Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 0day is being exploited now for CVE-2022-1096; update immediately

forbes.com

Post reply on HN
Print view View original

21–30 of 150 posts

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#21

Post by Sunspark »

dclusin wrote: post #15
octoberfranklin wrote: post #9

When the web "standards" are so insanely complicated that even Google can't implement them securely, it's time to admit that we have a problem. When there is only one other complete implementation of these "standards" (with miniscule market share), it's time to panic.

It feels to me like the entire os security model is broken and leaving security up to applications even well resourced ones like chrome is a fools errand. Is there anyway we could benefit from starting again and building a secure os from first principles? Isn’t this one of Fuscias goals?

You have to start further back than you realize. Almost all computers nowadays ship with a second dedicated CPU and OS that you can't access or shut off. They are network self-aware and it is a backdoor. The most well known one is called the Intel Management Engine.

There is no point having better software if you can't even secure the hardware. Yes, the risk is minimal because even if the key to the ME leaks, it will never be given away or sold because it's too valuable. It is still a sense of disquiet for me that it is there in the first place. It doesn't add to the performance or security of your existing setup. It is there to make things easier for others.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#22

Post by svenfaw »

_Nat_ wrote: post #2

> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 1…

For Windows, IE11/Trident. This may sound ridiculous, but if you think about it, it's still maintained security-wise (and will be forever, as per MS), and since its codebase has been frozen a few years ago, its attack surface can only shrink with time.

So if you're OK with the limited compatibility, it might be worth considering.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#23

Post by gruez »

scambier wrote: post #18
amelius wrote: post #14

Is Electron at risk too?

If your Electron app executes third party, remote code. But if it does, you should definitely not use it.

>If your Electron app executes third party, remote code.

There's a high chance that it does because of embedded content/ads/iframes/in-app browsers.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#24

Post by hdjjhhvvhga »

bawolff wrote: post #10
octoberfranklin wrote: post #9

When the web "standards" are so insanely complicated that even Google can't implement them securely, it's time to admit that we have a problem. When there is only one other complete implementation of these "standards" (with miniscule market share), it's time to panic.

There is no indication yet that this is due to complex web standards. It could be, but we literally dont know what the bug is yet.

But we do know that it is Javascript-related, so please correct me if I'm wrong but disabling JS for all websites except the ones you really, really trust and need should offer long-term general protection against such 0-days in most cases.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#25

Post by gruez »

svenfaw wrote: post #22
_Nat_ wrote: post #2

> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 1…

For Windows, IE11/Trident. This may sound ridiculous, but if you think about it, it's still maintained security-wise (and will be forever, as per MS), and since its codebase has been frozen a few years ago, its attack surface can only shrink with time. So if you're OK with the limited compatibility, it might be worth considering.

>it's still maintained security-wise (and will be forever, as per MS),

Source? According to microsoft:

>Please note that the Internet Explorer (IE) 11 desktop application will end support for certain operating systems starting June 15, 2022

>Customers are encouraged to move to Microsoft Edge with IE mode. IE mode enables backward compatibility and will be supported through at least 2029. Additionally, Microsoft will provide notice one year prior to retiring IE mode.

Your best bet right now for IE 11 is an installation of windows server 2022, which contains IE 11 and will be supported till Oct 14, 2031. Still, it's unknown whether IE 11 would be supported by then.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#27

Post by asddubs »

svenfaw wrote: post #22
_Nat_ wrote: post #2

> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 1…

For Windows, IE11/Trident. This may sound ridiculous, but if you think about it, it's still maintained security-wise (and will be forever, as per MS), and since its codebase has been frozen a few years ago, its attack surface can only shrink with time. So if you're OK with the limited compatibility, it might be worth considering.

i think the problem with IE11 is going to be the rendering moreso than the javascript engine. it doesn't support css variables and only a custom version of the grid syntax, so sites are only going to get more broken

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#29

Post by cors-fls »

gruez wrote: post #20

Is there a site/service/mailing list that provides notifications for critical/RCE/in-the-wild exploit patches? Keeping every piece of software you run up-to-date takes a lot of work, and something like that would help with knowing what to prioritize.

Yes ! Computer Emergency Response Teams (CERT)[1] exist in most countries and publish security advisories as newsletters or RSS. e.g. CERT-EU security advisories [2]

But there are so many softwares and exploits that the signal to noise ratio is low if you are not in charge of a big IT infra.

[1] https://en.m.wikipedia.org/wiki/Computer_emergency_response_...

[2] https://cert.europa.eu/cert/newsletter/en/latest_SecurityBul...

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#30

Post by asddubs »

Ourgon wrote: post #16
_Nat_ wrote: post #2

> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 1…

> I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days. Not on the "modern web" you wouldn't, even the current speedy versions of V8 and ${whatever}monkey now used by Firefox the thing often is brought to a crawl by the deluge of…

whenever someone says "the solution is" and then says something that depends on a bunch of individual actors acting of their own accord rather than something systemic, it's hard to take them seriously. in a hypothetical dream world that might be a solution.
Post reply on HN