guest

VirtualBox 5.2 的 0day 爆破...

在 Hacker News Daily 上看到「VirtualBox E1000 Guest-to-Host Escape」這篇，講 VirtualBox 5.2 的機器上 E1000 + NAT 模式的爆破... 另外在 Hacker News 上的討論也提到了很多這樣做的背景：「VirtualBox E1000 Guest-to-Host Escape | Hacker News」。

Oracle 對社群的態度 (無論是 open source community 或是 security community) 都一直是社群很不爽的事情。

這次爆破的發現人之前找到一個 VirtualBox 的 security bug (參考「SSD Advisory – VirtualBox VRDP Guest-to-Host Escape」)，回報後先是回應他們在處理中，然後被發現 VirtualBox 在 5.2.18 修掉了，但是完全沒有提到安全性問題的事情。所以這次作者也懶得囉唆了，找到就 full disclosure 出來。

作者給的 workaround 有兩個，優先建議暫時先用 PCnet 系列的界面，如果不行的話，至少不要用 NAT。

作者發表後沒多久馬上就有 5.2.22 推出，不過看 changelog 應該是沒有修正這個問題？(或是修掉又沒提...)

Microsoft Azure 宣佈正式支援 FreeBSD

Microsoft Azure 宣佈支援 FreeBSD：「Microsoft has created its own FreeBSD image. Repeat. Microsoft has created its own FreeBSD image」，Microsoft 的正式公告在這：「FreeBSD now available in Azure Marketplace」。

Microsoft 所作的 patch 都有進 10.3-RELEASE 裡，主要是對於 Hyper-V 虛擬化後的效能補強：

The majority of the investments we make at the kernel level to enable network and storage performance were up-streamed into the FreeBSD 10.3 release, so anyone who downloads a FreeBSD 10.3 image from the FreeBSD Foundation will get those investments from Microsoft built in to the OS.

像是 10Gbps 網路這部份就有明顯的改善：

For example, our measured networking throughput on a 10Gb network on FreeBSD 10.1 was 2Gbps. With 10.3, we’ve been able to achieve over 9Gbps in testing

不過我覺得宣傳意義比實質意義重一些...

Google 加倍對 Chromebook 訪客模式的攻擊獎金

Google 決定加倍對 Chromebook 訪客模式下攻陷系統的獎金：「After 0 successful submissions, Google doubles top reward for hacking a Chromebook to $100,000」。

原先是五萬美金：

Last year, Google introduced a $50,000 reward for the persistent compromise of a Chromebook in guest mode. The company’s security team says it hasn’t received a single successful submission.

提升到十萬美金：

As such, Google has doubled the bounty, which was already the top Chrome reward, to $100,000. The company really wants someone to hack Chrome OS to pieces. “That said, great research deserves great awards, so we’re putting up a standing six-figure sum, available all year round with no quotas and no maximum reward pool,” Google declared.