Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 0day is being exploited now for CVE-2022-1096; update immediately

forbes.com

Post reply on HN
Print view View original

71–80 of 150 posts

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#71

Post by CiPHPerCoder »

gruez wrote: post #41
cors-fls wrote: post #29

Earlier quoted context omitted.

Yes ! Computer Emergency Response Teams (CERT)[1] exist in most countries and publish security advisories as newsletters or RSS. e.g. CERT-EU security advisories [2] But there are so many softwares and exploits that the signal to noise ratio is low if you are not in charge of a big IT infra. [1] https://en.m.wikipedia.org/wiki/Computer_emergency_response_... [2] https://cert.europa.eu/cert/newsletter/en/latest_Securi…

>[2] https://cert.europa.eu/cert/newsletter/en/latest_SecurityBul ... I took a look and my first impressions are not good. 1. like you mentioned, the signal to noise ratio is pretty bad. eg. "OpenSSL/LibreSSL Vulnerability (CERT-EU Security Advisory 2022-017)" which is a DoS exploit that consumers would likely not care about. There's also no vendor/product filter, so I get notifications about "H2 Database Console" th…

Yes, it's a firehose. I'm sure you can find a security vendor willing to offer a curated list somewhere.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#73

Post by nathants »

securing a machine that is updated regularly and runs untrusted code is not realistic, monitoring network exfil is.

an exploit that cannot communicate is likely benign and easy to detect in the attempt.

monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security.

macos has littlesnitch[1], linux has opensnitch[2], or roll your own on libnetfilterqueue[3].

bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering.

bonus points if the filtering is at executable level granularity instead of system level.

1. https://www.obdev.at/products/littlesnitch/index.html

2. https://github.com/evilsocket/opensnitch

3. https://github.com/nathants/tinysnitch

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#76

Post by josephg »

svenfaw wrote: post #22
_Nat_ wrote: post #2

> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 1…

For Windows, IE11/Trident. This may sound ridiculous, but if you think about it, it's still maintained security-wise (and will be forever, as per MS), and since its codebase has been frozen a few years ago, its attack surface can only shrink with time. So if you're OK with the limited compatibility, it might be worth considering.

It depends on what "Javascript engine" means, and what sort of javascript you want to execute.

If you want something that can run ES5 code, this might be your ticket. But if you want something that can run "modern javascript" (where the meaning of "modern" changes over time), then IE11/Trident won't help. It doesn't even support ES6, which came out in 2015. Modern websites often depend on javascript language features newer than that. Npm packages are the same.

[1] https://kangax.github.io/compat-table/es6/

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#77

Post by lern_too_spel »

metadat wrote: post #72
tommiegannert wrote: post #11

Looks like 99.0.4844.84 is the release we want. https://chromereleases.googleblog.com/2022/03/stable-channel...

It's definitely not yet out for Android. On my device the version is stuck at: 99.0.4844.73

I have 99.0.4844.88, updated yesterday. The release notes for Android don't mention the CVE. https://chromereleases.googleblog.com/2022/03/stable-channel...

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#78

Post by relaunched »

_Nat_ wrote: post #48
meibo wrote: post #43

Earlier quoted context omitted.

What you're asking for will probably put you more at risk than V8 does: 1) JavaScript engines with any kind of usable performance are inherently complex 2) V8 is hardened, battle-tested and fuzzed/verified by the best engineers at Google and indepentently by third party researchers, since inception - the engine you will be using probably won't be All of this is really a side-effect of Chrome's popularity and Google's…

I'd prefer a [provably secure]( https://en.wikipedia.org/wiki/Provable_security ) JavaScript-engine as a default. Or, if provable-security would be a bit much for a near-term project, something more heavily based in a simple engine-design, without trying to optimize stuff and perhaps including seemingly-redundant run-time checks. Ya know, stuff like type-checking arguments, using stronger restrictions on async-calls…

I've been in the security field a while, what exactly do you mean by provably secure?

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#79

Post by ______-_-______ »

zamadatix wrote: post #39
gruez wrote: post #19

Earlier quoted context omitted.

>Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? You can disable JIT in firefox[1], which makes it fall back to an interpreter. That should theoretically make it safer as there are less optimizations going on and less generated code being directly executed by the CPU. [1] https://github.com/arkenfox/u…

You can disable jit in Chromium browsers via flag as well. Chromium Edge has this exposed in the UI as "Super Duper Secure Mode". I'm not sure if there is a way to do this on Safari.

I found this comparison of JIT vs non-JIT. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...

If you take those charts at face value, they're pretty incredible. The JIT ends up worse than the interpreter for most (real-world non-synthetic) use cases for power usage, memory usage, and startup time. Page load time is a wash. And this is after Google has poured $billions into optimizing V8.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#80

Post by metadat »

lern_too_spel wrote: post #77
metadat wrote: post #72

Earlier quoted context omitted.

It's definitely not yet out for Android. On my device the version is stuck at: 99.0.4844.73

I have 99.0.4844.88, updated yesterday. The release notes for Android don't mention the CVE. https://chromereleases.googleblog.com/2022/03/stable-channel...

I just checked the play store and there was indeed a pending update for chrome. Now at .88.

Until the next C++VE, cheers!

Post reply on HN