Chromium unconditionally downloads binary blob

Post by mavhc » Tue, Jun 16, 2015, 2:02 PM UTC

morganvachon wrote: post #38

dtech wrote: post #18

Earlier quoted context omitted.

Even if malice instead of incompetence is involved, it goes pretty far to call Chromium a "rootkit-downloader" just because it downloads a binary blob. It could theoretically be a rootkit, but without any evidence to support it this is like calling someone a murderer because he went to the same high school as a murderer.

> without any evidence to support it this is like calling someone a murderer because he went to the same high school as a murderer. That's a pretty flawed analogy. If you're going to examine it from a criminal act point of view, let's really look at it that way. If installing a rootkit is equivalent to premeditated murder, then the murderer must have motive, means, and opportunity. Let's take Sony as a good example o…

Post by sneak » Tue, Jun 16, 2015, 2:05 PM UTC

Flenser wrote: post #63

rmc wrote: post #52

Earlier quoted context omitted.

> If someone has MitM'd Google, it's gonna be a bad day for a lot of people. Didn't foreign government agencies already do that? (e.g. NSA?)

They spied on unencrypted data as it was transferred between data-centers. They can't decrypt or MITM anything because they don't have google's keys, and chrome using HSTS cert-pinning means that the cert is fixed and can't be faked with one for google from another top-level CA.

Post by codys » Tue, Jun 16, 2015, 2:14 PM UTC

simoncion wrote: post #30

belorn wrote: post #28

A bit surprised that there is no security CVE report attached. Debian policy is that binaries are vetted by a debian developer, sorted into Main, Contrib and Non-free, cryptographically signed and later verified by the client package system. The bug could allow arbitrary code to be installed and run without any of the above process if someone MitM the connection between the binary file and the client.

Isn't the blob downloaded from Google's servers over a HSTS and cert-pinned TLS connection?[0] If someone has MitM'd Google, it's gonna be a bad day for a lot of people. From my POV, the thing that's actually bothersome about this issue is that a closed-source blob is automatically inserted into a project that I -and others- had understood to be completely open-source. The fact that the Chromium Google Hotword code w…

Post by fla » Tue, Jun 16, 2015, 2:23 PM UTC

Post by rockdoe » Tue, Jun 16, 2015, 2:27 PM UTC

luso_brazilian wrote: post #49

roel_v wrote: post #27

Earlier quoted context omitted.

"A closed source binary being silently downloaded and executed without explicit action by the user or notification to the same is a security incident." Whereas source code being downloaded, compiled and run is not? Or a script being downloaded and run?

The source code being downloaded, compiled and run or a script being download and run would be a as much a security incident as what happened. In this context (Chromium on Debian) having a closed source binary downloaded and executed is an additional problem to the security incident and that's the reason it is mentioned in the statement. There are two problems conflated in the same sentence: 1. A binary was downloade…