Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VirtualBox E1000 Guest-to-Host Escape

github.com

Post reply on HN
Print view View original

51–60 of 118 posts

Re: VirtualBox E1000 Guest-to-Host Escape

#51

Post by wiz21c »

cantrevealname wrote: post #43

I think the author brings up a good point about so-called "responsible disclosure" (a self-serving term by the vendors). I'm paraphrasing his 3 reasons for disclosing immediately: 1. It's unacceptable to wait half a year until a vulnerability is patched. 2. Bug bounties are riddled with tricks to delay you, shenanigans as to whether they'll pay you or not, and games to low ball the price. 3. It's arrogant to wait mon…

yep, all of that is equivalent to "security by obscurity". Hiding vulnerabilities longer is of no use, it just helps companies to be ready to answer customers, not to fix things in a better way.

Re: VirtualBox E1000 Guest-to-Host Escape

#52

Post by wiz21c »

FTA :

>>> a browser opened a malicious website in the guest OS is exploited, a browser sandbox escape is made to gain full ring 3 access, an operating system vulnerability is exploited to pave a way to ring 0 from where there are anything you need to attack a hypervisor from the guest OS.

I cracked several games in the end of the 80's but that was nowhere as hard as this seems to be. How do researchers find the time to go so deep in their analysis ? Where do they learn ?

Anyway, the code analysis showed by the author is really good. That's so much clever than old school "replace this check by NOP's" :-) Kudo's

Re: VirtualBox E1000 Guest-to-Host Escape

#53

Post by SOLAR_FIELDS »

metafunctor wrote: post #50

This [1] gives a little more background. The same security researcher found another vulnerability in VirtualBox earlier this year, and didn't have a great experience with Oracle: “We reported this vulnerability to Oracle, the latest update from them is that they are still looking into it, while in fact the latest version of Oracle VirtualBox version 5.2.18 has silently introduced a patch without giving credit or ment…

Does Oracle have a track record of being The Worst about this or should I have assumed as such given my preconceived notions of them being the classic villain in the tech world?

Re: VirtualBox E1000 Guest-to-Host Escape

#54

Post by icebraining »

dev_dull wrote: post #27
cthor wrote: post #19

Earlier quoted context omitted.

These already exist. There are darknet firms that independently verify that an exploit is real (staking their reputation that they won't take it and run once shown), and then open it to the market. The main trouble is that for it to fully work, you need to have the big corps bidding against black hats in this market. I can't see that happening. It'd have big corps dirtying their hands too openly. The other trouble is…

> There are darknet firms that independently verify that an exploit is real (staking their reputation that they won't take it and run once shown), and then open it to the market. Is this really a thing? Who are these firms and what is their take?

One example: http://www.zerodium.com/program.html

Re: VirtualBox E1000 Guest-to-Host Escape

#55

Post by iforgotpassword »

xupybd wrote: post #23
metildaa wrote: post #3

Earlier quoted context omitted.

The author has a number of great points, with an overarching theme that how we handle security bugs is ridiculous.

You don't think there is a place for giving vendors time to fix the exploit before handing it over to everyone who can use it maliciously?

Considering https://blogs.securiteam.com/index.php/archives/3736 I'm not too surprised they just went "fuck you Oracle" this time.

Re: VirtualBox E1000 Guest-to-Host Escape

#57

Post by barrystaes »

Whats the CVE ? [1]

Next Critical Patch Updates by Oracle is scheduled at 15 January 2019. [2]

I see this bug exists at least in part in the open-source parts of VirtualBox. [3] Could it be fixed there?

Could that (that part being opensource) also be reason for the researcher not being granted the bug's bounty?

[1] https://cve.mitre.org/cve/

[2] https://www.oracle.com/technetwork/topics/security/alerts-08...

[3] https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Devic...

Re: VirtualBox E1000 Guest-to-Host Escape

#58

Post by icebraining »

profalseidol wrote: post #22
TheSpiceIsLife wrote: post #6

Earlier quoted context omitted.

With regard to this, maybe there’s an opportunity for a market maker to step in. An “Uber for vulnerabilities”. Having said that, I do tend to think “slap a market on it” can often lead to perverse outcome.

> Having said that, I do tend to think “slap a market on it” can often lead to perverse outcome. Yeah. Just look at where we are today. But calling it "perverse outcome" is sugar coating it. If it wasn't for profit being the king of all (and being the current common sense). Then we would've put more time into making software more secure.

Software not made for profit is very often no more secure.

The problem is not profit, it's that these security issues don't really lower it enough. I've seen the profit motive working very well in a couple of companies when the threat of lowering them (in the form of large fines) appeared thanks to the GDPR.

Re: VirtualBox E1000 Guest-to-Host Escape

#59

Post by iforgotpassword »

ehsankia wrote: post #24
jiveturkey wrote: post #16

huh. is the author a known “security researcher”? i agree more or less with his 3 points.

The author here just blindly assumes a lot of things about VirtualBox's bug bounty program. Many, like Google, put a very strict limit, and they will release the details when that time is over. I think it's more respectful to at least give them a chance, rather than throwing a hot shit on their lap and making hundreds of people's life a living hell for a week. The engineers in charge quickly patching this up aren't t…

Blindly assuming?

https://blogs.securiteam.com/index.php/archives/3736

Sounds pretty first hand to me.

Re: VirtualBox E1000 Guest-to-Host Escape

#60

Post by bayindirh »

SOLAR_FIELDS wrote: post #53
metafunctor wrote: post #50

This [1] gives a little more background. The same security researcher found another vulnerability in VirtualBox earlier this year, and didn't have a great experience with Oracle: “We reported this vulnerability to Oracle, the latest update from them is that they are still looking into it, while in fact the latest version of Oracle VirtualBox version 5.2.18 has silently introduced a patch without giving credit or ment…

Does Oracle have a track record of being The Worst about this or should I have assumed as such given my preconceived notions of them being the classic villain in the tech world?

Relevant discussion in another Oracle related post[0].

[0]: https://news.ycombinator.com/item?id=18389481

Post reply on HN