Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Escaping the Chrome Sandbox Through DevTools

ading.dev

Post reply on HN
Print view View original

51–60 of 85 posts

Re: Escaping the Chrome Sandbox Through DevTools

#51

Post by kevindamm »

ballenf wrote: post #49
skriticos2 wrote: post #48

Earlier quoted context omitted.

Yea, legitimate with illegitimate is a weird kind of calculation, as the risk with illegitimate market is to end up in jail, and few people want to calculate the monetary value of lost time due to incareration and all the fallout that comes with it. The more interesting question would be, if the bug bounty is enough to keep legitimate researchers engaged to investigate and document the threats. But.. The bug bounty i…

Is it actually illegal to sell an exploit to the highest bidder? Obviously deploying or using the exploit violates any number of laws. From a speech perspective, if I discovered an exploit and wrote a paper explaining it, what law prevents me from selling that research?

(I'm not a lawyer but) I think that would involve you in the conspiracy to commit the cybercrime, if you developed the exploit and sold it to an entity that used it with wrongful intent.

https://www.law.cornell.edu/uscode/text/18/1029 gives the definition and penalties for committing fraud and/or unauthorized access, and it includes the development of such tools.

A lot of it includes the phrasing "with intent to defraud" so it may depend on whether the court can show you knew your highest bidder was going to use it in this way.

(apologies for citing US-centric law, I figured it was most relevant to the current discussion but things may vary by jurisdiction, though probably not by much)

Re: Escaping the Chrome Sandbox Through DevTools

#52

Post by kevindamm »

Arnt wrote: post #47
luismedel wrote: post #13

Earlier quoted context omitted.

I know not everyone shares my world-view, but I need to be literally starving to consider selling whatever I discover to a criminal. principles > wild market

Not going to name names, but someone I know was happy when his workplace was acquired by a bigger company from another country. He was the most senior developer, had done the heavy lifting, the product was did a good job for its happy users and the buyer would continue that, and last but not least, he'd be rich. Admittedly part of the agreement was a handshake, there had been so much to do, they'd worked insane amoun…

To change your mind about making sure everything is in writing in a binding contract?

Re: Escaping the Chrome Sandbox Through DevTools

#53

Post by billy99k »

Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

I've made lots of money with bug bounties over the years and mostly stopped this year in favor of private consulting. Companies will try anything to get out of paying, even through the major platforms.

I once found a bug where I could access all of the names, addresses, emails, and phone numbers of all users for this new contest this company was running. I even found public announcements on Twitter. They told me this was a staging environment and wouldn't pay me. It clearly wasn't as the urls were linked directly to the announcement.

Another time, a company had an application that allowed other companies to run internal corporate training. I was able to get access to all accounts, information, and private rooms of all fortune 500 companies using it. They initially tried to get out of it by telling me they didn't own the application anymore (and immediately removed it from scope). I had proof it was in scope at the time I found the bugs (and even confirmed it before-hand with the platform).

Luckily, the platform I went through fought this and I got my payout...6 months later.

Even now, I have 50+ bugs that were triaged over the past year and the companies just sit on them and won't respond or pay out. Major platforms like Hackerone and Bug crowd don't seem to protect their researchers at all.

Re: Escaping the Chrome Sandbox Through DevTools

#54

Post by Thorrez »

grokkedit wrote: post #9
Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

they say: `This also means that, unfortunately, the bug will not work on stable builds of Google Chrome since the release channel is set to the proper value there` So it's only working on Chromium, a way smaller attack surface than the whole Chrome users

Slight correction: it worked on Chromium and on Google Chrome canary.

Re: Escaping the Chrome Sandbox Through DevTools

#56

Post by Arnt »

kevindamm wrote: post #52
Arnt wrote: post #47

Earlier quoted context omitted.

Not going to name names, but someone I know was happy when his workplace was acquired by a bigger company from another country. He was the most senior developer, had done the heavy lifting, the product was did a good job for its happy users and the buyer would continue that, and last but not least, he'd be rich. Admittedly part of the agreement was a handshake, there had been so much to do, they'd worked insane amoun…

To change your mind about making sure everything is in writing in a binding contract?

I'd guess most people would react in one of three ways, including that one. I can understand all three.

Re: Escaping the Chrome Sandbox Through DevTools

#57

Post by z3phyr »

skriticos2 wrote: post #48
n2d4 wrote: post #8

Earlier quoted context omitted.

> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

Yea, legitimate with illegitimate is a weird kind of calculation, as the risk with illegitimate market is to end up in jail, and few people want to calculate the monetary value of lost time due to incareration and all the fallout that comes with it. The more interesting question would be, if the bug bounty is enough to keep legitimate researchers engaged to investigate and document the threats. But.. The bug bounty i…

You only risk prison if you sell it to the "bad guys" on the black market. Sell it to people who can jail the bad guys instead; that is, our governments.

Re: Escaping the Chrome Sandbox Through DevTools

#58

Post by z3phyr »

edent wrote: post #36
Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

> sell these on the black market. How? I always see this mentioned but it seem impractical to me. I've discovered bugs which have paid out a few thousand dollars - big corporates have well publicised schemes, but I've no idea how I would go about selling it to a criminal. Even if I did know where to find them - how would I trust them? Can I tell they're not really the police doing a sting? If they paid me, how would…

Sell it to governments. Biggest good guys bad guys.

Re: Escaping the Chrome Sandbox Through DevTools

#59

Post by z3phyr »

faangguyindia wrote: post #46
Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

Chrome needs to be rewritten in Rust asap

Malwares are going to be written in rust; What difference does it make? Also Its not memory based vulnerability but policy based vulnerability.

Re: Escaping the Chrome Sandbox Through DevTools

#60

Post by gardenmud »

londons_explore wrote: post #27
Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

"what percentage of grandmas would lose their life savings if they stumble across this bug" is the metric I use to determine severity. And in this case, it requires a chain of unlikely events. The user tricked into installing an extension (probably not one from the store, which is now particularly hard on windows). The user tricked into opening devtools. It's gonna be sub-1%. Certainly still worth fixing, but nowhere…

Not only that, but it doesn't work on Google Chrome releases, only the (upstream) Chromium, and Google Chrome canary. Very few people use raw Chromium all by its lonesome and I would guess only for testing/development, not downloading random extensions.
Post reply on HN