On the slightly less dark side, we can probably assume that this class of exploits is so valuable that nobody would use it against a large number of people at once in an ordinary way, like sending out spam emails or comments with links to build a botnet. That would likely result in it getting noticed and patched quickly, for very little return on investment.

These types of exploits are probably only used by very well financed organizations in carefully targeted ways, so as to justify the huge cost of finding them and keep them unnoticed and unpatched for as long as possible. See the recent stories on the Equation group-associated malware. You and I are probably safe enough, but somebody like Edward Snowden better be very careful where he surfs.

I've never thought about surfing in a VM before, but it seems that if you're ultra paranoid that it would be best to do so.

Starting to think that running apps within a container is the right way to go.

Or on a completely separate machine: Exploits have been found for visualization software. Of course, then you need to be concerned about the network and so on.

It's turtles all the way down.

IMHO, the bigger concern is the exploits that the wider community hasn't found yet. How many nasty tricks were out there in Stuxnet for years before anybody noticed? Just given the scale of the stuff that's been found, I'm inclined to think that trying to out-secure organizations with that kind of resources is a losing battle.

You're better of not being somebody anyone would invest that kind of effort to hack. Or at least making your traffic not identifiable as somebody that your opponent would want to hack.

Last I checked, holders of large amounts of Bitcoin tend to avoid letting their identity be associated with their accounts easily, and that's probably why. I bet somebody would be willing to risk a few $100k exploits to get a few $million worth of BTC.

That's why I have a separate machine which I use just for browsing the Web, which I keep disconnected from the Internet in a sealed steel box.

...

Unplugged from the mains.

Qubes tries to build the OS that way.

https://www.qubes-os.org/

> Starting to think that running apps within a container is the right way to go.

If you're talking about something like Linux containers, note that the Chrome Pwn2Own exploit involved a sandbox escape via a kernel exploit. (Though seccomp-BPF mitigates this to some extent on Linux.)

See Sandboxie

And that is why you browse with a virtual machine which is re-initialized from the CD copy every time you restart :-)

.. running inside another virtual machine just to be secure from guest-to-host escape vulnerabilities.

Repeat as many times as necessary based on your paranoia levels. Inception.

So for a long time I had a spare Vax (MicroVAX III if you're wondering) hooked up to a modem on an unused phone line (yes it answered as KREMVAX), and when sufficient internet bandwidth came along put it on the Internet to watch people "hack" it. It was fun because they would get all confused when their x86 exploit code wasn't even a thing :-).

But your comment reminded me that if I ran a virtual VAX and then a virtual Windows on top of that and a browser in the windows, breaking out of the 'guest' into VMS would really challenge the bad guys tool box in terms of zero days :-) Fun to contemplate on a Friday afternoon.

And nesting of virtual machines is still useless if you have bugs in CPU like this (2012):

http://www.kb.cert.org/vuls/id/649219

And then you add a hardware emulator!

That only applied to Xen's paravirtualization mode (runnning a modified guest OS as an unprivileged process), not the hardware-assisted virtualization.

VMCeption

Not exactly - the economics are important.

Anyone who builds an exploit like this is not going to waste it. It's either going to be used in targeted attacks, or reserved for pwn2own. They're not going to burn it by leaving it on some hacked site to get used on your grandmother.

Those types of attacks happen after the exploit is already known and has patches available. The good stuff trickles down, and the early days of active exploitation are more or less restricted to those with the deep pockets and legal impunity.

True it is a scary web but how many of those exploits have relied on default settings and Javascript to run?

You are many times safer on the web if you have the discipline to use noscript properly.

> True it is a scary web but how many of those exploits have relied on default settings and Javascript to run?

Layout (just to name one non-JS subsystem) has been responsible for a lot of vulnerabilities too.

True, but from experience it is often the case that exploits are obfuscated by being wrapped in one or more layers of JS, so that they are less likely to be discovered by passive scanners.

This will probably seem quite shocking, but I almost exclusively used IE6 for a few years, with JS disabled - and despite frequently visiting the "darkest corners" of the Internet, was never exploited. On the sites that tried, I'd just see a blank page; view the source, and there was a blob of obfuscated JS.

And if the person sitting next to you in the same organization doesn't do that, or any person doesn't do that, if they get compromised then their box could attack yours with a different kind of payload.

Fun fact: Noscript loads and parses all javascript and then just stops it from running against the live DOM. Decreases page render time, sure. Prevents exploits? Don't think so.

NoScript won't actually execute any of the Javascript, though. I am not aware of any historical vulnerabilities from the mere act of loading and parsing Javascript, though they're certainly theoretically possible. It's much easier to secure a parser than a runtime.

I can't recall a single exploitable bug in these competitions that attacked the javascript parser. Running the js is a far larger surface area to attack.

That does not affect security significantly. If it did then it would totally defeat the purpose of noscript existing.

Any yet every time JavaScript blocking extensions are mentioned, it gets ridiculed.

edit: case in point, someone posted about it right before and it's downvoted. Good job!

Welcome to Hacker News in 2015, where the community mindset has changed from the old school Slashdot's reverence for software freedom and ideology to modern Reddit's mantra of "Who cares? It works! Get real!"

1) >implying the mindset on HN hasn't always been "push things and break shit who cares"

2) /r/programming and other software development subreddits are actually closer to slashdot's ideologies (excepting /r/webdev where performance is an overrated thing)

The good news is that HN seems to be slowly going back to a more old school mindset. At least you can criticize javascript.framework.of.the.day.js without being showered in downvotes, as opposed to a year ago.

The regrettable truth is that this pushes us all toward a more centralized web, as it's much less likely that google.com or facebook.com is going to pwn your browser.

The real nightmare scenario is when developer machines get hacked and attackers get access to source, but also to build servers where they can inject binaries into the web deployment stream, which themselves exploit end-user browsers. This is, I think, a very good reason to not give devs any access to build/CI servers. (Ironically, actual endpoint servers are slightly less critical to secure from devs.)

The few times I've caught on-load viruses was when visiting big sites. Turns out their ad networks often get compromised and suddenly reddit or facebook are loading exploits.

Virtualizing and sandboxing the browser in a secure way is the only way out of this. On top of an eventual move to memory safe languages.

That's a damn good point. It also means that ad networks and CDNs are the best targets.

The lovely choice:

1. facebook where the NSA are checking on you

2. faceskibook where a Russian hacker is going to own your pc