That's a neat vulnerability chain and a great writeup. Appreciated the breakdown of the vulnerable code as well! I'm always impressed by the simplicity of tricks like "Press F12 to try again", this is just so naughty :)
[deleted]
Escaping the Chrome Sandbox Through DevTools
71–80 of 85 posts
Re: Escaping the Chrome Sandbox Through DevTools
#72Earlier quoted context omitted.
"what percentage of grandmas would lose their life savings if they stumble across this bug" is the metric I use to determine severity. And in this case, it requires a chain of unlikely events. The user tricked into installing an extension (probably not one from the store, which is now particularly hard on windows). The user tricked into opening devtools. It's gonna be sub-1%. Certainly still worth fixing, but nowhere…
Not only that, but it doesn't work on Google Chrome releases, only the (upstream) Chromium, and Google Chrome canary. Very few people use raw Chromium all by its lonesome and I would guess only for testing/development, not downloading random extensions.
I use Chromium, because I'm on Ubuntu. (Admittedly, I don't use it very often. I tend to be loyal to Firefox most of the time.)
Re: Escaping the Chrome Sandbox Through DevTools
#73Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
Chrome needs to be rewritten in Rust asap
Did you even read the post?
Re: Escaping the Chrome Sandbox Through DevTools
#74Earlier quoted context omitted.
I've made lots of money with bug bounties over the years and mostly stopped this year in favor of private consulting. Companies will try anything to get out of paying, even through the major platforms. I once found a bug where I could access all of the names, addresses, emails, and phone numbers of all users for this new contest this company was running. I even found public announcements on Twitter. They told me this…
If they make excuses, sit on it, or dont pay out, release those bugs into the public domain, thats how this system works!
While I would love to do that, I still enjoy making a living in security.
Re: Escaping the Chrome Sandbox Through DevTools
#75Oof. Too late in my night to dive into the guts of what's broken in WebUI validation, but good on this person for persisting and figuring it out. It's pretty standard to question and distrust toolchains in the things we deploy, but at the same time we put way too much trust in magically convenient dev tools from large companies like Google or MS. Mostly because we want to get on with writing and testing our own code,…
[deleted]
Re: Escaping the Chrome Sandbox Through DevTools
#76That's a neat vulnerability chain and a great writeup. Appreciated the breakdown of the vulnerable code as well! I'm always impressed by the simplicity of tricks like "Press F12 to try again", this is just so naughty :)
I live in Missouri; I pressed F12 once and the governor tried to get me arrested.
For those not in the know:
https://techcrunch.com/2021/10/15/f12-isnt-hacking-missouri-...
Re: Escaping the Chrome Sandbox Through DevTools
#77Is it bad for Chrome to have vulnerabilities? I think long-term is really good. People need to get away from the browser monopoly (because it really is only Chrome here holding the power) and support the ecosystem
> Is it bad for Chrome to have vulnerabilities? Yes, obviously it is. Is it bad for others/the public? Probably, but not as bad as it is for Chrome. > because it really is only Chrome here holding the power I'm not sure this is true. Apple pretty much forces usage of their browser engine on iOS, and heavily try to get people to use Safari on macOS. Windows push Edge pretty hard on their OS, and their browser engine i…
> and heavily try to get people to use Safari on macOS
how so? on any new macOS install, I use Safari to download Firefox. After that, I never think about Safari until I'm trying to use its DevTools to look at iDevices. I never get a nag screen about Safari. I have never had default browser changed after any updates.
so where exactly is this heavy handed attempt at forcing Safari down anyone's throat?
Re: Escaping the Chrome Sandbox Through DevTools
#78Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
Chrome needs to be rewritten in Rust asap
This had nothing to do with Chrome, but rather Chromium.
>Considering that I'm using plain Chromium and not the branded Google Chrome, the channel will always be Channel::UNKNOWN. This also means that, unfortunately, the bug will not work on stable builds of Google Chrome since the release channel is set to the proper value there.
Re: Escaping the Chrome Sandbox Through DevTools
#79Earlier quoted context omitted.
> sell these on the black market. How? I always see this mentioned but it seem impractical to me. I've discovered bugs which have paid out a few thousand dollars - big corporates have well publicised schemes, but I've no idea how I would go about selling it to a criminal. Even if I did know where to find them - how would I trust them? Can I tell they're not really the police doing a sting? If they paid me, how would…
> How? Huh... First result in google for "selling exploits" shows it's not only criminals who are buying exploits: https://zerodium.com/program.html (up to $500K for Chrome RCE, but probably not for this since requires extension install) Another result is the Wikipedia article, which also talks about these gray markets: "Gray markets buyers include clients from the private sector, governments and brokers who resell v…
Zerodium sells to government intelligence agencies, so I guess it depends on your definition of “criminals.”
Re: Escaping the Chrome Sandbox Through DevTools
#80Reminds me of when I used this same API to debug Chrome OS's "crosh" shell and escape OS protections, also obtaining root access on developer devices. (CVE-2014-3172)
The author of this post had to bypass much more challenging obstacles. This is great work!