Exodus Intelligence's security researchers publish technical write-ups of exploits and vulnerabilities in Chrome, the Linux kernel, Android, and network gear.
HN links it as a source for detailed exploit analyses, such as the V8 bug, the io_uring flaw, and the Magellan WebSQL bug.
> We don’t have any memory safe techniques for the output of JITs (or compilers by the way)
That's not quite true.
BTW there is a writeup by Exodus Intelligence here:
https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/
It's a horrifyingly complicated vulnerability that takes 28 printed pages to explain and one line of code to fix. I don't even want to know what kind of effort it took to discover this one.
The bug is not directly caused by V8 being written in C++. It's a miscompilation, and those can happen whatever language your JIT is written in.
But. But but but. It could be argued that the problem is indirectly related to it being written in C++. It's a tricky argument, but it might be worth trying. I will now try and make it. Please be aware though, that I am commercially biased, being that I work part time at Oracle Labs on the Graal team who make a JS engine (open source though!). It should hopefully be obvious that these words and thoughts are my own, not indicative of any kind of party line or anything. So, yeah, take it all with a solid dash of table salt.
One of the reasons a higher level language like Java or even Rust is more productive than C++ is the capacity for building higher level abstractions. Specifically, Java has very good reflection capabilities at both runtime and also (via annotation processors) compile time. High level and safe abstractions are one of the key tools used to make software…
I appreciate a lot of the work that the Tails guys do - but for a privacy and security focused distribution there are far too many included apps for my liking[1], which increases the attack surface. LibreOffice, Gimp and Audacity are just some of the apps - and many have a horrible history of vulnerabilities[2].
When Tails has had vulnerabilities it is often with one of these included apps[6].
The browser isn't sanboxed (it's in progress[3]), and the machine is still directly connected to the internet, so you're a single Firefox vulnerability and a drive-by download away from being deanonymized.
It is also a shame that both OS X and Windows make it difficult to write an OS to an USB stick and boot from it - the install requires an intermediary Linux OS either on DVD or USB, which a lot of users won't get by.
For a different approach, see Whonix[4] - a virtual machine based approach with an isolating proxy (very popular setup amongst black hats) and Qubes OS[4] which is built on Xen and runs processes in separate VM's
[1] https://tails.boum.org/doc/about/features/index.en.html
[2] https://www.cvedetails.com/vulnerability-list/vendor_id-11439/product_id-21008/Libreoffice-Libreoffice.html
[3] https://wiki.mozilla.org/Security/Sandbox
[4] https://www.whonix.org/
[5] https://www.qubes-os.org/
[6] https://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/
You get my upvote, because I respect your perspective and I agree in principle.
But at its logical conclusion, this idea puts up some serious practical barriers. Even if you only use an OS that you’ve personally audited, and even if you’ve gotten past the potential Thompsonian compiler issues, you’re still left with a minefield of possibly-adversarial pieces of software that might interfere with your computing experience.
Have you audited your BIOS/UEFI firmware [0]? Your CPU’s microcode [1]? Your WiFi/Bluetooth adapter’s firmware [2]? Your HDD controller’s firmware [3]?
I acknowledge that I’m advancing something of a “slippery slope” argument here, but I still care about the question. Where do you draw the line? Obviously being able to audit all of it yourself perfectly would be awesome. But to me that just seems impossible. So how much is enough?
EDIT: beaten by astrodust!
[0] https://www.pcworld.com/article/2948092/security/hacking-teams-malware-uses-uefi-rootkit-to-survive-os-reinstalls.html
[1] https://www.dcddcc.com/docs/2014_paper_microcode.pdf
[2] https://blog.exodusintel.com/2017/07/26/broadpwn/
[3] http://spritesmods.com/?art=hddhack&page=1
An important consideration when deciding if it is a good alternative is how good is it's security and ability to keep you anonymous? Since that's the whole point of using it anyway.
When evaluating, it's important to look at past vulnerabilities. The following links are to posts from Exodus Intelligence about a vuln they found in i2p in July, 2014.
- http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/
- http://blog.exodusintel.com/2014/08/25/tails-from-the-cri2p/
On the one hand you could say it is more secure now because Exodus Intelligence reviewed it, and said "I2P had many cross-site scripting vulnerabilities" of which all were fixed. Also the way in this could be exploited is a little unique (by using XSS to hit the internal I2P router configuration intranet), so it's hard to fault the developers too much for overlooking those XSS problems originally.
On the other hand, there is the view that the more vulns that are found, the more likely it is there are more as yet undiscovered vulns.
I have not run i2p or otherwise paid much attention to the project for more than a year, but I did notice it had a remote code execution vulnerability discovered last summer or so (stemming from its default-on web admin interface: http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/). Just because of that I would not consider it an alternative to Tor. However it's not true that "nobody uses i2p". The network is somewhat lively. Another thing is that relay mode is the norm rather than the exception (unlike with Tor), meaning your relay going down can be correlated with your i2p torrent client going down etc.
I'd look to GNUnet (https://gnunet.org/) as the future. It is more than just a Tor alternative, since it also has non-realtime features. Unfortunately it also has few or no users. A neat feature for any aspiring network would be capability to run over Tor, so you don't start with an empty anonymity set.
Vulnerability researcher here. This vulnerability was patch-gapped before it was disclosed.
When the patch went out 9 days ago [1], many vulnerability researchers were able to look at it and identify the root cause within minutes. Exploits started going out over a week ago before it was publicly disclosed and the CVE was released. Good security orgs that can hire skilled vulnerability researchers started patching on December 6th/7th/8th. All the chaos started on December 9th when people started leaking the poc on twitter.
The same thing happens to google chrome when they release a patch for a security vulnerability. Very skilled researchers can produce a POC and exploit given the patch alone [2]
[1] https://github.com/apache/logging-log4j2/commit/d82b47c
[2] https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome/