Exodus Intelligence Blog

> We don’t have any memory safe techniques for the output of JITs (or compilers by the way) That's not quite true. BTW there is a writeup by Exodus Intelligence here: https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517… It's a horrifyingly complicated vulnerability that takes 28 printed pages to explain and one line of code to fix. I don't even want to know what kind of effort it took to discover this one. The bug is not directly caused by V8 being written in C++. It's a miscompilation, and those can happen whatever language your JIT is written in. But. But but but. It could be argued that the problem is indirectly related to it being written in C++. It's a tricky argument, but it might be worth trying. I will now try and make it. Please be aware though, that I am commercially biased, being that I work part time at Oracle Labs on the Graal team who make a JS engine (open source though!). It should hopefully be obvious that these words and thoughts are my own, not indicative of any kind of party line or anything. So, yeah, take it all with a solid dash of table salt. One of the reasons a higher level language like Java or even Rust is more productive than C++ is the capacity for building higher level abstractions. Specifically, Java has very good reflection capabilities at both runtime and also (via annotation processors) compile time. High level and safe abstractions are one of the key tools used to make software…

An important consideration when deciding if it is a good alternative is how good is it's security and ability to keep you anonymous? Since that's the whole point of using it anyway. When evaluating, it's important to look at past vulnerabilities. The following links are to posts from Exodus Intelligence about a vuln they found in i2p in July, 2014. - http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/ - http://blog.exodusintel.com/2014/08/25/tails-from-the-cri2p/ On the one hand you could say it is more secure now because Exodus Intelligence reviewed it, and said "I2P had many cross-site scripting vulnerabilities" of which all were fixed. Also the way in this could be exploited is a little unique (by using XSS to hit the internal I2P router configuration intranet), so it's hard to fault the developers too much for overlooking those XSS problems originally. On the other hand, there is the view that the more vulns that are found, the more likely it is there are more as yet undiscovered vulns.

Here's a recent vulnerability: https://blog.exodusintel.com/2024/03/27/mind-the-patch-gap-exploiting-… It's just your typical multithreading woes (in an unsafe language). One presumes that these problems will be ironed out eventually. Unfortunately it seems as though various hardened distros turn it off for this reason (source was a HN comment I read a while back).

WebSQL? https://blog.exodusintel.com/2019/01/22/exploiting-the-magellan-bug-on…

I was curious as to what the issue is. Found some discussion here[1] and here[2]. Anything else? At least with that patch last year you can turn it off, which seems prudent for servers facing the internet. [1]: https://lwn.net/Articles/943239/ [2]: https://blog.exodusintel.com/2024/03/27/mind-the-patch-gap-exploiting-…

There’s also a very interesting wasm based Ubercage (V8) sandbox escape in the chain: https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517… I don’t think the Chrome process isolation sandbox is escaped though.

Vulnerability researcher here. This vulnerability was patch-gapped before it was disclosed. When the patch went out 9 days ago [1], many vulnerability researchers were able to look at it and identify the root cause within minutes. Exploits started going out over a week ago before it was publicly disclosed and the CVE was released. Good security orgs that can hire skilled vulnerability researchers started patching on December 6th/7th/8th. All the chaos started on December 9th when people started leaking the poc on twitter. The same thing happens to google chrome when they release a patch for a security vulnerability. Very skilled researchers can produce a POC and exploit given the patch alone [2] [1] https://github.com/apache/logging-log4j2/commit/d82b47c [2] https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome/

I'm considering switching from Android to iOS because I don't want to throw away my phone once my 2-4 years of security updates are over. How do firmware updates factor into your thinking around Android and security? Is there a way off of the "buy a new phone if you want firmware updates" treadmill? (I don't expect you to have a solution, but I'm curious to hear how you're thinking about this problem.) See-also: https://ollieparanoid.github.io/post/security-warning/ --- Example: https://blog.exodusintel.com/2017/07/26/broadpwn/ If your phone is new, you'll get firmware updates to resolve this. If your phone is old, you need to buy a new phone or live with a vulnerable device.

Vulnerabilities in Broadcom/Cypress wifi chips' firmware have been known for a while now: https://blog.exodusintel.com/2017/07/26/broadpwn/

So, a neighbor’s compromised wifi router could remotely exploit your smart tv without even configured settings: https://blog.exodusintel.com/2017/07/26/broadpwn/

What does this post add to the original report? https://blog.exodusintel.com/2017/07/26/broadpwn/ Discussion here: https://news.ycombinator.com/item?id=14859602

Here a nice explanation of the vulnerability: https://blog.exodusintel.com/2016/02/10/firewall-hacking/ There is also a Snort signature to detect attempts to exploit this vulnerability.

Here's Exodus's write-up on the vulnerability and exploit: https://blog.exodusintel.com/2016/01/26/firewall-hacking/

gets is not missing from the list. As for alloca() please see http://blog.exodusintel.com/2013/01/07/who-was-phone/ as an example of how things can go very wrong. memcpy() isn't bad in itself but its easy to get wrong when you're dealing with untrusted user supplied size parameters. memcpy_s is a better alternative because it encourages the developer to think about the size parameters being passed in.

You get my upvote, because I respect your perspective and I agree in principle. But at its logical conclusion, this idea puts up some serious practical barriers. Even if you only use an OS that you’ve personally audited, and even if you’ve gotten past the potential Thompsonian compiler issues, you’re still left with a minefield of possibly-adversarial pieces of software that might interfere with your computing experience. Have you audited your BIOS/UEFI firmware [0]? Your CPU’s microcode [1]? Your WiFi/Bluetooth adapter’s firmware [2]? Your HDD controller’s firmware [3]? I acknowledge that I’m advancing something of a “slippery slope” argument here, but I still care about the question. Where do you draw the line? Obviously being able to audit all of it yourself perfectly would be awesome. But to me that just seems impossible. So how much is enough? EDIT: beaten by astrodust! [0] https://www.pcworld.com/article/2948092/security/hacking-teams-malware… [1] https://www.dcddcc.com/docs/2014_paper_microcode.pdf [2] https://blog.exodusintel.com/2017/07/26/broadpwn/ [3] http://spritesmods.com/?art=hddhack&page=1

I have not run i2p or otherwise paid much attention to the project for more than a year, but I did notice it had a remote code execution vulnerability discovered last summer or so (stemming from its default-on web admin interface: http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/). Just because of that I would not consider it an alternative to Tor. However it's not true that "nobody uses i2p". The network is somewhat lively. Another thing is that relay mode is the norm rather than the exception (unlike with Tor), meaning your relay going down can be correlated with your i2p torrent client going down etc. I'd look to GNUnet (https://gnunet.org/) as the future. It is more than just a Tor alternative, since it also has non-realtime features. Unfortunately it also has few or no users. A neat feature for any aspiring network would be capability to run over Tor, so you don't start with an empty anonymity set.

I appreciate a lot of the work that the Tails guys do - but for a privacy and security focused distribution there are far too many included apps for my liking[1], which increases the attack surface. LibreOffice, Gimp and Audacity are just some of the apps - and many have a horrible history of vulnerabilities[2]. When Tails has had vulnerabilities it is often with one of these included apps[6]. The browser isn't sanboxed (it's in progress[3]), and the machine is still directly connected to the internet, so you're a single Firefox vulnerability and a drive-by download away from being deanonymized. It is also a shame that both OS X and Windows make it difficult to write an OS to an USB stick and boot from it - the install requires an intermediary Linux OS either on DVD or USB, which a lot of users won't get by. For a different approach, see Whonix[4] - a virtual machine based approach with an isolating proxy (very popular setup amongst black hats) and Qubes OS[4] which is built on Xen and runs processes in separate VM's [1] https://tails.boum.org/doc/about/features/index.en.html [2] https://www.cvedetails.com/vulnerability-list/vendor_id-11439/product_… [3] https://wiki.mozilla.org/Security/Sandbox [4] https://www.whonix.org/ [5] https://www.qubes-os.org/ [6] https://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/