Hacker News new | past | comments | ask | show | jobs | submit login

I get that it's important that we call out exploitable situations like this, but it's also kind of moot. There are so many ways to exploit modern systems you can just rustle around in a bag of exploits and one will work. Known executable, unknown, doesn't matter. Not even using a VM will keep you safe. Not even RBAC.

What's easier and more reliable is to work in terms of risks. It's fine if you get exploited, as long as the access you have to sensitive systems is limited, and those sensitive systems have backups, and you can't delete those backups, you can re-deploy systems from scratch using automation if you get compromised, automatically rotate credentials, etc.

Lower the overall risk by setting everything up so the worst case scenario isn't that bad. Then you don't have to worry so much about an "unknown executable" because even if it gets exploited the attacker can't cause too much damage.




This ("so many ways to exploit modern systems") is not actually true.

Yes, plenty of memory-unsafety vulnerabilities exist, but modern mitigations like stack cookies, ASLR, (and sometimes) sandboxing and PAC make it unlikely that e.g. a buffer overflow is exploitable without other factors such as an information leak from your machine back to the attacker. (This might be the case on publicly-accessible servers, but probably not on your laptop.)

The vulnerability being discussed here is unusually dangerous because it's more like command injection, and mitigations aren't going to help.


ASLR, PAC, etc are trivial to defeat for an experienced black hat / red team.

I'm not even talking about memory safety. That's just one class of exploits. There are so many more to choose from.

This vuln isn't that dangerous. It requires a special circumstance and trust. Other vulns don't require those things.


The number one method of security, at least for power users, is user behavior. Look at URLs you might visit critically. Don't run random-ass code. Keep an eye out for being taken advantage of.


> Not even using a VM will keep you safe.

Do you browse the Internet? Ever visited an unknown website? Whatever the browser uses to run JS and wasm code on the web ought to be enough.


Browsers do in fact get exploited; I would have called that an example of it not being a solved problem.


They get exploited (and then the exploit is patched), but we're still using a browser to talk about this, right?


People used IE6; I wouldn't call that an endorsement of it as a secure system, only useful enough to justify the risk.


You're joking, right?

Browsers haven't ever been safe. There are competitions every year to find new 0days that break out of browser protections, and every year multiple are found. And those are the vulns they'll tell you about.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: