Slashdot Mirror
Google: Chrome Zero-Day Was Used Together With a Windows 7 Zero-Day (zdnet.com)
Google said this week that a Chrome zero-day the company patched last week was actually used together with a second one, a zero-day impacting the Microsoft Windows 7 operating system. From a report: The two zero-days were part of ongoing cyber-attacks that Clement Lecigne, a member of Google's Threat Analysis Group, discovered last week on February 27. The attackers were using a combination of a Chrome and Windows 7 zero-days to execute malicious code and take over vulnerable systems. The company revealed the true severity of these attacks in a blog post this week. Google said that Microsoft is working on a fix, but did not give out a timeline. The company's blog post comes to put more clarity into a confusing timeline of events that started last Friday, March 1, when Google released Chrome 72.0.3626.121, a new Chrome version that included one solitary security fix (CVE-2019-5786) for Chrome's FileReader --a web API that lets websites and web apps read the contents of files stored on the user's computer.
Chrome is an incredibly complex browser with a lot of moving parts. I expect more and more serious vulnerabilities. I'm a little scared that it has been opening more and more interfaces to the underlying OS. There are a lot of settings that I turn off on a regular basis now, while I used to feel that Chrome was pretty secure out-of-the-box.
Lol
dance to the tune of someone elses search engine /ad-broker suckers, remember 100000 developers student loans/ mortgages depend on it, kind of focuses the mind to who your real masters are
the twitter command and control accounts of botnets/terrorists...
Scanning for vulnerabilities is a start, but eliminating the accounts is probably a whole other kettle of fish.
If another large security hole opens up after EOL, Microsoft will just say we told you so and tell you go get Windows 10. There WILL be a large security incident a few years from now because too many people are using unsupported systems.
needlessly jargony?
Why not say what it is in plain english... a newly discovered or previously unheard of exploit or vulnerability.
And if it's not that, then it's not zero-day, by definition.
File under 'M' for 'Manic ranting'
> 0-day
vs
> a newly discovered or previously unheard of exploit or vulnerability
I'll take the former, thanks.
The problem with "0-day", is, as I said, that it sounds like jargon... like a buzzword that people overuse when they want to invoke an emotional reaction to the concept rather than using regular English words to say the same thing.
Calling it a a newly discovered exploit instead of a 0-day exploit is both more informative by virtue of being in plain English and doesn't come across as trying to push some agenda for software that detects and removes malware.
File under 'M' for 'Manic ranting'
0-day = new, known for 0 days. All words are jargon. Your replacement does not replace the functionality of the existing phrase, and is longer and more cumbersome. So by your own definition, jargon.
Keep thinking about these really big issues, Mark.
If another large security hole opens up after EOL, Microsoft will just say we told you so and tell you go get Windows 10. There WILL be a large security incident a few years from now because too many people are using unsupported systems.
I see Google has successfully managed to get some people to already forget about their own zero-day bug here. You know, the Google bug which gave attackers remote access to the Windows 7 computers in the first place.
The Windows bug was a local privilege escalation attack. It needs to be fixed, but the Google Chrome bug was the bigger issue here.
#DeleteChrome
You are both wrong.
'Zero-Day' describes that the exploit was previously unknown, and that it took zero days for it to be exploited.
Instead of "we found a bug, let's hope it gets patched before someone writes code to exploit it", zero-day describes "OMG what is this code doing!? look it's using a previously unknown bug!"
"Newly discovered" does not adequately describe the situation.
There is clearly etymological room for a different term, even if it does sound like a buzzword.
Exactly, so why bother with the jargon? "New" is plain english, 0-day is jargon. It obfuscates what is being talked about and sounds like its trying to grab headlines by using a fancy buzzword.
File under 'M' for 'Manic ranting'
Who's going to go back and update the reports to 1-day, 2-day, etc.?
It's not newly discovered if it was used in the wild and actively exploited
You're being willfully stupid. "New" is vague. 0-day says 0 days since discovery, a metric. It's also shorter than your jargon-itself replacement. It's not a buzzword, it's an industry term since whenever.
Sorry, you're not going to have much luck replacing common terms of usage in industries you know nothing about. Go redefine the milkman's job instead. "Milk, what does it mean? It's COW JUICE! What jargon!"
So, I've got a Window 10 box, that apparently Chrome can't update itself on, instead giving this message:
https://twitter.com/MrDanack/s...
Which is obviously not a good sign as blocking the security updates seems like a thing an infection would like to do.
Anyone know of how to tell if a box is actually infected or not?
"Free software as in beer, copy protection as in racket" - Telsa Gwynne
It entirely adequately describes it.... "0-day" is just jargon for "new", which by definition means it wasn't around before. It just happens mean it was discovered on the day that the developers knew about the exploit, but if the developers actually already knew about the exploit, then it isn't really new is it?
Worse, "0-day" can suggest to a person unfamiliar with the precise definition that the exploit was discovered less than one day after the relevant software had been most recently updated, which of course makes absolutely no sense when you are talking about software that hasn't been updated in years such as Windows 7.
Calling it a new exploit, or previously unknown exploit, is descriptive to anyone who knows english, and does not require familiarity with some fancy term that quite honestly just sounds like an overused buzzword.
File under 'M' for 'Manic ranting'
'Zero-Day' describes that the exploit was previously unknown, and that it took zero days for it to be exploited.
you should meet my Zero-Day son, let's remove the "newborn" thing and use the jargon instead!
Sorry, you're not going to have much luck replacing common terms of usage in industries you know nothing about. Go redefine the milkman's job instead. "Milk, what does it mean? It's COW JUICE! What jargon!"
You're being willfully stupid. It's not a buzzword, it's an industry term since whenever. YMMV, but it changes nothing in reality. The reality is, you're suggesting the circumlocutious jargon.
"New" is vague. "New" in the news cycle is 1-2 weeks to 1-2 months. 0-day is 0 days, specific. Stop. Being. Dumb.
You're not changing the lexicon, but please if you feel like continuing to beat your head against a wall for no reason, make sure you tick the 'organ donor' spot on your license application.
"New" does not denote a number of days and is thus useless and vague. 0-day is a technical term to describe a technical concept. Yes. Don't like it? Too fucking bad, it's been there forever.
Just because you can't learn words that accurately describe things and prefer "Extracted and cooked Cow Juice" to "Milk" doesn't mean anyone else is similarly as dumb or pedantic about using only basic idiot-level words to describe basic concepts as you are.
Nothing is changing no matter how hard you whine. Realize it or don't, but if you continue being a petulant retard trying to tell the world to be as dumb as you're being and getting upset that it isn't happening, you're digging a hole.
We'll simply fill it in and put your name on a rock on top. Oh wells! "Here lies some weird dumbass who didn't matter, didn't like basic words."
"and that it took zero days for it to be exploited." - this is not a fact.
Except an exploit using a bug in the wild isn't new, even if a developer was unaware of it--and it's not even given that such is true, as the bugs might actually be fixed already in the internal branch. There's also the point that it might not be "a" new exploit but a host of them, leveraging one or more bugs--implementation or design ones. Further, an exploit that exists but isn't being actively used isn't 0-day. All the above applies to "previously unknown".
Don't get me wrong: I think 0-day is a pretty terrible name. It is jargony, but that's because it tries to encompass multiple things at once: there's an exploit, it's being actively used, and it exploits a bug or feature in an unintended way. Like most things, jargon improves the communication of things in one way. The heart of the matter is not the exploit but the means of the exploit, since exploits don't magically happen but are tied to hardware/software.
I can't say it equivalent to a buzzword because buzzwords often mean little to nothing or people don't really known what it means and it's used often specifically for obfuscation. Yes, 0-day is used instead of "new" at least in part because it conveys more urgency. That's because in a lot of circumstances, where people have millions or more money invested, it is urgent and it's important to figure out which are the most urgent threats. Twenty new exploits for a patched bug aren't as threatening as one 0-day.
ohh my God, is /. overrun by morons now?
Zero-day refers to an exploit which was effectively there at day zero of coding. Basically, an inherent flaw in original code. It's "new" in the sense that someone recently found it, but it's still as old as the code base or patch that introduced it.
what is the use case to have a browser expose some API for random websites to read files on user computer? or what is this API if not that?
People keep telling me tools will help prevent this kind of shit for C(++). Google has fuzzers and memory checker tools out the ass, still these bugs get through.
If people were to use shared_ptr, vectors and std::string many of these errors could be prevented.
Find All Currency Rates here USD to PKR
Very Nice blog, please visit my website; We offer Best leather jackets for Men and Women
Find All Amazing recipes only in the No 1 Food Magazine of Pakistan, The Cook Book