A form of Mandatory Access Control (Apparmor, SELinux, RBAC, Tomoyo) would help limit the damage this exploit could do (in terms of what data it could read, delete, encrypt, etc). Its not a root level exploit, though I imagine it could be used to profile certain aspects of the system that could aid someone with a toolbox of zero days (even a simple ls -a of /home/username could inform you of some programs installed you might have exploits for, etc). I wonder too what firejail would have made of this exploit? I'll have to research this because I'm fairly weak in the more specific aspects of these exploits. Personally I think its good these things are coming to light- I've seen way too much "I run Linux therefore I am safe period" arguments in the past (elsewhere- not here at Wilders so much). Technologies like grsecurity, firejail, pax, MAC, etc being implemented that try to handle entire classes of exploits rather than just patch found specific exploits I think are needed. And then there is Qubes- a dispVM would make this exploit useless unless someone managed to package it with a 0-day root level exploit, a 0-day Xen exploit, and then whatever they wished to do on dom0 (or any domain they can access using these exploits)- highly highly unlikely especially at this point, and given Xen's much smaller attack surface even than Virtualbox/KVM/Vmware/etc. Regardless of all this, real world damage by such attacks may now be demonstrably possible but still only hypothetical (for example, we havent seen these exploits used to implement wide-scale ransomware attacks on Linux systems).
It's just a vulnerability in a third-party library - think Flash. Essentially, if you were to find a malicious file through the browser and OPEN it, the exploit, whatever it is, would run. But this requires that you actually go to a page hosting Fedora/Ubuntu exploits and then open MP3 (and such) files from there. This is no different than any other similar plugin/codec/library problem. The mitigation is simple - chmod 000 the offending plugins/files until they are patched. But did any article mention anything productive? No. It's all about fear, fear, fear. Plus, the chances of you landing on a specially crafted file for Fedora/Ubuntu with the particular set of libraries is very low. Mrk
Mrk is right.... chances of being hacked are remote. As realistic as the fake news Russian hackers somehow changed all data on the fly in American election computers. Oh wait - those aren't connected to the Internet.
Downloaded Qubes to give it a try.................... totally out of my league! I couldn't even figure out how to get connected to the Internet! A bunch of cryptic commands and apps, I lasted about an hour before giving up and restoring an image lol!! I'll just stay with my Mint 18 running Whonix in Virtualbox for now.
Well, the root of the problem - like in the previous exploits found by Chris Evans - is that, by default, Google Chrome downloads files without asking the user for confirmation. That's an insane behavior! So the best advice is: Stop using Chrome. As I'm sure that most Chrome users won't follow this advice, the second best is what Chris, too, suggested: chrome://settings -> Show advanced settings -> Downloads -> Ask where to save each file before downloading. As for tracker, it seems that there are efforts to sandbox Gnome tracker as a reaction to Chris' findings. Note that there is also a Firejail profile for tracker, and you can also try to sandbox it with systemd. Or you can disable tracker - this is what I've done for Baloo in KDE for years. I don't miss it. Avoiding gestreamer is also an option but not always easy as many multimedia players still need it.
".......... In addition to qubes and TemplateVMs, there’s one special domain called “dom0,” which is where the Desktop Manager runs. This is where you log in to the system. Dom0 is more trusted than any other domain (including TemplateVMs and black-labeled qubes). If dom0 were ever compromised, it would be Game OverTM. (The entire system would effectively be compromised.) Due to its overarching importance, dom0 has no network connectivity and is used only for running the Window and Desktop Managers. Dom0 shouldn’t be used for anything else. In particular, you should never run user applications in dom0. (That’s what your qubes are for!).................." So, I just realized why I couldn't connect to the Internet lol!! Heading back for more reading.
F25 was only vulnerable with gstreamer1-plugins-bad-free-extras installed by the user since it doesn't come installed by default the way the rest of the gstreamer plugins now do. I always run through the Chrome settings after installing it, that's not rocket science but there is no defending Google for not enabling more secure settings by default though. It's idiotic that they don't do that. I remove tracker. Firefox just patched a 0-day a week or two ago, one that was already actively being used in the wild. It's not like they are immune.
Of course not. What I said was that it is a crazy design decision by the Chrome developers which, btw., also affects Windows users.
