News for hackers. Stuff that matters.

A comment on Javascript exploit actively used against TorBrowser. Parent comment

Re:Javascript exploit actively used against TorBrowser by ryuuchin on Tuesday November 29, 2016 @07:59PM (#13067609)
> A 30 second glance at the source code makes it looks like this exploit pivots to attacker-controlled memory on the heap, and spawns a thread using kernel32.dll. As EMET has hardening against attacks like this, I am curious if this exploit works at all on EMET-enabled Windows systems.

EMET can be bypassed so it's no guarantee that it would stop the exploit (but it would probably stop THIS exploit). I don't know if some modification would be able to bypass EMET or other mitigations.

A better solution would be to run javascript in a sandbox (as is done in Chrome/Chromium based browser) which has a much higher barrier to exit.

[ Parent | on HN ]
Re:Javascript exploit actively used against TorBrowser by micaksica on Tuesday November 29, 2016 @08:32PM (#13067722)
> A better solution would be to run javascript in a sandbox (as is done in Chrome/Chromium based browser) which has a much higher barrier to exit.

Sure, but we can't get TBB rewritten overnight to work instantly with Chromium, and I'm sure there'd be a lot of push back on that.

[ Parent | on HN ]
Re:Javascript exploit actively used against TorBrowser by TD-Linux on Wednesday November 30, 2016 @01:48AM (#13068955)
An easier solution would be to enable e10s. It should be on by default in the next ESR, and I know TBB has been working to make their patches compatible with it.
[ Parent | on HN ]
Re:Javascript exploit actively used against TorBrowser by gcp on Wednesday November 30, 2016 @03:32AM (#13069278)
Not just e10s, they also need to enable the sandboxing, i.e. it requires Firefox 50 at least.

It should actually be easier for Tor to enable stricter sandboxing than in the default Firefox, though, as presumably they have to care less about compatibility.

[ Parent | on HN ]
Re:Javascript exploit actively used against TorBrowser by splesjaz on Tuesday November 29, 2016 @08:43PM (#13067763)
Well yea but this isn't something that we discovered today it's been years sadly :(
[ Parent | on HN ]
Re:Javascript exploit actively used against TorBrowser by MikeHolman on Tuesday November 29, 2016 @09:50PM (#13068063)
I don't know much about EMET. How would they mitigate this? After all, it's obviously valid for a VM to call CreateThread.
[ Parent | on HN ]
Re:Javascript exploit actively used against TorBrowser by micaksica on Wednesday November 30, 2016 @01:53AM (#13068969)
EMET has mitigations against stack pivoting.
[ Parent | on HN ]