Slashdot Mirror
Every Browser Hacked At Pwn2own 2015, HP Pays Out $557,500 In Awards
darthcamaro writes: Every year, browser vendors patch their browsers ahead of the annual HP Pwn2own browser hacking competition in a bid to prevent exploitation. The sad truth is that it's never enough. This year, security researchers were able to exploit fully patched versions of Mozilla Firefox, Google Chrome, Microsoft Internet Explorer 11 and Apple Safari in record time. For their efforts, HP awarded researchers $557,500. Is it reasonable to expect browser makers to hold their own in an arms race against exploits? "Every year, we run the competition, the browsers get stronger, but attackers react to changes in defenses by taking different, and sometimes unexpected, approaches," Brian Gorenc manager of vulnerability research for HP Security Research said.
Is it reasonable to expect browser makers to hold their own in an arms race against exploits?
The problem is that browsers are trying to become an OS - with all the complexities associated with one.
If we want back to a world where HTML was mostly about content -- that could be displayed in everything down to things like the Lynx browser -- they coudl be made secure.
People wanted more, though -- so they decided to allow extensions like Java Applets, Flash Plugins, and ActiveX controls. Obviously more complex, those were not surprisingly insecure.
So now people decide to take all the complexity and insecurity and build it directly into the browser itself?!? WTF.
Makes me miss gopher clients. Maybe we should go back.
TL/DR: Javascript+HTML5 is the new Java applet + Flash Player + ActiveX control.
... getting their code airtight and less time constantly fucking about with GUI and javascript interpreter - sorry, "engine" - changes perhaps these exploits could become less of an issue.
To successfully exploit such a vulnerability (other than to make the browser to simply crash), and attacker needs to craft the attack to place just the right content into memory.
By building the browser yourself (with CFLAGS, CXXFLAGS and even CC and CXX set to something unusual — such as to target only your specific -march) — rather than downloading prebuilt binaries — you make the attacker's job much harder. To successfully exploit your browser, he'll now need to make a custom exploit just for you.
And, if you include -fstack-protector or equivalent among your compiler-flags, you may even be able to make such attacks impossible for good.
In Soviet Washington the swamp drains you.
Are the majority of exploits due to bugs which would be trivially detected at compile time let alone runtime in a modern language as usual?
The article doesn't provide many details on what these exploits actually were, but in case anyone else is curious like I was they appear to be published on the ZDI site:
Broad strokes for new discoveries
Details for older exploits
Curious how much NoScript would mitigate the Firefox vulnerabilities. I find the mild annoyance of having to enable scripting occasionally is well worth it.
The thing is, that was all true with even relatively early browsers, because it's the uniform access to information that was the radical improvement on what we had before.
Nothing about that necessarily means moving complex executable software to the browsers or making browsers a thin client for code running in the cloud is a similarly significant improvement. Plenty of us would argue that in many ways it has been a huge step backward, leading to dumbed-down software, security and privacy concerns, rent-seeking behaviours, inherent unreliability, and so on.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
[...] they are also trying to write secure software in unsuitable programming languages like C++.
Right. So tell me, what "suitable" language would allow the browser to parse 200-500K of minified JS code in under 0.5 second? (200K == JQuery + few JQ plug-ins, 500K - JQuery + lots of JQ plug-ins.) Anyway, browsers already do resort to optimizations in assembler, because even C++ is not fast enough for what the web has become.
So now we can't use tried and tested plug-in technologies to actually make stuff, and we all have to use HTML5+JS instead, even though in some areas they are still far inferior to what we had before with Flash or Silverlight or Java applets.
Integration with 3rd parties is a bitch. That was and remains the main reason why plug-ins suck.
Portability is another big reason. Windows, iOS and Android do things in starkly different ways, making portable plug-ins even harder.
The problem are not plug-ins per se. The problem is that Google steers development of the Web toward its own goal which is to make the OSs obsolete. The short-sighted strategy resulted in overbloated browsers, with all the consequences for the security. Worse, they keep "optimizing" the browsers instead of e.g. integrating the JQuery/etc right into the browser to avoid repeating the loading of the same every time user clicks a link.
All hope abandon ye who enter here.
IE Fell First...
But then George Lucas decided to edit it?
so, since the attackers came with prewritten exploits, that essentially means that IE got tested first. And this means what?
Shaka, When the Browsers Fell
These are "stock" browsers without security plugins or addons, correct? None too surprising really.
You mean malware like Symantec? I agree, exploiting anything on a Symantec infested machine would take much longer... but only because everything running on that system would run at about 1/17th max throughput.
I was at Pwn2own and NEVER ONCE experienced an exploit thanks to my browser of the future: Links.
now if youll excuse me i need to gloat...there are some arpanet users on gopher that are going to be mighty impressed by this.
Good people go to bed earlier.
Just ignore him and he'll go away...
Slashdot is pretty "lightweight" and yet:
The size of JS embedded on this page I'm replying from is 33K in about 890 lines of code.
Externally loaded libraries are (most minimified):
http://a.fsdn.com/sd/all-minified.js?release_20150309
http://player.ooyala.com/v3/85...
http://a.fsdn.com/sd/html5.js
http://a.fsdn.com/sd/comments-...
http://www.googleadservices.co...
Total size: 1147446 bytes, aka 1.1MB.
You are welcome.
All hope abandon ye who enter here.
Nonsense. A browser can fall before the contest even takes place, which is what happened here. Or do you think they honestly found an attack in one second? Some people just wait for the contest to exploit the browser; others try to create one on-the-fly. That doesn't speak to the quality of ANY of the software involved. For all we currently know, it took months of work to exploit Firefox/IE, and only a few hours to exploit Chrome. But sensationalizing is the order of the day with these events, because browser users like to treat their browsers as sports teams, when in reality ALL of them lost in this competition (were compromised) and ALL of them won (discovered those exploits so proper fixes could be made).
window.onbeforeunload = function(){while(1);}
Throw that on a page, close the tab, and lol.
Browsers happily execute what the page commands it to before considering what you the user commanded it to do. There are poorly-documented restrictions on things you can do during beforeunload or unload, all varying across browsers. I don't think you can alert(), you can return 'Some Shit' but it always displays a stock message ("Do you want to leave this page?"), IE will block window.open calls, etc. There's still plenty of room for you to fuck the user's experience over, however.
Eventually the browser's long-running script timer will grant you, the pitiful user, the option to fucking do what you want.