Untitled attachment

Notices where this attachment appears

1. Joanna Rootkovska ☠️ (rootkovska@mastodon.social)'s status on Thursday, 13-Apr-2017 15:05:22 UTC Joanna Rootkovska ☠️

   About the Subgraph attack:
   1. The main problem that @micahflee exploited is the unfortunate decision made by Subgraph OS to keep Gnome/Nautilus in the TCB *and* letting this complex software process *untrusted* files,
   2. The specific Nautilus bug (handling of .desktop files) is just *one* example of what could go wrong in this case,
   3. We can think of other potential problems (e.g. Thumbnails processing)
   4. More details: https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/

2. Micah Lee (micahflee@mastodon.social)'s status on Tuesday, 11-Apr-2017 17:01:06 UTC Micah Lee

   I've published a technical explanation of how to get unsandboxed arbitrary code execution in Subgraph OS, and how this attack compares with Qubes https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/ cc @rootkovska