Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 0day is being exploited now for CVE-2022-1096; update immediately

forbes.com

Post reply on HN
Print view View original

131–140 of 150 posts

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#131

Post by figglestar »

nathants wrote: post #73

securing a machine that is updated regularly and runs untrusted code is not realistic, monitoring network exfil is. an exploit that cannot communicate is likely benign and easy to detect in the attempt. monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security. macos has littlesnitch[1], linux has opensnitch[2], or ro…

> monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security.

> bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering.

Is it possible to combine these two with open/tinysnitch somehow? It'd be nice to easily build a whitelist but with the way Windows works I couldn't trust any firewall that was running on Windows itself.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#132

Post by nathants »

figglestar wrote: post #131
nathants wrote: post #73

securing a machine that is updated regularly and runs untrusted code is not realistic, monitoring network exfil is. an exploit that cannot communicate is likely benign and easy to detect in the attempt. monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security. macos has littlesnitch[1], linux has opensnitch[2], or ro…

> monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security. > bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering. Is it possible to combine these two with open/tinysnitch somehow? It'd be nice to easily build a whitelist but with the w…

filtering upstream is easy, just send all traffic to a linux wireguard server and run a snitch there. getting the gui prompt is a bit tricker. for maximum trust, that gui should probably be on another device than the original machine. ie a push notification to your phone.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#133

Post by emerged »

ainar-g wrote: post #60

Looks like these are the two commits, based on the issue number: https://github.com/v8/v8/commit/0981e91a4f8692af337e2588562a... https://github.com/v8/v8/commit/a2cae2180a7a6d64ccdede44d730... Although there could be others.

Interesting, I’ve never seen the “maybe_db” style of variable naming. Makes sense but looks weird.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#134

Post by dTal »

lanstin wrote: post #46
johndfsgdgdfg wrote: post #37

Earlier quoted context omitted.

I just love MS. A company so focused on security and caring about its customers. I always encourage people to use Edge. We need to stop spyware companies like Google.

My what a difference twenty years makes. the relative food and evil of MS and Google have totally swapped. Shows the cost of Google's failure to find other profitable businesses than ads. It is sad for the software revolution, with so much talent in their employees, they had so much potential to improve the world.

Nah - Microsoft will never, ever earn the trust and cachet that early "don't be evil" Google enjoyed. Nor have all of us forgotten their true nature.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#136

Post by zamadatix »

______-_-______ wrote: post #79
zamadatix wrote: post #39

Earlier quoted context omitted.

You can disable jit in Chromium browsers via flag as well. Chromium Edge has this exposed in the UI as "Super Duper Secure Mode". I'm not sure if there is a way to do this on Safari.

I found this comparison of JIT vs non-JIT. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... If you take those charts at face value, they're pretty incredible. The JIT ends up worse than the interpreter for most (real-world non-synthetic) use cases for power usage, memory usage, and startup time. Page load time is a wash. And this is after Google has poured $billions into optimizing V8.

For clarification the graphs aren't comparing JIT vs interpreted they are comparing the JIT tier being allowed vs not allowed.

Even with JIT enabled most functions are still just interpreted, hence why the vast majority of tests are equal as the vast majority of tests are interpreted either way. It's only when the JS engine thinks it can start to realize performance gains on hot code that it will start to JIT it. You can see this behavior in the "Average improvement and regression" graph where JIT starts trading other stats for performance gains.

Knowing this and looking at top "daily browsing" sites you get results about exactly where you'd expect, the JIT engine is tuned to let the vast majority of the code on these sites be interpreted since much is only called a handful of times or less leading to little difference. You see a bit of the JIT engine tiering where it starts to pick up a few of the hot pieces of code at a trade off on the other stats.

If you look beyond "daily browsing" sites into web apps and such that's where JIT is actually focused and where you'll see the most gains. It's intentionally not trying to get involved on lightweight pages because it makes no sense to do there, regardless how much time and money is invested into the JIT it will always know the best performing strategy for some 1 pass JS to set the page layout is to interpret it.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#137

Post by pas »

fulafel wrote: post #89
meibo wrote: post #43

Earlier quoted context omitted.

What you're asking for will probably put you more at risk than V8 does: 1) JavaScript engines with any kind of usable performance are inherently complex 2) V8 is hardened, battle-tested and fuzzed/verified by the best engineers at Google and indepentently by third party researchers, since inception - the engine you will be using probably won't be All of this is really a side-effect of Chrome's popularity and Google's…

> V8 is hardened, battle-tested and fuzzed/verified by the best engineers It's built on unsound foundations that causes an endless stream of this kind of bugs. They make compromises regarding security engineering and then do indeed put a fair amount of engineering resources to mitigate the resulting security problems. This can be said to be good or bad engineering depending on your viewpoint, the alternatives might f…

can you please elaborate on those unsound foundations?

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#138

Post by eternityforest »

sysOpOpPERAND wrote: post #125

why is chrome having so many updates within the past few months? is it because of coverage? (more users?). i use chrome off and on between that and firefox depending on the site and i am surprised how often i've been reading about issues with chrome. should i switch browsers all together?

Basically everyone seems to be getting hacked. It's like all the hackers in the world snorted something and have been hacking nonstop all month.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#139

Post by eternityforest »

Sunspark wrote: post #21
dclusin wrote: post #15

Earlier quoted context omitted.

It feels to me like the entire os security model is broken and leaving security up to applications even well resourced ones like chrome is a fools errand. Is there anyway we could benefit from starting again and building a secure os from first principles? Isn’t this one of Fuscias goals?

You have to start further back than you realize. Almost all computers nowadays ship with a second dedicated CPU and OS that you can't access or shut off. They are network self-aware and it is a backdoor. The most well known one is called the Intel Management Engine. There is no point having better software if you can't even secure the hardware. Yes, the risk is minimal because even if the key to the ME leaks, it will…

I'm fine with the ME, but if it ever did leak, it very well could be sold or dumped on a pastebin.

Hackers are unpredictable. They could throw the plans for a fusion reactor that saves the world in the ocean. They could launch a nuke for the lulz. They can be crazier than wallstreetbets people.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#140

Post by fulafel »

pas wrote: post #137
fulafel wrote: post #89

Earlier quoted context omitted.

> V8 is hardened, battle-tested and fuzzed/verified by the best engineers It's built on unsound foundations that causes an endless stream of this kind of bugs. They make compromises regarding security engineering and then do indeed put a fair amount of engineering resources to mitigate the resulting security problems. This can be said to be good or bad engineering depending on your viewpoint, the alternatives might f…

can you please elaborate on those unsound foundations?

Formulating a plan to make V8 safe with a high degree of assurance sounds like a tall order for a monday HN comment!

I'll just point out that this type confusion bug class is just one of many that plague v8 based on perusing the CVE list, and memory safety errors and other security bugs typical of unsafe C++ seem to play a large part in many. V8 is also huge, and complexity is the enemy of security, there are much smaller JS implementations around.

Just fixing these most high profile bug classes might only reveal some other fundamental soundness issues. So it may be necessray to start from a clean slate with soundness and safety design constraints when adding features.

Post reply on HN