u/trustsigRobert

As per WABT's SECURITY.txt, #2831 issue exists

For context:

WABT is a Binary Toolkit for WebAssembly developed by WebAssembly.org (W3C)

wasm2c is a tool inside of it, which is used by many projects like FireFox (via RLBox) to compile wasm down to a sandboxed c library, the assumption is the built C code preserves all WebAssembly's sandbox security features.

This PoC demonstrates escaping that sandbox.

As per WABT's SECURITY.txt, #2831 issue exists

For context:

WABT is a Binary Toolkit for WebAssembly developed by WebAssembly.org (W3C)

wasm2c is a tool inside of it, which is used by many projects like FireFox (via RLBox) to compile wasm down to a sandboxed c library, the assumption is the built C code preserves all WebAssembly's sandbox security features.

This PoC demostrates escaping that sandbox.

https://preview.redd.it/h9kc8me346jh1.png?width=2550&format=png&auto=webp&s=0d5441b056f0b55e9eb88589ca43be7885a8fa02

The blog post itself shows a real demo too which detects the Mimic engine.

https://trustsig.eu/blog/multilogin-mimic-canvas-webgl-masking/

https://preview.redd.it/pmvp48q946jh1.png?width=1280&format=png&auto=webp&s=3e5164b99479a072e8b5067f89554fa489e9f423

(we are a anti-bot SaaS provider, with free and paid tiers)

We have noticed a lot of posts about your SaaS getting hit by massive bot signups after launch, and it also makes sense you dont want the user to see some extra box they have to tick or even worse, a challenge they have to solve.

On top of that, majority of captcha providers (*cough cough* google recaptcha recent change), collect a ton of data about the user and track them everywhere they go, no privacy whatsoever. And thats actually what sparked us to start (and very recently launch) our privacy focused, invisible anti-bot SaaS.

There is a very generous free tier (5x larger than google's) that you can try out and see for yourselves that it is in fact more effective then recaptcha.

If you do need a higher limit, feel free to reach out to us and we will be happy to give you a few months free! Or you can use the free trials.

https://trustsig.eu