News for hackers. Stuff that matters.

A comment on Sandboxed Mac apps can record screen any time without you knowing. Parent comment

Re:Sandboxed Mac apps can record screen any time without you... by kibwen on Saturday February 10, 2018 @08:24PM (#16350635)
Just goes to show that not all sandboxes are created equal (though I don't think I've ever even used a properly sandboxed Windows or Linux app, so those OSes don't get any points anyway). For example, reading other tabs or processes out of the web browser sandbox isn't possible short of exploits like Spectre and Meltdown, and even seeing something like the history of visited links requires cleverly tricking the user (and coarse guesswork) e.g. https://tinsnail.neocities.org/ and http://lcamtuf.coredump.cx/yahh/ . I imagine the behavior in the OP is impossible on both Android and iOS too?
[ Parent | on HN ]
Re:Sandboxed Mac apps can record screen any time without you... by abecedarius on Saturday February 10, 2018 @11:12PM (#16351136)
There was a pre-Spectre proof of concept of a program telling what tabs you have open in your web browser: https://github.com/defuse/flush-reload-attacks

This was a program rather than another webpage, and I haven't bothered to read how it worked beyond the general idea of exploiting a cache side-channel. I expect the bit-rate is low compared to Spectre/Meltdown. But it made me leery of confidentiality in current systems.

[ Parent | on HN ]
Re:Sandboxed Mac apps can record screen any time without you... by yzmtf2008 on Sunday February 11, 2018 @04:51AM (#16352009)
I think you have the idea of sandbox (or at least the idea of sandbox in the context of a web browser) backwards: it means an application (webpage) running inside the sandbox cannot access resources not granted. This side channel access does not run inside a sandbox at all.
[ Parent | on HN ]
Re:Sandboxed Mac apps can record screen any time without you... by abecedarius on Sunday February 11, 2018 @02:08PM (#16354188)
If you don't consider an OS process a sandbox at all, why are even talking about security here?
[ Parent | on HN ]
Re:Sandboxed Mac apps can record screen any time without you... by yzmtf2008 on Sunday February 11, 2018 @03:09PM (#16354485)
That’s not the point of GP though? The whole premise of virtualization is that an OS process is not a perfect sandbox. There’s a hierarchy of sandboxes. Protecting other processes from accessing something inside the sandbox is not the job of a browser sandbox. This actually just goes to show the GP’s point: not all sandboxes are created equal.
[ Parent | on HN ]
Re:Sandboxed Mac apps can record screen any time without you... by abecedarius on Monday February 12, 2018 @03:17AM (#16357274)
I was not arguing against kibwen, I was sharing some more points. People have implicitly expected OS processes to be better isolated from each other than they are. (I think there's a related problem that people tend not to think about which of the properties of integrity, confidentiality, and availability they rely on.)
[ Parent | on HN ]
Re:Sandboxed Mac apps can record screen any time without you... by ergl on Sunday February 11, 2018 @12:15PM (#16353531)
You might not be able to escape the browser's sandbox, but you can certainly escape your tab's sandbox and spy on other tabs using timing attacks: https://www.usenix.org/system/files/conference/usenixsecurit...
[ Parent | on HN ]
Re:Sandboxed Mac apps can record screen any time without you... by johncolanduoni on Saturday February 10, 2018 @11:02PM (#16351108)
If you've used Chrome, you've used a properly sandboxed app on both. I believe Firefox also now uses the Chrome sandbox on Windows. And this is definitely not routine to accomplish on iOS or Android.
[ Parent | on HN ]