Hacker News Reader

Comment by choeger | Hacker News Reader

I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been prevented by using Firefox, (because it relied on a Chrome CVE). It also did not work on Linux and presumably not on Apple's ARM CPUs.

But unfortunately we don't get exponential security. Normally, one would expect that n variables (Browser, OS, CPU architecture) with three choices each should give you 3^n required exploits to cover all combinations.

But unfortunately, n is rather small nowadays, the number of choices shrinks every year, and -even more worrying- the attack vectors compose extremely well so you actually just need 3n exploits.

So I am a little bit at a loss here how we can make such attacks non-economical again.

View on HN

But these are attacks that worked across multiple systems. Heterogeneity is going to lead to more systems with less overall security work being done per system. Sure, using Firefox would have prevented the attacks we know about, but who's to say Google found all of the attacks. They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them."

> They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them."

Samsung's browser and Chrome share 100% of attack surface; Safari and Chrome share likely near 70%. Windows and Android have Chrome built-in at the OS layer, iOS has Safari built in at the OS layer.

In this case, something like Firefox which shares much less attack surface would in fact solve the problem, because the problem is that other things have Chrome at the OS-level.

>Windows and Android have Chrome built-in at the OS layer

How is Chrome built into Windows at the OS layer? Wouldn't that be IE or Edge?

Edge is now Chromium based and soon Edge-Chromium webviews will ship with the OS. The old IE/Edge webviews will remain for legacy but they'll eventually get stripped.

> Edge

I think that's OP's point. Edge uses chromium.

> Safari and Chrome share likely near 70%

This is wrong. I'd say it's more like 5%. Blink forked from WebKit 7 years ago and development has been very active on both sides since then. And probably the majority of the attack surface is outside Blink/WebKit proper to start with (e.g. JS engine, font libraries, media decoding, networking, etc).

The JS engine is part of Blink and WebKit, but yes, they are essentially entirely different.

I don't know about JSC, but V8 is very much a standalone project. I guess you could define it as just part of Blink but I don't think that's a very useful definition.

Diversity is a sign of health in an ecosystem. But, increasing diversity directly isn't really viable. Question is, why is diversity low?

In my opinion, Web, OSes and CPUs suffer from being overly complicated, closed-source ridden, non-modular systems-within-systems. Basicly, the opposite of what the Unix philosophy advocates.

Diversity is low because of the massive amounts of capital Google has. Both in terms of money and power.

If a Web browser were easier to implement, we would have more than ~3 well maintained engines. In other words, why should Web require massive amounts of capital?

Feature creep. Everyone wants to leave a footprint in the world. Same thing with legislation.

I agree. They are too complicated. Some more work toward making better one will be helpful.

Protocols and instruction sets etc will need to be not too complicated, in addition to being open source and fully documented.

Exactly how biodiversity protects us from diseases.

But this is reversed for a watering hole bug against an organization. They only needed to get into one stack one member of the org uses and stay. Their reason for releasing multiple chains of attack at once instead of whenever their current attack is patched is unclear unless they want to get into multiple organizations where some avoid a diversity of exploitable software.

> I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem.

How does that balance against the thread of each platform/ecosystem having its own variants of security issues?

It did not rely on a Chrome CVE, it just included a Chrome exploit.

What they found was a server that served up the correct exploit for the platform making the request, and were able to coax a bunch of iOS and Chrome exploits out of it. This doesn't mean that the attackers didn't have other browser exploits or that Firefox exploits couldn't have been dropped into the same framework.

In fact, if you start trolling around in Tor, you're likely to find a ton of Firefox exploits because Tor Browser is obviously based on Firefox.

> It also did not work on Linux and presumably not on Apple's ARM CPUs.

Hmm, anyone else find this interesting? I haven't looked into the actual exploit itself yet, but having it work on Android, which has SELinux and/or other protections by default, but not on (presumably) a generic Linux distro, is weird.

I would have assumed it exploited something present only on mobile builds of Chrome, but it affects Windows as well. Odd.

Okay, just noticed that the Windows exploits are independent, don't know how I missed that.

The Android vs Linux part still stands though.

>To counter such threats we need a healthy heterogeneous ecosystem.

And how do you get that?

>But unfortunately, n is rather small nowadays, the number of choices shrinks every year, and -even more worrying- the attack vectors compose extremely well so you actually just need 3n exploits.

Let me tell you about early-to-mid 2000s. Now that was a time of very low 'n'. Compared to then, we live in a heterogenous nirvana.

Pretty sure the iOS exploits worked on Apple CPUs.

>>how we can make such attacks non-econimical again Does it say how they monetized these attacks? Or how would you expect?

Reply on news.ycombinator.com