Google, VUPEN Spar Over Chrome Hack

If bypass of Chromes sandbox indeed used a new Flash vulnerability in the browser, then its both a Flash bug and a Chrome hack, says security researcher Dan Kaminksy

The Google Chrome browser hack revealed this week could come down to a dispute over third-party software: A Google security expert says a zero-day flaw discovered by VUPEN Security researchers to bypass the browsers sandbox actually lies in Adobe Flash. But VUPEN isnt budging on its claims that its researchers successfully owned the browser software itself.
But for now, only VUPEN and its three-letter government agency customers know the details about
the two zero-day vulnerabilities that VUPEN says it exploited and successfully used to bypass Chromes sandbox
and other security features.
Nobody knows how we bypassed Google Chromes sandbox except us and our customers, and any claim is a pure speculation, says Chaouki Bekrar, CEO and head of research at VUPEN. We will not reveal the details on how we achieved the full compromise of Chrome and its sandbox. We can, however, say that we did use the default and built-in attack surface of the browser without using a Windows kernel vulnerability. All users of Chrome should be aware now that this browser can be fully hacked despite its famous sandbox and despite all the marketing that Google has been doing around its security.
Bekrar would neither confirm nor deny whether his firm found the bug in Chromes Flash plug-in implementation, which comes with the browser. But he did say this when asked about it: Google Chrome sandboxes all its default plug-ins; thus, exploiting a plug-in vulnerability is not enough to bypass the sandbox.
Google, meanwhile, is challenging VUPENs claims of a bug in Chrome. Google security researcher Tavis Ormandy said in a Twitter post that VUPEN misunderstood how sandboxing worked in chrome, and only had a flash bug.
A Google spokesperson said the Chrome team is still investigating VUPENs claim that it hacked Chromes famed sandbox feature. Chromes sandbox, along with its use of Microsofts DEP and ASLR technologies, thus far has made the browser relatively impenetrable to hackers.
Aside from a video and blog posting on the attack, VUPEN has kept details of the flaws and exploits closely held: As of this posting, Google hadnt received them. Bekrar did reveal yesterday in an interview that VUPEN employed one zero-day thats exploited inside the sandbox, and another thats executed outside of it. The first one results from a memory corruption leading to the execution of the first payload at low-integrity level, inside the sandbox, he says. A second payload is then used to exploit another vulnerability, which allows the bypass of the sandbox and execution of the final payload with medium-integrity level, outside the sandbox.
But tweets today from Googles Ormandy appear to point to Flash as containing a vulnerability, not Chrome.
So what gives?
Both VUPEN and Google are technically right, says security expert Dan Kaminsky, who has been analyzing VUPENs public disclosure and the debate that unfolded on Twitter between the two companies today. VUPEN didnt break the primary Chrome sandbox. It might have broken a secondary Flash sandbox. But at the end of the day, the [Chrome] browser got owned, Kaminsky says. This is sort of a rare, nuanced situation where everyone is right.
Kaminsky applauds Googles efforts to lock down Chrome. He says the issue with the VUPEN research is that it goes back to the issue of using and keeping third-party software safe. Everyone has been scratching their heads for years about what to do about insecure plug-ins, he says. Google took Flash code in-house, for example and wrote a PDF parser for PDF plug-ins.
Google basically assumed the responsibility of keeping its browser users as safe as possible with Flash, Kaminsky says. Chrome has to push an update of Flash ... because [of] the code they shipped thats buggy, he says. If you ship it in your browser and its on by default, its your responsibility. Sometimes youre going to get burnt because of it.
Kaminsky says that because Flash breaks when placed in the browsers primary sandbox, its not protected by it. [Google is] still working on a version of Flash that doesnt break when put in the sandbox, he says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Google, VUPEN Spar Over Chrome Hack