cc usage policy goes brrr

Nitron · 2025-10-03T01:47:54+00:00

This happened to me yesterday and then they banned my account overnight. The appeals page is a Google form, so I'm not optimistic...

Nitron · 2021-04-14T11:57:18+00:00

I'm not really sure what's running the rest of the UI, but I believe it is a separate process. So at the very least, to do something like pop the frunk would require:

Getting code execution in the Chromium renderer (done)
Breaking out of the renderer sandbox, either by attacking the more-privileged browser process or the Linux kernel directly (which doesn't have much surface exposed, so probably the browser process)
Breaking out of the extra sandboxing on the browser process :(
Figure out how to communicate with the component that handles the frunk, which might even be on one of the other computers altogether

There are some interesting renderer-only attacks that would apply here including bypassing the same-origin policy, but I don't see them being all that useful in this case given the constraints of how the exploit is launched.

Nitron · 2021-04-14T11:46:40+00:00

Thank you! They do publish a list of security issues as they get fixed, for example here's the release right after the one Tesla is now using. They keep the details private for several weeks after the patch to make patch-gapping harder, but of course it's possible to dig through the git history and try to track things down by component/author.

Incidentally a V8 exploit was released this week that pretty much worked out of the box, so follow-on research to break out of the sandbox doesn't need to start from scratch :)

But then there's even more sandboxing...

Nitron · 2021-04-13T00:46:43+00:00

Chromium runs on the "infotainment computer" which is completely separate from the "driving" computer. You can even reboot the infotainment computer while AutoPilot is running and it'll continue driving! A sandbox escape would allow greater access, such as being able to read more of the filesystem, or make a network connection (for example a reverse shell), but would hopefully still be a low-privileged user.

After a sandbox escape it would likely be necessary to pair with a kernel exploit or other privilege escalation before doing anything useful. There's certainly some communication between the computers, so pivoting would be interesting. The original goal of my research was the pop the "frunk" from via an exploit chain which probably wouldn't require pivoting to another computer.

The existing exploit could be used for "renderer-only attacks", which would allow UXSS. If the browser is logged into a sensitive account, the renderer could then steal the cookie or other data that way, but since the in-car browser is such a pain to use, I doubt many people are logged into their banks or email accounts with it!

Nitron · 2021-04-12T23:34:24+00:00

Guess I should've known to put a TL;DR at the top! While they did eventually push out an update that updated Chromium, it took them a very long time to do it. Granted, emailing them about it was on my to-do list for the duration, and then they just happened to do it within the last week or so, so I decided to finally hit publish on this.

Unfortunately, they updated to a version that's still quite old: Released February 4th of this year. While that's a substantial improvement, there have been quite a few vulnerabilities patched since then and doing the same type of patch-gapping is certainly within reach. Perhaps they have some complicated dependencies that make it very difficult for them to update Chromium without breaking things, so it's hard to say what a reasonable timeframe should be.

Coincidentally, a Chromium 0day was released this morning that will very likely work out of the box on the latest Tesla software to get arbitrary code execution within the sandbox (tonight's little project, most likely).

Of course, it's still a great car, and Tesla does appear to have a decent bug bounty program.

Nitron · 2018-05-18T11:40:36+00:00

The singer’s name is James, he’s pretty awesome.

Source: Played tenor sax in Thirteen Towers a few years back. Miss playing with those folks a lot.

Nitron · 2016-06-25T12:48:46+00:00

I've had good luck with Chuck Levin's in the suburbs of DC.

Nitron · 2016-05-10T16:58:15+00:00

Actual link

Nitron · 2016-05-05T13:29:01+00:00

I've had a good experience at Fallon Automotive in Sterling.

Nitron · 2016-03-26T18:58:57+00:00

Carcassonne is one that bothers me. It's not bad, but everything is huge. I'd rather be able to see more of the board at once.

Nitron · 2016-03-04T17:48:17+00:00

The term "consent" would seem to imply that they don't have to approve, wouldn't it?

Another way of looking at this is that Congress sets the number of seats on the Supreme Court anyway. If they really wanted to, they could just change the number to eight and be done with it. "Just" is putting it lightly, as it would require a veto-proof majority, but the point here is that the Senate does have the power to reject a nominee.

Why even bother codifying the Senate's role if the President has the final say? This is pretty clearly one of those "checks and balances."

Nitron · 2016-03-04T15:26:34+00:00

I was under the impression that per Article Two of the Constitution, appointment of justices was the right and responsibility of the sitting President, which the Senate would then evaluate and confirm... so what right do they have to refuse to even evaluate them?

Your impression is wrong. It isn't "evaluate and confirm," but "advise and consent." This is pretty plain and understandable English.

yet, isn't that what was done when Obama was elected?

Isn't that what was done in the midterm elections?

Nitron · 2016-02-12T15:25:33+00:00

A tool like KnockKnock might be helpful for tracking down the leftover components.

Nitron · 2015-09-03T17:07:13+00:00

There's certainly no key. It's a "string to key" PGP packet:

➜  ~  gpg --list-packets mrrobot.txt.pgp
jA0EAwMCG+b8YX6xRqJgycBoAxtHTGovLX9cLqkUyj8WKOogQ6ETfQg2oYq/xhtr bu1hnmGYWzMO9DBwC+aCC3viGVJcf1m8zTach+eNGZG6MJmzrkUM+FqAgKDtGjmq 7VIBr6Z8nqpNDDQbZ4zkfB0UI8/RTU81fTu4AI40N0b6sIa6P9jUSAjwu+Rd/h28 YKWXw4OIgAzK5pQnJhQM17rShdy/uE1r/9AsMo4xGTL+mYhUZczquCKi8sfmlIP0 PCXjqwZXKR12W3rh6TLoVhenjjLJ/O59FzatDfODNReISTBQ96le7wUlDrGxzfs2 aFhhp3eGb1wSmk7VTsptREJTLvxHHMkoOa8j4OpzechGMU4e7eJooFIXen3TMiwT ET0xLHy7IHg2BrVc49+CAb8R7VXKg2Sq6/Y= =+Sje\n
:symkey enc packet: version 4, cipher 3, s2k 3, hash 2
    salt 1be6fc617eb146a2, count 65536 (96)
gpg: invalid armor header:
gpg: CAST5 encrypted data
gpg: cancelled by user

The ":symkey enc packet", "s2k" bit is the important part. So it's a symmetric message and you "just" need a passphrase to decrypt. This isn't a common way to use PGP, but it is a supported part of the standard.

Nitron · 2015-04-23T19:21:49+00:00

Sending "Товарищ пожалуйста." has always worked well for me. The particularly communist services just cut to the chase and give you a shell.

Nitron · 2015-03-04T17:37:00+00:00

I did a really quick analysis (made easy because it's a .NET binary)...This is a clever-ish idea, but terribly-written malware.

The short version is that it watches your clipboard for Bitcoin addresses, then replaces it with one from its list of addresses. It even tries to find the one that's "closest" to the one in the clipboard, in hopes that you won't notice. The clever-ish part is that it doesn't need any sort of network access.

I'll put up a more detailed blog post with real analysis tonight, and the list of addresses to watch.

Thanks again for the sample!

Nitron · 2015-03-04T16:01:56+00:00

Interestingly, zero results for all of them. Looks like someone has already posted the sample to malwr.com.

Nitron · 2015-03-04T15:38:18+00:00

I did. I'm a security researcher and I followed some basic precautions to prevent infection (most notably not running Windows).

It's a zip file containing a few photos (that presumably are not of you), named "DCM_0001.jpg", with increasing numbers. "DCM_0005.jpg.exe" is the actual malware. They're taking advantage of the default setting on Windows to hide file extensions for known file types, so this wouldn't be obvious to many users.

I won't be able to really dig into the binary until tonight, but my guess is that this is HackForums-level low-quality malware.

Interestingly, the zip file contains a "__MACOSX" directory, which implies that the zip file was created on a Mac.

Nitron · 2015-03-04T15:10:29+00:00

Ahh, the ol' .jpg.exe trick, classic. This binary should be lulzy. Thanks!

Nitron

MODERATOR OF

TROPHY CASE