Hacker News Reader

Comment by rasz | Hacker News Reader

my patch:

    delete WebAssembly

injected with uBlock into every browser context before page loads.

View on HN

For Chrome you can also run:

chrome --js-flags=--noexpose_wasm

More info for other browsers and platforms:

https://github.com/stevespringett/disable-webassembly

Considering that JS is JIT'd (and V8 has had JS based RCEs in the past), is there any reason to believe webasm is a significant security hole?

This particular 0-day exploit goes thru webassembly. Other things I disable just in case is for example

    window.AudioContext = undefined

saved me from 2 previous Chrome RCEs.

Supposedly half of wasm deployments recently were malware like secret crypto miners.

https://www.infoq.com/news/2019/10/WebAssembly-wasm-maliciou...

It's probably tolerable to turn it off for now unless you know you need it.

WebAssembly (and asm.js) add additional attack surface to V8, and multiple attacks (including this one) are not possible without that

The actual bug is in the Turbofan JIT, not WASM.

Using WASM is the method de'jour for turning arbitrary read/write/object leak into RCE. Without WASM, the writer would have to use ROP/etc, but the primitives are still there.

Check out this discussion by a bunch of the big names in the field, including Niklas B who was on the team that originally found this bug: https://twitter.com/spoofyroot/status/1379911787282243584

How do you have uBlock do this?

Check "I am an advanced user (required reading)", enter advanced-settings.html, last line is where you define your own uBlock scriptlets. Then in My Filters define

    *##+js(myscript)

this will inject into every(1) executable context of every page. You still need to hotpatch workers/sharedworkers/webworkers(I disable the last one entirely).

This way you get some of the control over Chrome browser back. Not so fun fact - Google is very against users having the ability to execute arbitrary user defined code, afair Gorhill had a problem with google concerning injectable scriptlets.

(1) of course there are issues, you cant inject into <iframe src="data: https://github.com/whatwg/html/issues/1753 in Chrome :( so you would have to manipulate CSP to disable those.

I have uBlock disable all javascript and make permanent and temporary exceptions when I need to. It's really made browsing the web cumbersome. The more I'm aware of new 0-days the more I appreciate the tar I've laid before myself.

Thanks for the info about 'delete WebAssembly'

The irony here is that uBlock itself uses WebAssembly.

What's the slowdown like on this? Any stuttering?

ublock is already executing in context of every loaded page, this is just one more line of js. The only website I use that could benefit from webassembly is twitch, but thankfully they detect webassembly capability and their fallback js webworker is working just fine.

Reply on news.ycombinator.com