Try out the early alpha of Process Isolation in Chrome 138. chrome://flags/#enable-process-isolation-ui then chrome://settings/system for the switch. Read known issues https://t.co/68RfiInChZ and report bugs! Especially interested in App-Compat bugs.
@0xcharlie The sooner we have the bug the sooner we are able to fix it for users. Breaking exploits with offset changes doesn't cause the bug to magically disappear or make users any safer.
@0xcharlie We already tried to avoid releasing Chrome updates in the days leading up to pwn2own just in case a benign offset change meant we didn't get a juicy bug. Prefer to get the bug than not. Harder to avoid now though with weekly updates...
@simplylurking2 Hmm, many techniques here might not work any more...? e.g. Secure Preferences now enabled on Enterprise and use App-Bound Encryption for hashes. Post what you find from your testing :)
@5aelo seems like strong CFI should be possible - I suppose I am talking both forward and backward edge, and maybe CET or some hardware support? I think this seems more achievable than 'solving the JIT problem' but I dunno
pwn2own has always been a great datapoint for how hard it is to find vulns, what exploit mitigations are working, new exploitation techniques, and now how AI works on offensive security.
Great advice from @AnthropicAI on prep for accelerated AI vulnerability discovery, including what to do if you don’t have a dedicated security team, if you’re reporting bugs you found, or are an open source maintainer.
/ht @_decius_ for sending the link
https://t.co/3qfqDJzCPM
@WindowsCentral Make it so right clicking on a file in explorer on a modern 64-core theadripper 3995WX doesn't take 3 seconds to open the context menu.
The window between vulnerability disclosure and real-world exploitation keeps shrinking.
The Zero Day Clock visualizes how fast attackers are operationalizing new CVEs. What used to take months now often happens in days, or hours.
The future needs to be Secure by Design.
https://t.co/zFXOSKB7eq
#AppSec #CyberSecurity
@afneil On international flights with no first class cabin they sometimes don't even bother calling group 1 (BA Gold) and go straight to 2 (business class).
@xaitax I find it amusing that Copilot is using App-Bound Encryption - how about adding this support directly into the OS instead? Does this mean I work in AI Security now? :)
Interesting. Microsoft Edge now finally switched on App-bound encryption for their passwords. At least for me now on Version 144.0.3719.35. Last test on Version 142.0.3595.53 this wasn't the case.
@jrozner@dinodaizovi ... you need something like application isolation or strong application secret binding (macOS has keychain, Windows has app-bound encryption). 2/2
@jrozner@dinodaizovi yes, exactly - so the cookie can be stolen but it can't be used off the device because of the need to present the short lived bearer token which is hardware bound. I don't think the goal of DBSC is to block an attacker with a persistent presence on the device. for that ... 1/2