Good antivirus should protect you from such attacks.
Even zero day ones.
Actively exploited sandbox RCE in all Chromium versions
311–320 of 527 posts
Re: Actively exploited sandbox RCE in all Chromium versions
#312Earlier quoted context omitted.
If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched. Further: a vulnerability is probably…
I was under the impression that the three letter agencies and contractors bought vulnerabilities?
They want the good shit, not this bargain bin fuckup
Re: Actively exploited sandbox RCE in all Chromium versions
#313Earlier quoted context omitted.
They should just multiply a base rate against the severity level. Say the base rate is ranged so low-severity stuff is $500-1K base but high-severity stuff is $10K base. That would net a researcher ~$88K for this specific bug (8.8 severity).
That would create a perverse incentive to inflate the severity levels even more than they already are
It doesn't have to. Just put a cap and say "we officially recognize 1-10" and be done with it.
Re: Actively exploited sandbox RCE in all Chromium versions
#314I’m so tired. I think I’m just going to get a job as a garbage man and cancel my internet.
You've not watched the poor guy have to reboot his truck, have you?
Re: Actively exploited sandbox RCE in all Chromium versions
#315Earlier quoted context omitted.
They should just multiply a base rate against the severity level. Say the base rate is ranged so low-severity stuff is $500-1K base but high-severity stuff is $10K base. That would net a researcher ~$88K for this specific bug (8.8 severity).
CVE severity is a terrible way to do this. If you follow the cybersecurity space you should know why.
It's a simple multiplier number and you can set a cap on it (and payout amounts). Where's the fire?
Re: Actively exploited sandbox RCE in all Chromium versions
#316Earlier quoted context omitted.
Okay, and why is that more of a security risk than executing arbitrary JavaScript in the sandbox?
Among other things, JavaScript in the browser has no way to even express "kill PID 1234 on the user's machine" or "list the contents of `C:\Users\Documents` and upload all of the files" or "spawn cmd.exe on the user's machine". How would you even do these things if you could run any JavaScript in the browser? You can't. However, chrome.exe itself does because it's a native application, as is the sandboxed JavaScript…
Okay, but we're still talking about running machine code inside the sandbox, where that functionality is still not available.
Re: Actively exploited sandbox RCE in all Chromium versions
#317Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.
And people ask me why I complain about web pages failing to display basic content without JS.
(I keep WASM and WebGL disabled in Firefox settings, too. Yes, I had another post ITT questioning why those things are any less secure than the JavaScript, given that they're supposed to be in a sandbox. But you know, defense in depth. It's insane that we're expected to put up with these grossly unnecessary risks all the time. Just like how it's insane that frontier models are being tested in environments that are physically capable of connecting to the Internet at large.)
Re: Actively exploited sandbox RCE in all Chromium versions
#318Earlier quoted context omitted.
That's basically the comment I was just going to write but you made me not need to. We need simpler protocols and formats, especially those that are used over the internet. I want everyone to really start fighting for this. I always use a browser that doesn't run any scripts (w3m) for both this reason and others. It hurts when I see websites that don't work without js. A bit funny though that this page is one of them…
> We need simpler protocols and formats But we do! It doesn't get much simpler than HTML/CSS/JS. It's just abused to make apps instead of web documents.
Hm. HTML, maybe. CSS and JS? No way. View the CSS here sometime:
Re: Actively exploited sandbox RCE in all Chromium versions
#319> Type confusion in V8 Fortunately I disabled js by default. Unfortunately, it breaks about 30% of the web. Including nvd.nist.gov, which shows a completely blank page without js enabled, even though with js it’s just a simple page with only static content.
> Unfortunately, it breaks about 30% of the web. Only 30?
People who disable JS are very likely to have delusions like this.
Re: Actively exploited sandbox RCE in all Chromium versions
#320I would guess it's now trivial for attackers to have an llm analyse every new commit to chromium repo linking to an issue that's 403 for security reasons, but maybe I'm missing something.