I discovered a browser bug

https://jakearchibald.com/2018/i-discovered-a-browser-bug/

by cgtyoder • 8 years ago

574 129 8 years ago

obl2• 8 years ago

It's quite incredible how the web managed to get along with such a janky sandbox model.

It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger.

Eroding this trust would ruin it for everyone, even well behaved static websites without javascript.

Maybe it's time to reconsider giving the same execution rights to gmail and unknown web pages ?

simion3142• 8 years ago

I use a private window for banking/paypal , I don't trust the extensions or the other tabs so for this cases I get more security.

felix_nagaand• 8 years ago

That hardly helps. For true security devote a device purely to banking. Preferably a diskless device running an updated live CD on a security oriented distro with no rewritable storage attached connecting out over a VPN through an equally dedicated firewalled router. Then you're just left to worry about your bioses getting infected off an unpatched or 0d exploit.

tzahola• 8 years ago

Sorry, but we need a Turing-complete language for ads and tracking.

Preferably with JITting, and unfettered access to the GPU and other misc. peripherals like GPS, webcam, etc. In return you get free cat videos.

You’re welcome.

kevin_thibedeau• 8 years ago

No. The server just needs to send over an image and log the IP of the requestor for reconciliation at the end of the month.

datenwolf• 8 years ago

…and with unfettered access to USB devices. WebUSB my ass.

WorkLifeBalance• 8 years ago

Do you want to reinforce established monopolies? Because I can't think of a better way of doing that than having a technical difference between "trusted" and "untrusted" sites.

yoz-y3• 8 years ago

What about differentiating applications and web sites? The line between the two is blurry, I know, but I would be happy if the document metaphor were divorced from the application one.

obl2• 8 years ago

Well, I personally would be fine with the fair policy of disabling js everywhere but I'm sure most would not agree, so what's the alternative ?

If anything, Spectre class attacks really showed how hard it is to properly sandbox arbitrary programs.

Yes, the CPUs are complex, but the attacks happen on a high conceptual level, level at which the CPU is fairly simple. It's not like they rely on an obscure detail or bug.

No one (publicly) figured those out for 2 decades when the involved ideas (speculation, cache timings) are well known, common and did not change.

This indicates that for something with such a large surface as the various web standards, where both the spec and the implementations are changing all the time, there is very little hope.

joshschreuder• 8 years ago

Aren't we sort of starting down that path already? IIRC Chrome only allows certain operations on HTTPS domains as of late such as webcam or microphone access.

It seems like this sort of iterative securing of different things over time could be a good way to secure the web while also giving time for older sites to upgrade.

makmanalp• 8 years ago

The web didn't used to be able to do much, and we're using browsers that depended on tons of multi-decade old code, so I see how it happened. Agreed on the main point though.

pjc50• 8 years ago

The key thing is differentiating one set of pages from another set of pages - putting security boundaries into a hypertext system that was originally designed to allow mixing resources from different sources.

Endy2• 8 years ago

No. The burden needs to be on the user to understand their own security. If we stopped taking the burden out of user's hands and tried to ensure that everyone on the Internet understood that anything they access becomes data on their computer/device, we'd have a smarter Internet. Frankly, I think if we made people understand that they have a responsibility to choose what they download, there might be more vocal group demanding the ability to do whatever they want with data transmitted to their computer, save for directly malicious acts against other users.

The browser should be only two things: a client between a user and a server, passing information; and a parser which displays that information on the client-side. The moment a browser alone begins controlling what the user sees, or does not see, without the user having the ability to control it, we have a major problem.

That becomes a security problem, a privacy problem, and a functionality problem. All data on the Internet should be treated the same by all browsers' client functions. The display may vary (e.g. the difference between Lynx and Firefox), but all data should be treated equally and the user should have both the authority and the responsibility for their own computer.

lucideer• 8 years ago

The moment a browser alone begins controlling what the user sees, or does not see, without the user having the ability to control it, we have a major problem.

What you're describing would be inordinately taxing for even the most experienced developer, not to mention the average internet user. The only way this could possibly be viable would be if we used gopher:// instead of http(s)://

Currently, there are tools such as Privoxy Actions & Filters, which allow you to do 100% of what you're describing, Greasemonkey which allows you to do ~80% of what you describe, or uMatrix which allow you to do quite a lot. The prerequisites for using those range from full-blown programming skill (for the former 2) to managing a relatively advanced in-browser UI (for uMatrix), and having a lot of spare time. For every single webpage you visit on the web. This isn't viable for 99% of people.

z3t4• 8 years ago

Some browsers allow you to have many profiles. So you can use one profile for banking and e-mail, and another profile when browsing dubious sites.

dannyw• 8 years ago

This was such a nasty bug for Edge. Visiting any page means I could now read your private Messenger messages, or your email. You could even automate resetting the password to an account, and then automatically exfiltrating the URL!

Avamander• 8 years ago

superlogout.com v2.0

acdha4• 8 years ago

The Microsoft experience reminded me of the time when security@apple.com went to the building security office, who just quietly deleted bug reports. Poor processes amd communication is one of the worst classes of security problem.

munin2• 8 years ago

Microsoft used to have a group, Trustworthy Computing (TWC), that was where all the security expertise lived. TWC was destroyed in 2014. From the outside, it seemed like that was the point where the reporter/outside security engagement story stopped, because the people that held responsibility for it Microsoft wide were either fired or re-orged into a role where they didn't have broad authority any more. Now, you get stuff like this, where people on the "security" group (which is squirreled away in a totally different part of Microsoft) don't have visibility into the Edge bug tracker any more.

Internally, Microsoft is organized a lot like the Federal government, only worse.

pbhjpbhj• 8 years ago

One can see a rationale in not having a security group - every team should have security focus (eg by having expertise & champions within each group). You can't tack on security, you have to build it in.

chrisfinazzo2• 8 years ago

product-security@apple.com is the real one these days.

Of course, this gets me thinking, what kind of super powers do these addresses have that allows people to send potentially malicious things there to be disassembled and analyzed? I suspect they are quarantined in some way, but it would be interesting to hear from the ops sec crowd how this gets handled.

acdha4• 8 years ago

Yes – I even got a nice email from someone apologizing about that and explaining that they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response.

hobs• 8 years ago

Often badly, I remember Tavis O crashing Symantec's email server when sending an exploit using standard username/password combos, it unzipped it and crashed itself.

https://twitter.com/RyPeck/status/732405198644228096

nitwit005• 8 years ago

Our IT people were apparently incapable of creating a way to receive emails which didn't flag zip or tar files as security threats and block it. We've had to sometimes ask people stick things in dropbox and share it with us that way.

We've had similar issues with people submitting code for remote interviews.

evfanknitram2• 8 years ago

Last time I reported a security issue to Microsoft I got reply same day and a confirmation that it was in fact an issue some day later. And then a few days later they notified me that my report was eligible for a bounty (I didn't have to ask).

This was the opposite experience of my previous report where the bug was acknowledged 9 months later and then fixed another 3 later.

I wonder if it just depends on whether your report ends up in a escalation path with lots of busy people.

Rodd455• 8 years ago

Wonder how much report they got this time and that taking them so long to response.

Promarged• 8 years ago

Oh, I guess the vulnerability needs an extremely tenuous name and logo right? Here goes

I admire the extra touch here :)

kawsper• 8 years ago

I enjoyed the WhatsApp-looking box that explained the server/client conversation.

_trampeltier• 8 years ago

The PDF was great too ;-)

_bxg1• 8 years ago

  For example, the request may have the following header:
  Range: bytes=50-100
  …which is requesting bytes 50-100 (inclusive) of the resource.

I haven't finished the article, but I've seen how this movie ends...

usermac• 8 years ago

First paragraph made me chuckle.

ariehkovler• 8 years ago

That's a really well-explained and clearly presented writeup of the bug and how it can be exploited as a vulnerability.

chrisfinazzo2• 8 years ago

Lol no.

That hurts, Jake :(

jaffathecake5• 8 years ago

bwhahahaha

MatthewPhillips3• 8 years ago

I can echo his experience reporting browser bugs and provide my own reviews:

Firefox - By far the best. Quick response, usually from engineers. If it's important the fix will be quick.

Edge - No reply for months / years. When I've gotten replies back it's been to ask me to try with the current version. When I do and the bug still exists it goes back at the bottom of the queue it seems.

Chrome - Somewhat of a mixed bag. Some times responses are quick, some times they are from engineers. But most often I get replies that convey the person I'm speaking too is a very green QA type. I've gotten replies that the test case I provided them doesn't reproduce the bug, because they had attempted loading it with the file:// protocol (of course hardly anything works with the file protocol). I'm not sure, do they expect me to include a web server for them?

Safari - Only tried a couple of times, never gotten a whisper back.

I would rate my experiences as:

Firefox - A+

Chrome - C

Edge - D

Safari - F

jaffathecake5• 8 years ago

Yeah that Chrome experience doesn't sound great. Fwiw I tend to put my test cases on jsbin or Glitch, but yeah, a Chrome engineer should know to put the page on a basic web server.

If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me.

MatthewPhillips3• 8 years ago

Like I said, my impression is that often the people replying are not engineers. Here's one with that problem: https://bugs.chromium.org/p/chromium/issues/detail?id=674096...

paulddraper• 8 years ago

I have an S3 bucket for mine.

E.g. a js closure memory leak:

https://bugs.chromium.org/p/chromium/issues/detail?id=315190

https://s3.amazonaws.com/chromebugs/memory.html

reitanqild6• 8 years ago

If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me.

Hi, and thanks for being part of creating Chrome && reaching out here.

Now that I have a Chrome guy here maybe you can help with another annoying issues:

-QC internally at Google seems to be blissfully unaware of the fact that other browsers exists.

Examples:

- one glaring issue I'm running into in core Angular on a daily basis.

- Google Calendar performance is sometimes unreasonably slow in Firefox

- For weeks or months Google search results would drive once CPU core to 100% twice a minute.

robotmlg• 8 years ago

Did you report the Safari bug to Apple or to WebKit.org? I've had good luck getting responses and fixes from the webkit guys

Rodd455• 8 years ago

They seem to get the things done professionally and effectively.

CryoLogic• 8 years ago

I reported a very serious one to Edge recently and the team told me they would "backlog it and might be on a future release".

Chrome had already patched it and Firefox never had it. (It was related to incorrect DOM spec implementation of document inheritance allowing cookie access from anywhere).

I'll do a full write up and blog it when I'm back from vacation but to summarize I was really unimpressed by the team at Edge and Microsoft Security.

driverdan• 8 years ago

Did you include a 90 day public disclosure window?

robocat• 8 years ago

Personally over many bug reports and many years:

A+ experience with the Chrome team

E with Edge

F with Safari

The Chrome devs have been astonishingly good. My experience has repeatably been that if they are given a good bug report, they get it fixed and often fix it really fast. Or they reply with excellent technical reasons why not. Also multiple times I have seen extreme corner-case regressions get magically fixed without me reporting anything!

Edge - always waffle and misdirection in reply to bug reports. I only bother to give them very well documented, repeatable bugs, plus attached repro file, for things I really need fixed. However: I did have one good experience recently because I reported the bug for the Edge beta, on a feature they were actively working on catching up to the other browsers (however they still had poor interaction).

Safari: hopeless. Report a critical bug with excellent repro file, and get no response, and no fix.

No rating for Firefox because I haven't bothered reported any bugs to them in the last few years.

Edit: this is for non-security related bugs.

odbol• 8 years ago

Apple hears ya, Apple don't care.

ikeboy• 8 years ago

I once reported a chrome issue. Got no attention until I found a different issue I thought was related and commented there, which got the attention of someone competent who realized it was a hardware bug they'd fixed before but had a regression.

Not a security bug, just that a very large number of websites didn't load.

userbinator• 8 years ago

In other words, the experience gets progressively worse the bigger the company. I'm not surprised, having worked in companies of that scale the amount of bureaucracy and general red-tape to do the smallest of things is absolutely irritating.

mito882• 8 years ago

and Samsung's browser?

zegl• 8 years ago

Microsoft claims to be developer friendly these days, but they are clearly not white-hat friendly.

evfanknitram2• 8 years ago

My entirely anecdotal experience is that they are white-hat friendly some time. My last experience was super good.

zamalek• 8 years ago

I think it depends on the team.

notveryrational• 8 years ago

This is really nice research! Simple, effective, and brutal.

This reminds me of the research that went into finding issues in the media plugin models. Essentially, once the security community discovered that Java and Flash, etc, plugins didn't follow the same rules as the browser at all times - it became a free bug hunting exercise until the media plugin model just died.

I expect there are some "side channel" type ways to create high resolution timers in browsers which have removed built in support for them, for instance: WebAssembly? WebGL subroutines?

Anyway, congratulations.

frandroid• 8 years ago

Is it Tuesday?

con22• 8 years ago

hn bet big money on firefox/mozilla? all news for other web browser is bad except firefox. HN now is mozilla's Microphone

dang• 8 years ago

HN doesn't bet any money on anything. Please don't post unsubstantive comments here.

andrewmcwatters• 8 years ago

I, too, discovered a browser bug. Specifically with mutation observers in Safari (but not Chrome, or other WebKit-likes) in a particular DOM event scenario. Fully replicable. Not a word from any team at Apple, no acknowledgement of the bug, no acknowledgment of the issue.

The situation is a common one wrt SPAs, routing, and changing a tree based on history state. I'm sure other frameworks have run into it. My brief experience documenting the issue solidified the position that I will never do it again.

jlg23• 8 years ago

This just happened to be two anecdotes with 2 browser dev teams that should not be generalized.

Everyone who has to deal with n-th layer tech support regularly (where n > 2) knows that even there it's hit or miss. Sometimes you file a bug report and get a "thanks, fixed!" an hour later. Sometimes you spend an hour to gather all the data upfront only to be painstakingly taken through the exact same data gathering process step by step. By email. Over days. On a "4h response" SLA (and they always just barely make it, not considering the value of the "response").

Randall Munroe has the best description: https://www.xkcd.com/806/

djhworld• 8 years ago

I'm not familiar with the Web Audio APIs, was the Edge bug effectively interpreting the stream of bytes from the cross origin request as an 'audio stream', and then the OP just wrote a thing to convert it back so it could be converted into a string?

masklinn2• 8 years ago

A stream of bytes is valid PCM (that's the point). The issue is that Edge would first allow a redirect to a cross-origin then would leak the entirety of the cross-origin data by allowing it through the Web Audio API — an API for low-level audio processing and synthesizing — ultimately allowing the attacker to retrieve the cross-origin resource.

westmeal• 8 years ago

Nice one!

hnruss• 8 years ago

I've found a couple of browser bugs in different browsers (but nothing security-related). Nothing I've reported to browser teams has ever been fixed, even with simple standalone test cases. It's definitely easier just to write a workaround and call it good.

amelius• 8 years ago

Another symptom of browser specs getting too complicated.

jaffathecake5• 8 years ago

In this case it was a symptom of them being too simple. The use of range requests wasn't specified.

mito882• 8 years ago

tip of the iceberg?

I discovered a browser bug

Related Stories