New Chrome Zero-Day
According to Microsoft researchers, North Korean hackers have been using a Chrome zero-day exploit to steal cryptocurrency.
Comments
Lazaro • September 11, 2024 1:12 PM
I agree with Clive about Javascript. If one had it disabled, one wouldn’t have been affected by this bug. Unfortunately, one would also be unable to read about it in issues.chromium.org; or, at least, I’m assuming that’s why the page has nothing but a “Sign in” button (and the HTML has a lot of obfuscated Javascript).
The Microsoft link is telling me “We are currently experiencing high demand. Please wait and try again later.” Perhaps they should try hosting it on some reliable cloud service… anyway, here’s an archive.org link for that post. It links to a page about a Windows kernel sandbox-escape exploit, which says “You need to enable JavaScript to run this app” (wait, what app? I’m just trying to view a page).
Sandboxing is kind of a weak point in modern operating systems. As far as I know, most implementations have sandboxed and non-sandboxed programs using the same kernel entry points, each of which is expected to properly enforce the sandbox if necessary. Microsoft could probably fix this more readily than the Linux developers, who need to deal with internal politics and distributors. Swap the interrupt vector table for sandboxed processes, or even put the whole OS under a hypervisor and run them that way (they’ve got Hyper-V, after all, plus a well-funded research division who might enjoy making Windows run under something like seL4).
Clive Robinson • September 14, 2024 1:10 PM
@ Bruce,
I have not done private EMail for years, so don’t have anything set up.
Over the W’kend I’m looking into a way to get a message to you, that does not involve any of the idiocy and privacy invasion required by many methods these days.
Subscribe to comments on this entry
Leave a comment
← Australia Threatens to Force Companies to Break Encryption Evaluating the Effectiveness of Reward Modeling of Generative AI Systems →
Sidebar photo of Bruce Schneier by Joe MacInnis.
Clive Robinson • September 10, 2024 9:56 AM
How many times has North Korea pinched the contents of crypto coin wallets?
If it was turned into an Olympic Sport they would be “Front runners” based on what has been claimed in the past…
But Microsoft say,
An RCE via JavaScript/WebAssembly,
“Who’d have thunk?”
Well readers here should know by now that JavaScript, WebAssembly, and a big chunk of HTML5 really should not be used for various “in-security” reasons. Not least because they all allow a system to be used in ways most users would not like at all.
Several people here, have pointed this out for years if not decades in the case of JavaScript…