5

I am using Google's Chrome browser under Linux (Ubuntu) 64 bit for web browsing.

If I a virus uses for example a leak in the flash player, the virus will get the privileges of the user who started the browser, in my case a normal non-admin user.

  1. Each tab in chrome is separated in a different process and I know that applications are directly prevented from modifying each other's memory addresses because they can't see it. So if I have two tabs open. In one tab there is my twitter login page, in the other tab there is the malicious website with the flash malware. If the tab (process) with the flash player gets infected by the virus, is the virus separated from the tab (process) where my twitter login is? This would mean that the virus can only sneak passwords etc. in the tab (process) where the virus exists. If I will use my Twitter password in the other tab, the password is only in the memory of this tab and cannot be seen by the infected tab (process) right?
  2. Another point is the sandbox of google chrome. If the virus uses a leak in the flash player to control the process where this tab is executed, what can this virus do? I think a successful usage of a plugin leak will bring the virus only in the sandbox and what can it do inside this sandbox? Can it read my personal data from my home folder, or sneaking passwords I use in the browser?
Improve this question

1 Answer 1

Reset to default
2

First you have to understand what a sandbox is. It is not like a virtual machine where the things running inside can do whatever they want. The Chrome sandbox controls access to the outside by providing a limited set of APIs with stricted parameters. Some Chrome sandboxed processes are not allowed to write to disk or display anything to screen. What exactly they can do is controlled by an explicit policy.

Escaping a sandbox means doing things that are not specifically allowed by the sandbox.

Read more about Chrome's sandbox from the Chromium homepage and The Security Architecture of the Chromium Browser

You said:

This would mean that the virus can only sneak passwords etc. in the tab (process) where the virus exists.

"Sneaking passwords" means that the exploit has access to memory and can execute code. That means it can do anything on the system. Read more about the concept of sandbox.

In the context of sandboxes, the closest thing you talk about is a partial sandbox escape where an exploit (the generalization of what you call a virus) for example, can read arbitrary memory of the process it is running under. This is still a vulnerability and it can be combined with other vulnerabilities to realize a full sandbox escape. Google will pay you money for a partial exploit.

$60,000 - “Full Chrome exploit”: Chrome / Win7 local OS user account persistence using only bugs in Chrome itself.

$40,000 - “Partial Chrome exploit”: Chrome / Win7 local OS user account persistence using at least one bug in Chrome itself, plus other bugs. For example, a WebKit bug combined with a Windows sandbox bug.

$20,000 - “Consolation reward, Flash / Windows / other”: Chrome / Win7 local OS user account persistence that does not use bugs in Chrome.

Flash is not completely sandboxed in Chrome, so some exploits can be contained by the sandbox while others not. The contained ones will not be allowed by the sandbox to access your sensitive data. The other ones will run free on your system.

Improve this answer
4
  • You said that "sneaking passwords" means that the exploit has access to memory and can execute code. That means it can do anything on the system. But in the architecture of chrome the broker process handles the IPC between the processes (tabs). How can one process get access to the password in the memory of the other tab? I could not imagine, how this should be possible
    – Jan Koester
    Jan 21, 2013 at 17:18
  • I think that's precisely the point, @JanKoester - Getting access to the memory of another tab would require unlimited access to the system - in which case why bother with passwords when there are so many more valuable things you can do with the system?
    – Wayne Werner
    Jan 21, 2013 at 17:57
  • indeed. so the exploit must first get higher privileges to get access to the memory of the other processes? Of course this meens much more but this would be another wall which has to be break down by the exploit.
    – Jan Koester
    Jan 21, 2013 at 18:20
  • Writing an exploit to process information (i.e. stealing a password and sending it somewhere) from a different tab is not much easier than writing an exploit that has access to the OS.
    – Cristian Dobre
    Jan 21, 2013 at 18:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .