view View original

111–120 of 126 posts

Re: Zoom RCE from Pwn2Own 2021

#111

Post by titzer »

josefx wrote: post #105
UncleMeat wrote: post #58

Earlier quoted context omitted.

Imagine thinking we should, literally, police engineering techniques. If you build a bridge then you are expected to use techniques and systems that provide at least some degree of planned safety for the users of that bridge. It is virtually impossible to write a C++ program of any meaningful complexity that processes untrusted data in an unsandboxed environment that does not expose the owner of the device running th…

> Every single person who starts writing a new application in a memory-unsafe language that will deal with untrusted inputs is declaring up front that they are willing to tolerate the inevitable vulnerabilities and exploits caused by that decision. Meanwhile we banished Java and Flash from browsers, with JavaScript still leading every pwn2Own contest because these "memory safe" languages are ultimately still implemen…

I worked on V8 for almost 7 years. It being written in C++ is a cause of a large number of issues. And even larger number of issues is caused by its absolutely massive complexity and the low-level nature of what it does, particularly the object model and the JIT compiler's complex optimizations. Low-level is really dangerous and error prone.

I think every VM should be rewritten in a memory-safe, GC'd language. While there are bugs at the meta-level (i.e. the compiler IR and object representation), making the runtime code itself memory-safe should be table stakes for even talking about a trustworthy implementation.

Re: Zoom RCE from Pwn2Own 2021

#112

Post by Geezus_42 »

koolba wrote: post #20
skrebbel wrote: post #11

Earlier quoted context omitted.

To be frank, if Zoom was a web only app (or maybe web plus web-in-a-electron like eg Slack and WhatsApp) there'd be a vocal HN crowd complaining that there was no proper native app.

Last I checked you didn’t have to install anything. I’m not sure about more advanced usage like screen sharing or how many timing options their are, but for generic “see me, see you” it works fine in the browser.

I can confirm that the in browser version does not allow for remote desktop. I use zoom in a support role because webex is a laggy dumpster fire.

Re: Zoom RCE from Pwn2Own 2021

#113

Post by Popegaf »

titzer wrote: post #43

> This meant that by sending a ResponseKey message with an AES-encrypted element of more than 1024 bytes, it was possible to overflow a heap buffer. This is what I was looking for. Fundamental bug was an overflow of statically-allocated buffer leading to heap corruption. We gotta get off memory-unsafe languages.

That's going to take a while. But at least the linux kernel is starting to integrate Rust. It's doubtful they'll rewrite the whole thing in Rust, but getting it in there is a start.

I know the Chromium team was considering switching to Rust too, but who knows if that's ever going to happen. IIRC Chromium has more LOC than the linux kernel.

Re: Zoom RCE from Pwn2Own 2021

#114

Post by reecko »

UncleMeat wrote: post #109
reecko wrote: post #84

Earlier quoted context omitted.

No, that is why I wrote "subtle implication" there. Unfortunately on online forums, the term "memory-safety" (which is a well-defined term in computer science), is nowadays almost always used in contexts of Rust evangelism. I would be very surprised if the GP's actual intent was that Zoom must have been written in a garbage collected language and not Rust. The wider context of this discussion at all is that whether m…

> But the problem with your take is the subtle implication that Rust is "safe" (not just memory-safe) when in fact there is no empirical evidence or track record of Rust being successfully used in anything remotely mission-critical. If you don't need the performance characteristics or OS-level interaction offered by systems languages, then please use an interpreted language. Please please please please please. But th…

Fair enough. I felt compelled to post in this thread because I've seen the "ban unsafe languages" sentiment expressed several times here and on Reddit before (especially on r/rust I remember reading some comments that had a hostile tone written by people who were serious about it). Your initial comment in this thread resembled one of those.

I think you've misunderstood why I mentioned Verona and Vale though. It is to challenge the notion that there could not be any other language than Rust that could be more ergonomic but with slightly different trade-offs. Moreover, I agree with your point regarding the ecosystem.

Re: Zoom RCE from Pwn2Own 2021

#115

Post by steveklabnik »

Popegaf wrote: post #113
titzer wrote: post #43

> This meant that by sending a ResponseKey message with an AES-encrypted element of more than 1024 bytes, it was possible to overflow a heap buffer. This is what I was looking for. Fundamental bug was an overflow of statically-allocated buffer leading to heap corruption. We gotta get off memory-unsafe languages.

That's going to take a while. But at least the linux kernel is starting to integrate Rust. It's doubtful they'll rewrite the whole thing in Rust, but getting it in there is a start. I know the Chromium team was considering switching to Rust too, but who knows if that's ever going to happen. IIRC Chromium has more LOC than the linux kernel.

There is a PR (or whatever they call them) to add the rust toolchain into chromium’s build infrastructure. The link is in my submission history. Didn’t get any traction on here, but fingers crossed!

Re: Zoom RCE from Pwn2Own 2021

#116

Post by staticassertion »

reecko wrote: post #99
staticassertion wrote: post #89

Earlier quoted context omitted.

You sound paranoid.

That is a neat attempt at making it appear like I am somehow deluded and am imagining Rust evangelism. The person I replied to made a comment down thread that literally states that Rust must be given a free pass despite `unsafe` blocks on the face of such legislation against unsafe languages. Sounds completely illogical to me. https://news.ycombinator.com/item?id=28343526

Yeah, I'm literally saying you are deluded and imagining things. The post you replied to mentions multiple GC and non-GC languages. That you also have a bad opinion about unsafe isn't really important.

Re: Zoom RCE from Pwn2Own 2021

#117

Post by staticassertion »

staticassertion wrote: post #63
dvt wrote: post #55

Earlier quoted context omitted.

> We gotta get off memory-unsafe languages. You read this whole post and that's what you got? Just the fact that this includes a heap grooming step should be pretty telling that it's not very reliable and that it can easily be broken (it probably won't work if you try it after the next Win10 update). I mean, yeah, sure, buffer overflows are bad, but this is an extremely sophisticated attack that relies on like a zill…

Just because there's heap grooming involved doesn't mean it's unreliable. Exploits that use heap grooming can often be ~100% reliable. Our POC for Sigred required lots of heap grooming but it was extremely reliable. https://www.graplsecurity.com/post/anatomy-of-an-exploit-rce... The overflow was hardly a footnote either, it's the primary bug being exploited here.

FWIW, and this is not a 'dis' at the researchers, I would also not say this is "extremely sophisticated". Most attacks these days involve chaining lots of bugs like this and using grooming techniques. It's extremely impressive work and I have great respect for people who can do that, but I would reserve "extremely sophisticated" for cases where novel techniques are used, which isn't really the case here.

Re: Zoom RCE from Pwn2Own 2021

#118

Post by Silhouette »

Thorrez wrote: post #96
Silhouette wrote: post #52

Earlier quoted context omitted.

Basic TLS is sufficient to stop your employer from MITM'ing your personal email session as long as you control what certificates your machine trust. Which, on almost any employer-issued device on a large corporate network today, you won't. Personal stuff goes on personal devices with personal connectivity and uses personal accounts with personal security. Work stuff goes on work devices with work connectivity and use…

Yep. Pinning doesn't protect you, using a personal device protects you. You mention needing to use personal connectivity. I don't think that's necessary. HTTPS should protect you from malicious networks.

HTTPS should protect you from malicious networks.

Yes, but on the kind of network we're talking about, you probably won't be able to make an outbound HTTPS connection at all if you're not going via the required security infrastructure with an appropriate corporate-issued cert.

Re: Zoom RCE from Pwn2Own 2021

#119

Post by userbinator »

UncleMeat wrote: post #75
userbinator wrote: post #70

Earlier quoted context omitted.

That's the last thing I want to hear from the authoritarian industry who also writes user-hostile software, embraces DRM, and is deathly scared of users having control over their general-purpose computers. Insecurity is freedom. (Don't believe me? How is jailbreaking and rooting accomplished?)

I do not believe it is remotely reasonable to say that our software should be deliberately insecure so that people have the ability to root their own devices. That problem can be solved with other means, without exposing all of our devices to anybody else in the world who can send the same payload. If I can root my device through an exploit then I am not at the mercy of the company that made the device. But I am now…

That problem can be solved with other means

That's what they always say --- so how about solving that problem first, before thrusting ourselves head-first into advocating for full authoritarianism?

But I am now at the mercy of every single criminal or oppressive state that wants to use that exploit to harm me.

Good. That means power is not centralised. You can defend yourself instead. Besides, do you really want to be "at the mercy of the company that made the device" ? As we have seen multiple times, they do not really act in your interest.

There's also plenty of dystopian sci-fi to show us what attempts at making a "perfect" society in any way will turn out. This applies to making software "perfectly secure" too.

Re: Zoom RCE from Pwn2Own 2021

#120

Post by reecko »

staticassertion wrote: post #116
reecko wrote: post #99

Earlier quoted context omitted.

That is a neat attempt at making it appear like I am somehow deluded and am imagining Rust evangelism. The person I replied to made a comment down thread that literally states that Rust must be given a free pass despite `unsafe` blocks on the face of such legislation against unsafe languages. Sounds completely illogical to me. https://news.ycombinator.com/item?id=28343526

Yeah, I'm literally saying you are deluded and imagining things. The post you replied to mentions multiple GC and non-GC languages. That you also have a bad opinion about unsafe isn't really important.

Throwing ad-hominems at people criticising your language is not a good long term strategy, though it might appear to work for a while.

Not only there was not any "mentions multiple GC and non-GC languages" in the comment I replied or in the parent comments (except for single mention of C++), I also don't get why I have "bad opinion about unsafe" (and where I claimed it is important?). Such a friendly community. Now I see why people don't engage with Rust evangelists. Lesson learned. Anyway, have a nice day!

Post reply on HN