Conversation

twitter.com/EtTuCarl/statu It's 3 vulnerabilities in Skia, which is a 2D rendering library used by Android, Firefox and Chromium. It's widely used and the context where an attacker could gain code exec varies. For Chromium on Android it's in the Chrome or WebView renderer sandbox.

Quote Tweet

Carl (fan parody)

@EtTuCarl

Feb 14, 2019

@DanielMicay Do you know exactly what part of Android does this (specific to built-in photo app, webview, or something else)? twitter.com/cybersecboardr…

Daniel Micay

@DanielMicay

Feb 14, 2019

There are other Android apps using it along applications on other platforms. There's a detailed post about the issues on the Project Zero blog: googleprojectzero.blogspot.com/2019/02/the-cu Can tell it has diverse apps using it from StackOverflow questions like stackoverflow.com/questions/4229 (C# on iOS).

stackoverflow.com

How to add rect using Skia Sharp and apply both fill color and stroke color to that object?

How to add rect or any shape using Skia Sharp and apply both fill color and stroke color to that object in iOS

Replying to

Skia sounds as awful as something I'd expect out of Google...

Replying to

They made it because Cairo has terrible performance and varying output across platforms. I'd expect that Cairo has bigger security problems too, but doesn't get nearly as much attention because it's not exposed in two of the major browsers as the 2D canvas implementation.

Replying to

Why is this kind of functionality even exposed at all except opt-in?! (Obvious answer: Google wants it for adtech fingerprinting.)

Replying to

and

If sites want to rasterize shit themselves in my browser, they can ship a rasterizer in portable js that runs in the sandbox like everything else.

Replying to

Font handling is also a large attack surface since font rendering is extremely complex and browsers expose it to untrusted input by supporting fonts provided by the site. CSS is super complex by itself and keeps getting more features that need to interact with all the others.

Replying to

and

And of course they support all kinds of different image, video and audio codecs. They also keep expanding the feature set with things like access to MIDI devices, Bluetooth and USB but at least those prompt the user to allow it. Have you seen issues like github.com/mozilla/standa?

Replying to

and

There's literally a browser API which supports updating firmware on devices which mostly have no signature verification for the updates. The manufacturers consider that an important feature, even including the fact that there's no signature verification.

8:29 PM · Feb 14, 2019Twitter Web Client

Replying to

and

They don't want to deal with supporting updates and modding securely, so they expose firmware updates via an API exposed through web browsers and leave out verifying the updates. A user allowing access ends up letting a site implant it with persistent malware without any exploit.

Replying to

Firmware update should never be possible except via special physical interface solely for firmware update.

Show replies