Watch your Downloads: the risk of the "auto-download" feature on Microsoft Edge and Google Chrome

[Haifei Li <haifei-non-reply () outlook com>]

This is a copied version of my blog post, original version 
http://justhaifei1.blogspot.com/2015/10/watch-your-downloads-risk-of-auto.html.Probably it's commonly known that when 
you try to download something on your modern browser e.g. Google Chrome or Microsoft Edge, the file will be downloaded 
automatically to your local system with just a simple clicking - no need for additional confirmations. With default 
settings, the file will be downloaded to your "Downloads" folder ("C:\Users\<username>\Downloads").
Personally, I have worried about this feature quite some times, now I finally got some time on highlighting this. 
(Please tell me if there's someone already talked about this, I quickly googled around and wasn’t able to find an 
appropriate one, I think it should be known by many ppl).

The "auto-download" feature is good from “user experience” perspective, but obviously it's not good for security, as 
the downloading could also be started by Javascript (<iframe src="url">). The attacker may just place a malicious DLL 
with a specific name into the "Downloads" folder when the victim visits a webpage he/she controls. In future, when the 
victim tries to download/install good programs (executables) from legitimate websites - of course, the good executable 
will be downloaded, and will be launched from the "Downloads" folder as well - then the installation/execution progress 
could be hijacked.

This is because that in the real world, most executables replying dlls. Anyway, the "application directory" is the very 
first place in the search order when searching/loading for a dll (yoy may want to check this paper I released years 
ago). So, probably, most of dlls even the system dlls could be hijacked when you place a same-named dll in the 
executable’s directory, and that's not for the situation that the searching dll is not in anywhere of your system.

Usually, the "Downloads" folder is a place with massive downloaded files, so the victim probably never get a change to 
realize there is a malicious DLL sitting in his/her "Downloads" folder. I’d also doubt that even a normal user notices 
a strange dll in his/her "Downloads" folder, does he/she will really delete it immediately? DLLs won’t be executed by 
themselves anyway, right?

Anyway, in the real world, for most people, who really check their "Downloads" folder every time when they try to 
install something from internet? Instead, most people just click the "Run" button directly when installing something 
(see following figure).




I have quickly made a video showing this risk. The test environment is Windows 10 Pro, with Microsoft Edge and Google 
Chrome, fully updated as of Oct 2nd, 2015, all with default settings. Check it out here.


As you may have noted, a modified “VERSION.DLL” will be dropped into the “Downloads” folder when visiting the webpage 
https://dl.dropboxusercontent.com/u/14747595/auto_download_test/test.html. Then, when the user tries to install Adobe 
Reader from the official adobe.com website, the installation process of Adobe Reader will be hijacked - the modified 
“VERSION.DLL” will be loaded and my shellcode will be executed.

There’s one small thing, the code execution should be run out of the browser sandbox, but unluckily the tested 
shellcode I copied from internet runs calc.exe, and because there’s no calc.exe anymore on Windows 10, what you’ve seen 
it’s just a Calculator App which runs within the App Container sandbox. Other shellcode, for example, running 
notepad.exe, will be run out of the App Container sandbox and give the attacker control of your system. 
#BringTheLovelyCalcBackMicrosoft!

Also note that with default setting, the Microsoft Edge will promote a warning dialog saying the DLL is dangerous, 
offering the user an option to delete the file.




But:
1) Anyway, the DLL has been already dropped into the "Downloads" folder, if the user chooses not to delete the file or 
just do nothing, future execution will still be hijacked.2) I also guess this Microsoft Edge warning could be bypassed 
if the DLL is a signed DLL, but I don't have a certificate to test.
On Google Chrome, as you have seen, there's no warning at all.
Thanks,Haifei

                                          

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/