Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VirtualBox E1000 Guest-to-Host Escape

github.com

Post reply on HN
Print view View original

81–90 of 118 posts

Re: VirtualBox E1000 Guest-to-Host Escape

#81

Post by Piskvorrr »

matt4077 wrote: post #71
metildaa wrote: post #34

Earlier quoted context omitted.

Not at the cost of leaving end users vulnerable and in the dark, vendors can deal with the consequences of their choices. Hard lessons are needed, having attempted to disclose serious vulnerabilities in T-Mobile USA's APIs by reaching out repeatedly, most vendors will not patch in an urgent manner, and some (like T-Mobile) are content to leak customer info indefinitely. It is a culture problem, and it will take (fina…

So... It's okay to harm third parties, i. e. VirtualBox users, not just as an unfortunate but unavoidable side effect, but as your means to punish the vendor for their (neglient? wilful? morally depraved?) failure to follow the idealised processes you envision, and for not honouring your genius with whatever your ego believes it is owed?

The harm is already there, you're just shooting the messenger.

Re: VirtualBox E1000 Guest-to-Host Escape

#82

Post by dexen »

cantrevealname wrote: post #43

I think the author brings up a good point about so-called "responsible disclosure" (a self-serving term by the vendors). I'm paraphrasing his 3 reasons for disclosing immediately: 1. It's unacceptable to wait half a year until a vulnerability is patched. 2. Bug bounties are riddled with tricks to delay you, shenanigans as to whether they'll pay you or not, and games to low ball the price. 3. It's arrogant to wait mon…

While you raise very good points overall, this one I have beef with:

>SSDs that encrypt the drive with a key that doesn't depend on the password

AFAIK, this is the standard practice in software harddrive/filesystem encryption - LUKS, TrueCrypt, etc., for practical reasons, and with no negative impact on security if properly implemented. AFAIK again, this is also how Firefox handles encryption of stored website login/password credentials - they are always encrypted using locally generated & held key; in case user supplies her own password, this key is encrypted with that password, with no change to the actual login/password store.

Contrast the following two scenarios:

- derive encryption key from user-supplied password [potentially weak key]

- encrypt the whole device / filesystem with the key [very long process, prone to interruption]

- user wishes to change the password

- re-encrypt the whole device / filesystem with the new key [very long process, prone to interruption]

vs.

- generate a cryptographically secure random or pseudorandom key

- store the password in device

- encrypt device with the key from the first write onward

- when user sets password, encrypt the stored key [no change to content of device necessary]

- from that point the user password is necessary to use the decryption/encryption key

- when the user changes password, re-encrypt the stored key only [no change to content of device necessary]

The second scenario is also more amenable to implementing various multi-password schemes, password-recovery techniques, and encryption secured with both passwords and hardware tokens.

Re: VirtualBox E1000 Guest-to-Host Escape

#83

Post by j0hnml »

rplnt wrote: post #72

The number 3. oh my. It's ridiculous what people do with the bugs their found since Heartbleed. I don't remember anything like that before, but ever since every security issue needs a logo and a catchphrase for some reason.

Yeah, this is all too true, and unfortunately it gives the security industry a bad rap

Re: VirtualBox E1000 Guest-to-Host Escape

#84

Post by abmateen »

Very interesting read, I browsed the author's website and it says he is a independent security researcher and self employed, a real question, I am interesting in knowing he survives just reporting bugs, when there is no surety a bug could be found every month for a living....

Re: VirtualBox E1000 Guest-to-Host Escape

#85

Post by TazeTSchnitzel »

rplnt wrote: post #72

The number 3. oh my. It's ridiculous what people do with the bugs their found since Heartbleed. I don't remember anything like that before, but ever since every security issue needs a logo and a catchphrase for some reason.

It makes vulnerabilities easier to remember and talk about. Is that bad?

Re: VirtualBox E1000 Guest-to-Host Escape

#86

Post by niklasb »

To give a bit of context to this discussion: Oracle does not and has never had a bug bounty program. Honestly Oracle does not even play a big role in this. From my experience with reporting VirtualBox bugs to them, they usually handle them rather professionally.

The author must be referring to third-party, vendor-agnostic programs such as the Zero Day Initiative (ZDI), SecuriTeam Secure Disclosure (SSD), or the Accenture iDefense VCP (unless he was planning to sell to a non-disclosing entity). Keep in mind that the main purpose of these programs is PR (in the case of SSD) or a specific part of a security product (TippingPoint). I am not surprised that the value of a vulnerability in these scenario varies heavily over time. For example, if your purpose is to write a blog post and highlight your security research, maybe it's not as interesting if you have written another post about the same software recently.

The real question is, what is a business model by which a third party can make money off of vulnerabilities despite reporting to the vendor. This is a tough problem to solve. Maybe it's time to have the users of software contribute financially in some way?

Re: VirtualBox E1000 Guest-to-Host Escape

#87

Post by niklasb »

metafunctor wrote: post #50

This [1] gives a little more background. The same security researcher found another vulnerability in VirtualBox earlier this year, and didn't have a great experience with Oracle: “We reported this vulnerability to Oracle, the latest update from them is that they are still looking into it, while in fact the latest version of Oracle VirtualBox version 5.2.18 has silently introduced a patch without giving credit or ment…

By that time that researcher had already been paid by the company running the SecuriTeam program. Admittedly Oracle did release the patch too early, but this was clearly by accident, since they usually never release security patches outside a Critical Patch Update. Also I believe they did assign CVE-2018-3294 and give credit in the following October CPU.

Re: VirtualBox E1000 Guest-to-Host Escape

#88

Post by amdavidson »

dexen wrote: post #82
cantrevealname wrote: post #43

I think the author brings up a good point about so-called "responsible disclosure" (a self-serving term by the vendors). I'm paraphrasing his 3 reasons for disclosing immediately: 1. It's unacceptable to wait half a year until a vulnerability is patched. 2. Bug bounties are riddled with tricks to delay you, shenanigans as to whether they'll pay you or not, and games to low ball the price. 3. It's arrogant to wait mon…

While you raise very good points overall, this one I have beef with: >SSDs that encrypt the drive with a key that doesn't depend on the password AFAIK, this is the standard practice in software harddrive/filesystem encryption - LUKS, TrueCrypt, etc., for practical reasons, and with no negative impact on security if properly implemented. AFAIK again, this is also how Firefox handles encryption of stored website login/…

The difference is that the key was not encrypted with the password.

If the key were properly encrypted (as you describe) the password check could not have been bypassed.

Re: VirtualBox E1000 Guest-to-Host Escape

#89

Post by Spooky23 »

cantrevealname wrote: post #43

I think the author brings up a good point about so-called "responsible disclosure" (a self-serving term by the vendors). I'm paraphrasing his 3 reasons for disclosing immediately: 1. It's unacceptable to wait half a year until a vulnerability is patched. 2. Bug bounties are riddled with tricks to delay you, shenanigans as to whether they'll pay you or not, and games to low ball the price. 3. It's arrogant to wait mon…

I agree, except for the notion of security “research” being a significant market factor.

The marketplace gives very few shits about security vulnerabilities, despite the constant stream of outrageous defects. The real market force is selling consulting and security gizmos imo. Nobody is ditching peoplesoft because it’s a a security disaster — they double down and buy accessories to secure it.

Big companies like Microsoft got security religion when the prospect of liability started becoming real, particularly when Blaster/Welchia paralyzed big networks in the 2000s.

Re: VirtualBox E1000 Guest-to-Host Escape

#90

Post by ikeboy »

oarsinsync wrote: post #80
SOLAR_FIELDS wrote: post #53

Earlier quoted context omitted.

Does Oracle have a track record of being The Worst about this or should I have assumed as such given my preconceived notions of them being the classic villain in the tech world?

From GP's link: > While the crashing bug was reported to the VirtualBox tracker ( https://www.virtualbox.org/ticket/16444 ), it was never considered a security vulnerability, and is not marked as one. This ticket is 15 months old at the time of writing this post and still marked as unresolved. They might not be The Worst, but at 15 months, they're not great.

The text of the bug doesn't have any suggestion of it being a vulnerability and as the closing comment indicates, not enough information to reproduce
Post reply on HN