Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Escaping the Chrome Sandbox Through DevTools

ading.dev

Post reply on HN
Print view View original

21–30 of 85 posts

Re: Escaping the Chrome Sandbox Through DevTools

#21

Post by webXL »

TheDong wrote: post #5
Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

If you can trick someone into installing a malicious extension with arbitrary permissions, you can already run arbitrary code on every webpage they visit, including their logged in bank, social media, etc. You think an attacker is right now thinking "Man, I know exactly how to make a lot of victims install an extension, but I can only steal their coinbase wallet and bank accounts, if only there was a way I could run…

Correct me if I’m wrong, but remote code execution has the advantage of being able to access information without the user being involved at all. Sure the user needs to install and trigger the exploit, but whatever code the attacker runs doesn’t require the user to interact with certain urls. If you can launch arbitrary programs, you can probably install all sorts of nasty things that are potentially more lucrative than the victim’s bank or coinbase accounts.

Re: Escaping the Chrome Sandbox Through DevTools

#22

Post by cookiengineer »

luismedel wrote: post #13
n2d4 wrote: post #8

Earlier quoted context omitted.

> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

I know not everyone shares my world-view, but I need to be literally starving to consider selling whatever I discover to a criminal. principles > wild market

> principles > wild market

Your principles will be gone by the time the 10th company starts to sue you for a public disclosure you did in good faith.

There's a reason why nobody wants to use their real name and creates new aliases for every single CVE and report.

Principles are discrepancies with the law, they don't exist. If the law dictates a different principle than your own one, guess what, you'll be the one that is in jail.

Whistleblower protection laws are a bad joke, and politicians have no (financial) incentives to change that.

Re: Escaping the Chrome Sandbox Through DevTools

#23

Post by therein »

webXL wrote: post #21
TheDong wrote: post #5

Earlier quoted context omitted.

If you can trick someone into installing a malicious extension with arbitrary permissions, you can already run arbitrary code on every webpage they visit, including their logged in bank, social media, etc. You think an attacker is right now thinking "Man, I know exactly how to make a lot of victims install an extension, but I can only steal their coinbase wallet and bank accounts, if only there was a way I could run…

Correct me if I’m wrong, but remote code execution has the advantage of being able to access information without the user being involved at all. Sure the user needs to install and trigger the exploit, but whatever code the attacker runs doesn’t require the user to interact with certain urls. If you can launch arbitrary programs, you can probably install all sorts of nasty things that are potentially more lucrative th…

It breaks the assumption that Chrome is sandboxed and something I do as a user including installing an extension will not have an impact outside of Chrome. A new process outside Chrome to call your own and do whatever you want with.

You're on Windows? Download a binary, create some WMI triggers and get executed at every boot as the same user (requires no elevation for same user, if Admin, you can get NT_AUTHORITY). If you find something to elevate to Administrator you could also patch the beginning of some rarely used syscall and then invoke it and get a thread to yourself in the kernel. These things tend to almost chain themselves sometimes. At least on Windows it feels that way.

Also the user doesn't have to navigate to a specific URL in the final form, just needs to open devtools after installing the extension.

Re: Escaping the Chrome Sandbox Through DevTools

#25

Post by wslh »

n2d4 wrote: post #8
thrdbndndn wrote: post #6

Earlier quoted context omitted.

I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market." Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless. To give a straightforward a…

> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

> it's priced on demand and supply like anything else

You should complete the sentence: “It’s priced based on demand and supply in legal markets like anything else.”

There are, of course, other markets where things like this are traded, but that’s a different story. That said, I think the author is free to negotiate further with Google if they believe it’s worth it.

Re: Escaping the Chrome Sandbox Through DevTools

#27

Post by londons_explore »

Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

"what percentage of grandmas would lose their life savings if they stumble across this bug" is the metric I use to determine severity.

And in this case, it requires a chain of unlikely events. The user tricked into installing an extension (probably not one from the store, which is now particularly hard on windows). The user tricked into opening devtools.

It's gonna be sub-1%. Certainly still worth fixing, but nowhere near as bad as a universal XSS bug.

Re: Escaping the Chrome Sandbox Through DevTools

#28

Post by 7thpower »

thrdbndndn wrote: post #6
Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market." Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless. To give a straightforward a…

I suspect the fact there is potentially a wider addressable market via the black market probably has more to do with the price setting mechanism than an immorality premium.

Although, maybe there is something to the immorality/illegality tax in this case. The author is in high school (how cool is that!?) and the article would probably hit differently to perspective employers if they were detailing the exploit they had sold to NK (which is to say nothing of how NK would feel about the sunlight).

Re: Escaping the Chrome Sandbox Through DevTools

#30

Post by [deleted] »

wslh wrote: post #25
n2d4 wrote: post #8

Earlier quoted context omitted.

> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

> it's priced on demand and supply like anything else You should complete the sentence: “It’s priced based on demand and supply in legal markets like anything else.” There are, of course, other markets where things like this are traded, but that’s a different story. That said, I think the author is free to negotiate further with Google if they believe it’s worth it.

[deleted]
Post reply on HN