Hacker News Reader

Comment by oefrha | Hacker News Reader

Related, the two other $200k entries from Pwn2Own 2021:[1]

- DEVCORE targeting Microsoft Exchange in the Server category (The DEVCORE team combined an authentication bypass and a local privilege escalation to complete take over the Exchange server.)

- The researcher who goes by OV targeting Microsoft Teams in the Enterprise Communications category (OV combined a pair of bugs to demonstrate code execution on Microsoft Teams.)

It would be kind of funny if Slack had one too...

[1] https://www.zerodayinitiative.com/blog/2021/4/2/pwn2own-2021...

View on HN

I wonder if the OS world will move towards lightweight but unforgiving sandboxing like OpenBSD's `pledge` and `unveil` system calls. It's crazy to me that most software is still completely fine to run around and set things as fire the instant it's compromised!

This is about the implementation in the SerenityOS but it's my favourite explanation so far: https://awesomekling.github.io/pledge-and-unveil-in-Serenity...

iOS, Android and ChromeOS are already there. But for exploits targeting Exchange or Teams it's far from a perfect solution because valuable private information is in the app being compromised.

Most desktop OSes came about (or at least have their roots in) a pre-internet world, where you install software from discs you purchased at the store, or if you're feeling gutsy, from media your friend hands you in real-life. They assume you have a great amount of trust in every piece of code you run on your computer (and anyway, how will malware exfiltrate your data without an always-on network connection?).

Things like Windows Defender and Snap and the recent macOS hardening efforts are patchwork solutions to try and cope with the modern world, but they'll never really be enough because these systems can't be fundamentally re-thought; they have to keep doing everything everybody already expects them to do. Only brand new OSes really get the chance to do things right, and only the mobile ones really had the opportunity to gain wide adoption.

I don't see how the large majority of security problems could be solved by any OS design. Human failures would just account for 95% of breaches instead of the current 85% (made up numbers). Not saying the OS improvements aren't useful nevertheless..

Good design can dramatically reduce, if not eliminate, most human vulnerabilities.

For example, phishing sites would be radically less effective if passwords are not a thing, and everyone logged in using hardware keys (e.g. Yubikeys) which cryptographically prevent phishing.

See Qubes. Your compromised app can’t do much without a Xen hypervisor zero-day.

> Your compromised app can’t do much without a Xen hypervisor zero-day.

Of which there have been plenty.

Attack surface is much lower. Qubes is a massive improvement over a monolithic OS.

Just last week we were talking about a zero-click bug in Apple Mail (https://mikko-kenttala.medium.com/zero-click-vulnerability-i...) that didn't even need to bypass Apple's built-in sandboxing—simply overwriting Mail.app's config files was enough to trigger a devastating information disclosure.

Doesn't the equivalent already exist in Linux? BPF seccomp filters have been around since ~2012 (https://lwn.net/Articles/656307). There's also SELinux and friends (ie Linux Security Modules).

Pledge was created as a response to low `seccomp` (Linux) and `capsicum` (FreeBSD) usage in the wild. Pledge trades off granularity for ease-of-use, and has seen quite a bit of adoption despite OpenBSD being a small ecosystem.

As a Linux-based programmer who hasn't quite delved into the UNIX internals world, knowing that I have to write my own BPF filter or do some crazy stuff with file descriptors (in the case of capsicum) is enough to scare me. But on OpenBSD, I added `pledge` and `unveil` calls to all my silly Python chat bots in 15 mintes

Yeah the idea of wrangling raw BPF is a bit daunting. Just FYI, libseccomp (https://github.com/seccomp/libseccomp) exists to abstract away all the BPF stuff. It even comes prepackaged by the major distros (ex https://packages.debian.org/sid/libseccomp2) so you don't even have to compile it yourself.

Reply on news.ycombinator.com