Slashdot Mirror
Microsoft's Edge Was Most Hacked Browser At Pwn2Own 2017, While Chrome Remained Unhackable (tomshardware.com)
At the Pwn2Own 2017 hacking event, Microsoft's Edge browser proved itself to be the least secure browser at the event, after it was hacked no less than five times. Google's Chrome browser, on the other hand, remained unhackable during the contest. Tom's Hardware reports: On the first day, Team Ether (Tencent Security) was the first to hack Edge through an arbitrary write in the Chakra JavaScript engine. The team also used a logic bug in the sandbox to escape that, as well. The team got an $80,000 prize for this exploit. On the second day, the Edge browser was attacked fast and furious by multiple teams. However, one was disqualified for using a vulnerability that was disclosed the previous day. (The teams at Pwn2Own are supposed to only use zero-day vulnerabilities that are unknown to the vendor. Two other teams withdrew their entries against Edge. However, Team Lance (Tencent Security) successfully exploited Microsoft's browser using a use-after-free (UAF) vulnerability in Chakra, and then another UAF bug in the Windows kernel to elevate system privileges. The exploit got the team $55,000. Team Sniper (Tencent Security) also exploited Edge and the Windows kernel using similar techniques, which gained this team the same amount of money, as well. The most impressive exploit by far, and also a first for Pwn2Own, was a virtual machine escape through an Edge flaw by a security team from "360 Security." The team leveraged a heap overflow bug in Edge, a type confusion in the Windows kernel, and an uninitialized buffer in VMware Workstation for a complete virtual machine escape. The team hacked its way in via the Edge browser, through the guest Windows OS, through the VM, all the way to the host operating system. This impressive chained-exploit gained the 360 Security team $105,000. The fifth exploit against Edge was done by Richard Zhu, who used two UAF bugs--one in Edge and one in a Windows kernel buffer overflow--to complete the hack. The attack gained Zhu $55,000. At last year's Pwn2Own 2016, Edge proved to be more secure than Internet Explorer and Safari, but it still ended up getting hacked twice. Chrome was only partially hacked once, notes Tom's Hardware.
are an oxymoron.
Or are going to tell me those Windows 10 pop-ups are lying? Hmmm?
It gives your laptop better battery life!
Why are you running Chrome without an adblocker? I really don't understand people. Use an adblocker, always. Use Ghostery if you are worried about tracking.
...it's hideous how it tracks you.
I don't have anywhere close to this unnerving tracking with Safari or Firefox.
You're running a browser created by the same organization who has essentially indexed our digital universe, and turned that into a multi-billion dollar empire.
At this point, shareholders practically demand perpetuating "hideous" activity.
The irony here is Chrome users feel more secure than ever.
What else is there to say?
Mimetics Inc. Twitter
Does anyone have the results for Ff? Was it included?
Secure for their ads, not the users.
Domestic spying is now "Benign Information Gathering"
Yes, how dare they test things in the default configuration that only 99% of users will be using.
Google's Chrome browser, on the other hand, remained unhackable during the contest.
Unfortunately for me, I can't accept Chrome's EULA.
It incorporates Adobe's, which (if I recall correctly from my AT&T Android-based smartphone) has several clauses I can't abide - including a never-compete, don't block updates, don't work on circumvention tools, we can change the license without notice, ...
I don't intend to do anything that might come back to limit my future software work or employability. Clicking through such a license (even if every bit of it is struck down by the courts - which I'm not holding my breath expecting), especially on a device that "phones home" in a way that is easily identified with my true name, is an invitation for an all-versus-one gladiatorial match with two multibillion-dollar corporations' legal departments.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Interesting how well-known issues such as use-after-free, heap overflow, type confusion, and uninitialized memory are still common attack vectors.
Seems to support the arguments for efficient, type-safe languages such as Rust.
Russia learned a lot on how the CIA got the text to Khrushchev's "On the Cult of Personality and Its Consequences" speech https://en.wikipedia.org/wiki/....
Russian staff work on paper files in secure building now.
Stay in restricted city, town. No way MI6/CIA can get in to offer cash for file.
In West policy created by party political think tank on web browser connected to internet.
Many other nations read along in real time as policy correction made and then final document is prepared.
Domestic spying is now "Benign Information Gathering"
And the bulk of comments will be that Microsoft is so wonderful, in spite of the mega-awful flaws.... we love it! Right?
Is it just me, or was every single winner in pwn2own asian? Here's the youtube video: https://www.youtube.com/watch?...
It's not entirely clear what Asian country everyone is from (or perhaps they're Asian-American), but assuming none of them are from the U.S., it should make those in government U.S. cybersecurity a bit anxious, and perhaps give pause to our new-found love of immigration restrictions.
Fast Federal Court and I.T.C. updates
Mozilla's thoughts on replacing c/c++ with rust...
Or just use Opera, which is basically Chrome Stable (none of the bullshit blind A/B testing Google does on their "stable" branch that breaks shit), has built in ad blocker, and built in VPN. The best of all worlds!
Chrome might have remained unhackable.
Or quite possibly people can get more money for their Chrome exploits elsewhere, so they naturally don't want to submit - and then lose - good exploits here in this competition.
You are in a twisty maze of processor lines, all alike.
There is a lot of hype here.
That something from Microsoft is an insecure PoS is not news - it is business as usual. Consider yourself middle-fingered, Microsoft.
Your web experience must be thrilling, kind of like surfing the web in 1995. Christ, just use gopher to get the full glory of the 1990s Internet experience.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Class action over the "Edge is the most secure browser" popups in Win 10?
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
You mean like the perspective they cast by popping up an "Edge is the most secure browser" message every time you click a Chrome or Firefox icon in Win 10?
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
The teams didn't just decide that morning "hey let's compete in Pwn2Own today". They prepared months in advance, testing all the browsers to see what they could do. Perhaps a month or two before the event, they decided which browser they had the best exploits for, the browser they would focus on during the actual competition.
All the teams but one learned from their testing that they wouldn't be able to hack Chrome. One team thought it was their best chance and that team failed.
Edge isn't open source, it has no developer community, no user community like Firefox who will mercilessly bash it until it goes the right direction, no incentive to be secure.
You can steal millions from Google with a basic, unpublished cookie hack as they are the largest advertising company on planet. So, they are damn careful about their code. Chromium which eventually ends up to be Chrome has its own community. Additionally, there is a huge privacy fanatic user community, developer community in Mozilla.
Edge is a browser which comes with the OS, nothing else.
Use Ghostery if you are worried about tracking.
And don't forget to disable ghostery's tracking.
You mean like the perspective they cast by popping up an "Edge is the most secure browser" message every time you click a Chrome or Firefox icon in Win 10?
That doesn't happen though, but cool of you to say it does
Admit nothing. Deny Everything. Make Counter-accusations.
built in VPN
You mean built in connection to it's chinese overlords?
Do you have any evidence that Chrome tracks you if you disable the safe browsing and navigation assistance stuff?
I always ask the same question and never get any evidence. All I want is some proof that if you tell Chrome not to track you, it does anyway.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Oh, you've never seen it? I may have paraphrased, because the message is slightly different depending on which browser you're launching, but, well, it happens. In fact, it was reported here back in November.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
$105K for 3 zero days for the VMWare escape sounds hideously low. I bet those guys could get 10x that amount 'somewhere else'.
There's no reason to run a browser without AdBlock and ScriptSafe. That would be my minimum.
Well, that brings up an obvious question. If Edge is a whole new browser - built, presumably, using the latest, 'safest' coding techniques - what does that say about the ability to make programming languages (or 'standard' techniques for coding in them) safe. After all this time, new code is still more hackable than older - but better tested - code?
Posted from my Android phone. Oh, I can change this? There, that's better...
If you install a completely not blocked at all malware add on to Chrome as an extension, it will not only remain unblocked because Google doesn't give a shit but it will also automatically propogate itself or at least its settings to all your other devices that run Chrome. Isn't that convenient!
Given their interest in security and privacy, I'd say this is a significant fact.
Putting trust in corporations is stupid and trusting an advertising company (whose core business model is tracking people and building dossiers on them) to not track you is equally stupid. I don't have any evidence that they're tracking you, but you don't have any evidence that they're not and tracking you would fit their MO perfectly.
Do what you want -- nobody cares -- but there's nothing unreasonable about distrusting Google, even in the absence of hard evidence.
If you want a vision of the future, imagine a youtube comments section scrolling - forever.
I prefer to take the capitalist point of view. Chrome exploits are more profitable when sold to criminals (state aligned or free market ones).
I saw a fully patched, up-to-date machine get rooted via Chrome from a malicious website not two months ago.
Run it in a sandbox.
Run all browsers in a sandbox, even if they say they already have one built in.
I have Win10 pro on my laptop, I've never seen a pop up from M$. I only used Edge long enough to install Chrome. My laptop is an older Lenovo R61 that never just sipped electrons anyway. Other than Chrome I haven't done any mods or disabled any services.
You could have read the rest of the thread before posting and found an example of exactly what I'm talking about, including a screenshot and a link to where it was reported here in November. That would have been a good alternative to making yourself look like a MS shill by claiming that, since it doesn't happen to you, it must not happen at all.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.