Chris Evans (Scary Beasts Security)

>By default, there are no services listening. Desktop linux, not "the Linux kernel". The kernel isn't amazing, but on the desktop side you regularly see downright absurd stuff like this https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-compromis… and less surprising bugs like this https://donncha.is/2016/12/compromising-ubuntu-desktop/ The quality of software outside of some widely deployed server software tends to be quite poor, exploit mitigations are not being implemented. >And what malware runs on Linux? Far too many to list. You can easily find hundreds of public examples. This terrible wikipedia page provides a decent starting point with a list of names to google https://en.wikipedia.org/wiki/Linux_malware

> You have not been paying attention. Maybe consider accepting the advice of experts? It would be great to have a few of these issues sourced in the comment (and your comments on the Tor Browser expanded with some reasoning) just so everyone is on the same page. I've seen some exploits with Tor Browser but I thought they'd be mostly sorted out. I get that Chrome has some more mature sandboxing code, but I must admit I'm not a fan of how it handles a lot of things including download behaviour (http://security.stackexchange.com/q/145808 and https://scarybeastsecurity.blogspot.co.uk/2016/11/0day-poc-risky-desig… Firefox at least does a better job here. I agree with the advice for border passage, only thing that makes this difficult is the state of upload speeds.

VU#804060 is talking about "cookie forcing". This is not a new discovery. Here's Chris Evans (not the actor) talking about it in 2008: http://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.html The best solution is to preload HSTS on a domain and include all subdomains, and we've been saying that for years. That prevents any HTTP connections, although it's obviously not an easy solution in many cases. The USENIX paper does suggest some unilateral changes to cookie semantics to address this issue, but any such changes have eye-watering compatibility concerns and could only be deployed after a lot of testing.

The "guy" is Chris Evans. He works at Google in Chrome Security Team. * http://scarybeastsecurity.blogspot.co.uk/ * http://www.scary.beasts.org/security/

Few more great writeups: https://map.grauw.nl/articles/low-level-disk/ https://www.unige.ch/medecine/nouspikel/ti99/disks.htm https://scarybeastsecurity.blogspot.com/2021/05/recovering-lost-treasu… and my own contribution https://github.com/raszpl/sigrok-disk decoder for viewing floppy/hdd tracks in nice GUI using $5 logic analyzers like https://sigrok.org/wiki/Lcsoft_Mini_Board or https://github.com/gusmanb/logicanalyzer

You can try with advanced techniques: https://scarybeastsecurity.blogspot.com/2021/05/recovering-lost-treasu…

In general emulated code should only be able to interact with the emulated machine, not the host machine running the emulator. But there's no specific sandboxing and there have been cases of bugs in emulators that allowed specially crafted roms to execute code on the host (https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-compromis…

Since I can't edit anymore: This article re: imaging floppies in the analog domain made the rounds on HN a couple years ago: https://scarybeastsecurity.blogspot.com/2021/05/recovering-lost-treasu… The comments have some good links and background: https://news.ycombinator.com/item?id=27187435

Could also be something like that: https://scarybeastsecurity.blogspot.com/2020/12/the-cleverest-floppy-d… I remember reading some article I can't find again about a very unusual floppy protection that involved nonstandard floppy format, something like non standard sector sizes that could be read by the hardware but not written, and the protected software implemented some direct access to the floppy hardware to read data.

Someone posted this[0] recently about recovering old data from damaged floppies using oscilloscope. [0] https://scarybeastsecurity.blogspot.com/2021/05/recovering-lost-treasu…

This is why you have never seen FTPS in the wild, from the vsftpd.conf manual page: ssl_enable If enabled, and vsftpd was compiled against OpenSSL, vsftpd will support secure connections via SSL. This applies to the control connection (including login) and also data connections. You'll need a client with SSL support too. NOTE!! Beware enabling this option. Only enable it if you need it. vsftpd can make no guar‐ antees about the security of the OpenSSL libraries. By enabling this option, you are declaring that you trust the security of your installed OpenSSL library. Default: NO https://scarybeastsecurity.blogspot.com/2015/07/vsftpd-303-released-an…

To be fair, the Atari 2600 supports sprite multiplexing.[0] And you can drive a BBC Micro's floppy drive from its screen output lines…[1] [0]: https://en.wikipedia.org/wiki/Sprite_multiplexing [1]: https://scarybeastsecurity.blogspot.com/2020/07/turning-400-bbc-micro-…

I wouldn't be so complacent, I'm reminded of this vulnerability: https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-compromis…

Addendum: Anyone remember GStreamer being a Linux vulnerability because it had a 6502 CPU emulator to run... NES music files, and hackers managed to jump outside of the VM. https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-compromis… It makes me wonder how easy it is to break out of a particular anti-virus vendor's VM, in a vulnerability that wouldn't exist if you weren't even running AV (outside Defender) at all.

As an OpenBSD fan: consider Qubes instead if you want a "desktop" experience. OpenBSD works fine, but the open-source desktop is quite vulnerable (consider how many things need to go wrong for https://scarybeastsecurity.blogspot.nl/2016/12/redux-compromising-linu… and a lot of OpenBSD's hardening is in the (simpler) base system, not in GNOME / KDE / Firefox / Chrome / ... Alternatively, consider not running a full-blown desktop or using Windows, which has grown a lot more secure since the Windows XP pre-SP2 days.

Most of moderns RCE POCs lift off a scripting engine (VBS for Office, Javascript for browsers, ActiveX for Flash, etc..) in order to facilitate exploitation. The only ones which does not use a script engine are POC exploiting a "network" vuln (like SMB). Scriptless 0day RCE is still possible in a ROP+ALSR world, but exploitation is a real bitch. Ex : https://scarybeastsecurity.blogspot.fr/2016/11/0day-exploit-advancing-…

This is YB (Yahoobleed) #2. You might also enjoy YB #1: "*bleed continues: 18 byte file, $14k bounty, for leaking private Yahoo! Mail images": https://scarybeastsecurity.blogspot.com/2017/05/bleed-continues-18-byt…

Defining "non-executable" is then an interesting exercise... From https://scarybeastsecurity.blogspot.co.uk/2016/12/redux-compromising-l… > You’ve likely guessed it by now, but the Linux gstreamer media playback framework supports playback of SNES music files by…. emulating the SNES CPU and audio processor, courtesy of Game Music Emu. How cool is that?

There are interpreters for programs that are delivered over the network to be run locally by the unsuspecting user, in some surprising places. For example: Here's a sound player that contains an entire 6502-based virtual machine, because the "sound file format" that it "plays" is actually an executable program. Unfortunately, the virtual machine hardware is not properly simulated, allowing the 6502 code to memory-map parts of the virtual machine manager itself using the virtual memory controller hardware and alter them. * http://scarybeastsecurity.blogspot.co.uk/2016/11/0day-exploit-compromi… (https://news.ycombinator.com/item?id=12951503)

Please don't link to blogspam. The original article is here: https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-advancing…

Both Michal Zalewski[1] and Chris Evans[2] have commented on this, and I tend to agree with them. The actual implications for a CSRF like this are very minimal. [1] https://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-to-design… [2] http://scarybeastsecurity.blogspot.com/2010/01/logout-xsrf-significant…

Complete AI is no the hardest problem in CS, parsing text is. Joking aside this reminded me of that CSS vulnerability that allowed attackers to read peoples mails: http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-c…

I think this is what it hinges on: http://scarybeastsecurity.blogspot.com.es/2008/11/cookie-forcing.html Is that possible under HSTS?

google have a whole competition devoted to the basic idea. it's called pwnium. http://scarybeastsecurity.blogspot.ie/2013/02/exploiting-64-bit-linux-…

Thanks, that led me to http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-c… .

First, it's fascinating to watch newcomers discovering obsolete tech that was so current when I got into computers. I recall 8", 5.25" and 3.5" floppies very well. Most of this 'rediscovered' tech I'm already familiar with (it makes me feel like a dinosaur). I recall aligning Shugardt SA800 8" floppy drives with an oscilloscope and it's described in the maintenance manuals along with the circuit diagrams—yes, there was actually a time when we automatically had the Right to Repair and manufacturers provided circuit diagrams and repair information as an accepted and normal practice (back in the 1980s the very notion of Right to Repair would have been foreign and ridiculous to us)! (Incidentally, I still own two SA800 drives, they're still mounted side-by-side in their docking bay. I also have copies of the operation and maintenance manuals. They not only cover the theory of operation of the drive but also its maintenance and alignment procedures.) As the linked article demonstrates (https://scarybeastsecurity.blogspot.com/2021/05/recovering-lost-treasu… when one cannot read a floppy or gets data errors during a read the first thing to do is to try different drives as the read sensitivity and mechanical alignment can vary from drive to drive—even if one's drive is in perfect mechanical alignment the disk one is trying to read may have been recorded on a drive that was out of alignment (tiny alignment differences don't matter much in normal operation…

I asked that question myself before[1], and others, too [2]. But the answer is a clear no. Read this explanation [3] on oss-security where someone lays out in detail in which ways ASAN creates security problems. It ultimately is just not built as a protection mechansim, but as a debugging tool. While you'd catch some bugs (UAFs, Buffer overreads), you introduce others. Maybe there could be a "like asan but designed for production" tool. I think Softbound-CETS was trying to go in that direction, but never became production ready and is as far as I know no longer developed. But right now such a tool does not exist. Though however what absolutely should be done: Every C/C++-written tool should be tested with ASAN. This doesn't happen (not a single Linux distro uses ASAN testing as a default practice before adding packages), and this is very sad. (I know this because I still find major packages that have ASAN-findable bugs exposed by their own test suite.) [1] https://blog.hboeck.de/archives/879-Safer-use-of-C-code-running-Gentoo… [2] https://scarybeastsecurity.blogspot.com/2014/09/using-asan-as-protecti… [3] https://www.openwall.com/lists/oss-security/2016/02/17/9