Chrome OS exploit: WebAsm, Site Isolation, crosh, crash reporter, cryptohomed

Re:Chrome OS exploit: WebAsm, Site Isolation, crosh, crash r... by esturk on Thursday November 16, 2017 @02:27PM (#15715701)

I wonder if s/he save a bunch of bugs to chain together a single big exploit. From the latest report, there was 6 bugs chained together.

Imagine reporting 6 small bugs individually that nets you 6 x 1000$ = 6k$. But if you save each one, it may chain together for a potential 100k$ bounty. Of course, any insight that reveals these underlying relations is most certainly worth 100k$.

[ Parent | on HN ]

Re:Chrome OS exploit: WebAsm, Site Isolation, crosh, crash r... by lomnakkus on Thursday November 16, 2017 @02:57PM (#15716005)

AFAIUI (not a security researcher) that's actually how most of the most devastating security exploits work. There are obvious exceptions like HEARTBLEED, but in general escalation through multiple levels seems to be the name of the game.

[ Parent | on HN ]

Re:Chrome OS exploit: WebAsm, Site Isolation, crosh, crash r... by rodjun on Thursday November 16, 2017 @04:04PM (#15716601)

Or you can just get root from javascript, which that guy also did

[ Parent | on HN ]

Re:Chrome OS exploit: WebAsm, Site Isolation, crosh, crash r... by jwilk on Friday November 17, 2017 @05:12AM (#15720700)

If they care about security, they shouldn't pay more for chaining, because that gives security researchers incentive to hoard vulnerabilities, rather than report them ASAP.

[ Parent | on HN ]