News for hackers. Stuff that matters.

A comment on Zero-click, wormable, cross-platform remote code execution in Microsoft Teams. Parent comment

Re:Zero-click, wormable, cross-platform remote code executio... by coldtea on Monday December 07, 2020 @12:42PM (#25334605)
Yeah, because remote code exploits are particularly an issue with Electron, as opposed an order of magnitude less likely to happen with it compared to native code.

Basically you got it completely backwards. The typical native app (which is not Rust or Java but C/C++/Obj-C, etc) only keeps the unsafe part of Electron, and even drops the sandbox (whose holes can always be patched, but total absense cannot).

[ Parent | on HN ]
Re:Zero-click, wormable, cross-platform remote code executio... by toxik on Tuesday December 08, 2020 @06:23AM (#25343956)
Complexity leads to RCEs like the one in TFA, not “unsafe” languages.

It is very disingenuous to say that other native apps keep the unsafe parts; there are no such parts at all.

It should be telling that Microsoft, in one of their most successful products of late, have punched an RCE sized hole in that sandbox unwittingly.

[ Parent | on HN ]