All Major Browsers Fall at Pwn2Own Day Two

Re:All Major Browsers Fall at Pwn2Own Day Two by JBiserkov on Friday March 20, 2015 @02:44PM (#9239787)

.. running inside another virtual machine just to be secure from guest-to-host escape vulnerabilities.

Repeat as many times as necessary based on your paranoia levels. Inception.

[ Parent | on HN ]

Re:All Major Browsers Fall at Pwn2Own Day Two by ChuckMcM on Friday March 20, 2015 @05:48PM (#9240876)

So for a long time I had a spare Vax (MicroVAX III if you're wondering) hooked up to a modem on an unused phone line (yes it answered as KREMVAX), and when sufficient internet bandwidth came along put it on the Internet to watch people "hack" it. It was fun because they would get all confused when their x86 exploit code wasn't even a thing :-).

But your comment reminded me that if I ran a virtual VAX and then a virtual Windows on top of that and a browser in the windows, breaking out of the 'guest' into VMS would really challenge the bad guys tool box in terms of zero days :-) Fun to contemplate on a Friday afternoon.

[ Parent | on HN ]

Re:All Major Browsers Fall at Pwn2Own Day Two by anonymfus on Friday March 20, 2015 @04:32PM (#9240503)

And nesting of virtual machines is still useless if you have bugs in CPU like this (2012):

http://www.kb.cert.org/vuls/id/649219

[ Parent | on HN ]

Re:All Major Browsers Fall at Pwn2Own Day Two by oblio on Friday March 20, 2015 @05:00PM (#9240667)

And then you add a hardware emulator!

[ Parent | on HN ]

Re:All Major Browsers Fall at Pwn2Own Day Two by wtallis on Friday March 20, 2015 @08:45PM (#9241467)

That only applied to Xen's paravirtualization mode (runnning a modified guest OS as an unprivileged process), not the hardware-assisted virtualization.

[ Parent | on HN ]

Re:All Major Browsers Fall at Pwn2Own Day Two by jhildings on Sunday March 22, 2015 @05:48PM (#9248390)

VMCeption

[ Parent | on HN ]