taviso

The issue here is that the vendor did release patches, but then tried to hide that they fixed a vulnerability. This is usually called "silent patching", and it's controversial. As with any disclosure discussion, there are lots of opinions here and everyone likes to call everyone else irresponsible.

If you're pro-silent patching, you might argue that it reduces the number of people who know about a vulnerability, so publishing advisories is irresponsible.

If you're anti-silent patching, you might argue that it reveals the vulnerability to the people who monitor patches without giving any warning to the affected users that they need to patch, so not publishing advisories is irresponsible.

Maybe you're just a "minimum details" kind of person, and providing full details is irresponsible. Or maybe you're a "full details" kind of person, and restricting security professionals from accessing the information they need to do their jobs is irresponsible.

In summary, I'm irresponsible for leaving this comment and you're irresponsible for reading it.

Here are some examples!

https://github.com/taviso/ctypes.sh/blob/master/test/select.... https://github.com/taviso/ctypes.sh/blob/master/test/poll.sh

Yes, it is crazy :)

They should have used my (dumb?) library, ctypes.sh:

https://github.com/taviso/ctypes.sh

Then they can access libm, poll(), select() and so on from bash :)

The group selection the spammers target seems really strange, alt.comp.freeware is another example.

Not sure I understand what they're trying to achieve.

(I tried to raise the issue internally, fwiw).

I've been reading through vintage computer magazines in my spare time - this is from Unix Review, February 1986 issue. I was just struck with how this could almost be talking about GPT-4 or copilot, 40 years ago!

The technology must have seemed just around the corner...

Yes, exactly... :)

You can also create callbacks (i.e. function pointers to bash code) that you can pass to qsort() or bsearch()... or pthread_create? That last one was a joke, I mean, you probably could but I don't know what would happen - I don't think bash is reentrant :)

It's a funny trick, but you could probably also use setjmp and longjmp with ctypes.sh :-)

https://github.com/taviso/ctypes.sh

I'm not really sure, cpu and bandwidth utilization were fine. Memory usage was high, but not oom high. It continued serving over http just fine, perhaps there was some automated rate limiting by my provider.

I'll have to debug when things cool down.

I'm aware 128M is ludicrous in 2023... "a fun challenge", I thought to myself. I can be a dummy.

Yes. It was unexpected, but good. Not a complaint.

An msr is a "model specific register", a chicken bit can configure cpu features.

They don't persist across a reboot, so you can't break anything. You can undo what you just did without a reboot, just use `... & ~(1 << 9)` instead (unset the bit instead of set it).

welp, that's unfortunate indeed.

It's a single-core 128 MB VPS, which seemed fine for my boring static html articles. I guess I underestimated the interest.

123 was indeed ported to UNIX, I have that working as well! https://github.com/taviso/123elf

(Although it was more likely procalc - a popular low-end lotus clone)

I'm also working on porting dBase IV, another popular package from the era :)

A text editor and a word processor are different things. There are things you can do very easily in a word processor that are difficult in a text editor, and vice versa. I actually wrote a FAQ about this!

https://github.com/taviso/wpunix/wiki/FAQ#q-why-not-just-use

(Fwiw, I'm a daily vim user)

If you're looking for a more full-featured terminal word processor, you could take a look at wpunix! https://github.com/taviso/wpunix

I'm still a daily gmane user, thankfully you're mistaken and it's still alive and well, just nntp only (news.gmane.io)! I honestly don't know what I would do if it did die, it's such a large part of how I use the internet.

I remember watching someone insert a credit-card sized SIM into a StarTAC when I was a kid.

It blew my mind, it looked like a Star Trek communicator.

It's still useful on non-simple compilers when mixing inline assembly and c, for example `register __m128 foo asm("ymm7")`.

I realize that's a gnu extension - but it's super useful!

The attack here was that if you get tricked into giving a phishing site your password and Web USB access to your U2F key and then you press your U2F key, then the attacker can bypass the 2FA. I highly doubt this ever happened in real life, it was just a proof of concept.

In my opinion, the Chrome team overreacted and blocked all WebUSB access to any U2F/HID device.

Now if you want to update the firmware or configure your key you need to download an .exe and run it instead, which seems unfortunate to me.

If the phisher had said "Your U2F firmware is out of date, please download and run this update to continue", would that have been a vulnerability? That could also bypass 2FA (or anything else, for that matter).

Do you think you might have argued against the internet when it was being deployed?

It sure opened the door to a lot of scams, and was far from a perfect solution. Yet it does seem to have had a net positive effect. Maybe that can be true of other technologies sometimes :)

Let's leave it there, I don't think there's anything else to add.

Web USB can realistically improve security for billions of people globally. It will improve security for me and my family, and we're all humans.

Sure, it's not a magic a wand that solves all problems, or makes malware disappear. I wish it did, but the fact that it doesn't is not a good reason to reject it.

It's deployed to billions of people globally, can you show me any evidence at all that there is any Web USB social engineering happening?

I think I need to see some data to back up your claim that Web USB makes socially engineering "catastrophically worse". Web USB is deployed today for a billion users, and yet attackers still seem to prefer malware or walking victims through installing TeamViewer, correct?

We're not talking about any vulnerability here, this is social engineering. There is no amount of confirmation that can be required or warnings added that a confidence trickster cannot walk you through dismissing. The only solution is to limit what you're allowed to do with your own computer.

That's a really high price to pay.

Let's assume it's an absolute trash fire, the latest of all afterthoughts.

That's still better than "just download and run this exe as Administrator".

> But in reality a lot of devices actually already have drivers for that class in the OS

Great, then you don't need to install anything or use Web USB, it's a no-op!

Still, until we can get Microsoft to ship every driver for every device, we still need a solution that works today.

> In that case I'm now using a browser where random websites can either trick me into giving them access to my USB devices with a click,

You can already be tricked into granting complete access to your machine with a few clicks, that's malware. It's a huge ongoing problem that can only be solved by limiting the ability to run third party code. That's a really high price to pay.

Sure, you could be socially engineered into granting an attacker access to a USB device. The only solution is to have no way for you to grant access to USB devices. There is no amount of confirmation or warning you couldn't be tricked into dismissing by a social engineer.

You will also need to uninstall Remote Desktop and OpenSSH, because you could also be socially engineered into configuring them to allow access. It's a common scam to trick people into downloading TeamViewer, so we will also need to remove your Administrator access and setup AppLocker with a strict policy.

> or forcefully access them via an exploit on a surface that is generally amenable to such things

That's not how it works. When a vulnerability is described as "arbitrary code execution", that means the code can do anything, not just access functionality that exists in the browser. If you were to use a browser without WebUSB support, an arbitrary code execution exploit would still be able to interact with USB devices.

The only added complexity here is after you've granted access to a device, otherwise the attack surface is entirely tractable.

> pwn your computer because the high-quality USB implementation wasn’t that high quality after all.

You have to compare it to the options we have available today, not an implausibly perfect implementation that doesn't exist.

Let's imagine there is some bug that means if I grant access to a device, then more access than intended is actually granted. That sounds bad, but let's compare that to the non-Web USB model, where you have no option but granting unlimited unrestricted access to everything... now it doesn't sound so bad :)

Isn't "if you can find an 0day exploitable bug you can get access to everything" better than "You don't need a bug, because you already have access to everything"?

> …depends on how you’re squinting.

Umm, I know what I work on?

Why is installing software a distinct action, but granting device access not?

Malware is a huge ongoing problem, which suggests this distinction doesn't really exist.

I think we have to accept that there is no way to perfectly eliminate social engineering without also locking down legitimate access to devices. There will be some percentage of users who will click through all the warnings and confirmation prompts, just like there is some percentage of users that will run malware. That's bad, but you're letting the perfect be the enemy of the good.

Your argument could also apply to ssh, a small number of users could be socially engineered into sharing their id_rsa. This happens, we often find them checked into github, for example. Does this mean we should go back to telnet? No, for the vast majority of cases ssh is a huge imperfect improvement.

Likewise, in the vast majority of cases, Web USB is a huge imperfect improvement over installing drivers.

Why is it a security vulnerability? I really want WebUSB to succeed, it could be a cross platform way to eliminate random executables from shady websites.

The idea is that your browser can mediate and scope access to specific devices. There are some edge cases where Web USB is equally as dangerous as the status quo, but in the common case it is far better and never worse.

The situation today is you buy a random USB gadget (e.g. a fitness tracker), but you can't use it without also installing the accompanying software/drivers. That effectively gives the manufacturer complete control of your computer. All you really wanted was for them to sync your step count, but you have no option but to give them complete remote access to your computer.

With Web USB you can allow vendor.com to access device 1234:5678 only, and revoke that access whenever you like.

Sure, maybe you could be tricked into clicking through all the confirmations and granting https://fakevendor.com access to a device. That could be bad - but no worse (and probably a lot better) than being tricked into downloading and running fakedriver.exe.

(disclaimer: I work for Google, have nothing to do with Chrome)

Fun story, that TIFF bug was one of mine (CVE-2006-3459), I actually found it in an audit sponsored by Google!

The same bug was also used to jailbreak the PSP and other random devices. For a few years I would occasionally get mail from people thanking me for helping them jailbreak their DVD player or smart appliance.

I've never actually owned an iPhone, I wrote an exploit for Linux/x86, then someone else (cmw) ported it to iPhone and made the jailbreakme website!

For non-emacs users, I'm aware of navi which is a similar editor-independent solution.

https://github.com/denisidoro/navi

I got into the habit of asking things like "what is the weather like today" every morning before work, it worked fine for months and I quite liked it - while I'm occupied with something else it can give me some useful information. Then one day it started giving me the dictionary definition of the word "weather". That continued for over a week, so I just lost the habit and don't think I've really used it since.

Ah-ha, I stand corrected :)