Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 0day is being exploited now for CVE-2022-1096; update immediately

forbes.com

Post reply on HN
Print view View original

51–60 of 150 posts

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#51

Post by jacquesm »

dclusin wrote: post #47
jacquesm wrote: post #45

Earlier quoted context omitted.

You may want to review that very carefully, typically if that separate network port doesn't have a live network on it that issues DHCP addresses the functionality will fall back to the port that is attached.

Oh fun. Thank you for the tip! Any sugestions on how to go about this? I'm a relative newb in these matters. Switching from MacOS to linux daily driver

Keep an eye on ports 16992-16995, 5900, 623, 664, and realize that packets destined for those ports may never become visible to the OS so you'll have to catch them in transit to the board. Another place to look at is what DHCP leases are issued by your DHCP server, conceivably the management engine could request an address for itself.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#54

Post by Ourgon »

bastawhiz wrote: post #17
Ourgon wrote: post #16

Earlier quoted context omitted.

> I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days. Not on the "modern web" you wouldn't, even the current speedy versions of V8 and ${whatever}monkey now used by Firefox the thing often is brought to a crawl by the deluge of…

> it would be possible to browse the web using a slow-but-'safe' browser. Some pages (e.g. SPAs) really depend on all that Javascript and as such won't be useable withour 'modern' JS engines but there is no reason for e.g. your bank or payment processor's pages to depend on near-native speed Javascript engines. I don't plan on my bank trying to 0day my browser. If anything, I trust them not to do anything malicious m…

You don't seem to understand what I wrote so I'll explain it:

- imagine a slow-but-secure browser, 10 to 100 times as slow and using 10 times as much memory as stated by the parent poster

- imagine your bank and payment processor using a minimal amount of Javascript on their sites to make it possible to use that secure-but-slow browser without incurring too big a performance penalty

Do you now see what I mean? It is not that your financial institutions would zero-day you, it is that you'd use the secure-but-slow browser (or browser mode) to access those sites. Secure, because you're dealing with financial data. Slow because that is what the parent poster stated as the price he'd be willing to pay for a secure browser.

You can you your insecure-but-speedy browser to watch cat videos where the H4CkZ0Rz can try to zero-day you to their hearts content because that browser does not have access to sensitive data. You could try to watch those cat videos with the secure-but-slow browser but that'd transport you back to the late 90's with single-digit frame rates (cat slide shows?).

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#56

Post by sofixa »

johndfsgdgdfg wrote: post #37
svenfaw wrote: post #22

Earlier quoted context omitted.

For Windows, IE11/Trident. This may sound ridiculous, but if you think about it, it's still maintained security-wise (and will be forever, as per MS), and since its codebase has been frozen a few years ago, its attack surface can only shrink with time. So if you're OK with the limited compatibility, it might be worth considering.

I just love MS. A company so focused on security and caring about its customers. I always encourage people to use Edge. We need to stop spyware companies like Google.

Microsoft is not focused on security. The amount of trivially exploitable extremely serious security bugs in Azure scream "nobody even pretends to think about security here".
Post reply on HN