Hacker News Reader

Comment by dgan | Hacker News Reader

Well on one hand, VBA is a full blown programming language, so I would expect to be able to do that... On the other hand, I am lucky JS running in browser doesn't have access to my drivers

View on HN

Exploiting browsers to gain access to userspace is fairly common in stuff like console jailbreaking.

And at that point you can proceed with the same kinds of kernel/driver exploits.

Well... you can flash and update the firmware of a mobile connected via USB through a browser... so, not sure how accurate this is!

To be fair, you're supposed to get a permission dialog and it seems you have to pick the specific device(s) to connect to them.

https://web.dev/usb/#get-access-to-usb-devices

However I suppose that the mere existence of this API means that there could be a way to bypass the request; The browser already does have full access to every device.

Sweet jesus that's easy. Wonder if stuff like Samsung ODIN (which already has a OSS clone) could be ported to that.

Has been done with https://github.com/kdrag0n/fastboot.js, might be feasible with Odin as well..

I believe the device also needs to be WebUSB compatible, unless that part of the design changed - it's a measure to reduce the attack surface by not letting webpages talk to old pre-WebUSB hardware that might have vulnerabilities.

If I'be read it correctly it _can_ announce itself over WebUSB. And I suppose this announcement contains a landing URL, which Chrome will then show upon plug-in of the device. So device-side WebUSB capability seems like a feature, rather than a requirement for browser-side communication.

It’s certainly not a requirement for the device to support WebUSB. NetMD recorders were created long before WebUSB, but can still be used from a browser app.

Definitely possible, especially with native-to-WASM tooling.

I've used a web page to run ADB commands to quickly debloat my phone, so I don't see why fastboot support wouldn't work.

There's even a tool to flash your Android phone through the browser (https://pixelrepair.withgoogle.com/ I believe). Adding "automated LineageOS installer through WebUSB" to my infinitely growing to-do list :)

That sounds great, I hope you pursue it.

Do you know of any specific risks when flashing devices w/ WebUSB as opposed to the 'normal' way?

With Google's devices I think and hope that the code accounts both on the web side and the device firmware side for interrupted communications or latency due to whatever external factors (e.g. another page that is running in the same execution context sending the single JS thread into a loop or lock).

With non-Google devices... these might run into problems when the device expects a certain response latency or minimum bandwidth. YMMV I'd say.

Web MiniDisc folks ported the reverse-engineered the NetMD protocol tools to JS, and can now upload audio and patch device firmware on any MD device connected via Chrome/Chromium. Porting Odin is likely to be feasible.

It does have access to devices via those misfeatures called WebUSB and WebBluetooth. Yes, they do require a permission prompt at least.

It is most certainly possible to escape browser sandbox and inject to a vulnerable driver through JS.

Reply on news.ycombinator.com