oss-sec mailing list archives
Re: Re: [FD] Google Chrome Address Spoofing (Request For Comment)
From: anidear <anidear1 () gmail com>
Date: Fri, 3 Jul 2015 12:37:23 +0700
I played around with the code to see if can change it to avoid using the fork bomb. Here's what I came up with https://gist.github.com/ptantiku/d37c364cd13bb31a1ee6 It seems to need at least 500 threads to update the URL at 5ms for this to work (tested on Chrome x64 43.0.2357.130, Linux, locally). And the first setInterval() can be substituted for setTimeout(...,10) which will run only once for waiting the pop-up window to open. Although the browser is not crashed, the window is still unresponsive to allow user to interact with it. Wondering if there is a way to fix that. Cheers, PT On Thu, Jul 2, 2015 at 8:33 PM, Mustafa Al-Bassam <mus () musalbas com> wrote:
That's pretty neat. Played around with this and made a few discoveries. 1. It shows a valid certificate when you spoof HTTPS sites. That's really bad. POC/screenshot: https://github.com/musalbas/address-spoofing-poc 2. The page isn't responsive when using this flaw. That means you can't spoof a login box for example. (I tried.) 3. The success of the exploit seems to depend on if the browser can start loading content.html fast enough. I noticed that the exploit works 100% of the time when used locally. Perhaps a better version of the exploit would somehow preload content.html - for example by opening a window with an URL that starts with javascript: followed by a script to display the content? That, or perhaps reducing the interval time for trying to run next() after the popup is created. I wonder if this works on any other browsers? MustafaOn 30 Jun 2015 7:08 am, David Leo <david.leo () deusen co uk> wrote:Impact: The "click to verify" thing is completely broken... Anyone can be "BBB Accredited Business" etc. You can make whitehouse.gov display "We love Islamic State" :-) Note: No user interaction on the fake page. Code: ***** index.html <script> function next() { w.location.replace('http://www.oracle.com/index.html?'+n);n++; setTimeout("next();",15); setTimeout("next();",25); } function f() { w=window.open("content.html","_blank","width=500 height=500");i=setInterval("try{x=w.location.href;}catch(e){clearInterval(i);n=0;next();}",5);} </script> <a href="#" onclick="f()">Go</a><br> ***** content.html <b>This web page is NOT oracle.com</b> <script>location="http://www.oracle.com/index.html";</script> ***** It's online http://www.deusen.co.uk/items/gwhere.6128645971389012/ (The page says "June/16/2015" - it works as we tested today) Request For Comment: We reported this to Google. They reproduced, and say It's DoS which doesn't matter. We think it's very strange, since the browser does not crash(not DoS), and the threat is obvious. What's your opinion? Kind Regards, PS We love clever tricks. We love this: http://dieyu.org/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Re: [FD] Google Chrome Address Spoofing (Request For Comment) Roney Gomes (Jul 01)
- <Possible follow-ups>
- Re: [FD] Google Chrome Address Spoofing (Request For Comment) Mustafa Al-Bassam (Jul 02)
- Re: [FD] Google Chrome Address Spoofing (Request For Comment) Daniel Wood (Jul 02)
- Re: Re: [FD] Google Chrome Address Spoofing (Request For Comment) anidear (Jul 02)