Cookiejacking: 0-day exploit of all Internet Explorer versions

http://sites.google.com/site/tentacoloviola/cookiejacking

by jpadvo • 15 years ago

171 29 15 years ago

sites.google.com

tptacek6• 15 years ago

I mean, this is clever and all, but what am I missing? Isn't this just an IE bug? That you can access cookie files as IFRAME targets? Is there some part of the IE architecture that depends on that functionality, or is Microsoft just going to patch that?

Because pretty much all the browsers, on a better-than-quarterly basis, fall victim to attacks that allow arbitrary web pages to upload code into their processes and run it.

Just not sure this needed the "attack class" name.

daeken3• 15 years ago

Agreed. This is a one-off bug and certainly not something warranting its own term, since we're unlikely to ever see something quite like this again. Definitely a clever attack, though.

nbpoole3• 15 years ago

Agreed. This IE bug does seem to have some interesting behavior though:

https://twitter.com/#!/superevr/status/73920079921815552

jcr3• 15 years ago

> Because pretty much all the browsers, on a better-than-quarterly basis, fall victim to attacks that allow arbitrary web pages to upload code into their processes and run it.

> Just not sure this needed the "attack class" name.

You are being too generous.

By default, all web browsers ALLOW execution of ALL code encountered since all browsers ship with javascript enabled. Similarly, allowing hidden and/or transparent elements ENABLES clickjacking by default.

In other words, the fundamental design is flawed, and it remains flawed because of vested interests. Most argue the risks are worth the rewards, and anyone who disagrees is promptly told that their tin foil hat is on so tight that it's cutting off their circulation.

Seriously, do you really want to be the person who advocates removing all javascript and hidden/transparent elements?

We both know what would happen to said person.

EDIT: Getting down-voted for just stating the underlying problem on HN doesn't bode well for HN as a community.

daeken3• 15 years ago

> By default, all web browsers ALLOW execution of ALL code encountered since all browsers ship with javascript enabled. Similarly, allowing hidden and/or transparent elements ENABLES clickjacking by default.

Woah, woah, woah. There's such a huge difference between "they can run Javascript and maybe consume some CPU time" and "they can run native code and completely own my machine" that I don't even know where to begin. If you could do "eip = shellcode.ptr;" in Javascript, maybe this would be a logical argument, but really there's just a massive, massive difference here.

cppsnob• 15 years ago

Can someone describe the white hat credo with respect to 0 day exploits?

Did he give Microsoft a head's up about these and a chance to respond before going public? Or does he just give a conference talk and post it to his blog, potentially providing the information allowing thousands of browsers to get compromised (assuming they weren't already) before privately letting Microsoft get a chance to patch it?

Skalman• 15 years ago

I don't know, but Microsoft doesn't care anyway (or so they say), according to http://www.computerworld.com/s/article/9217116/Microsoft_dow... .

But I do hope that he told Microsoft before the world.

trotsky2• 15 years ago

Novel approach, but I'm curious how many networks let 445 smb over tcp out? Enterprise networks sure shouldn't, my office doesn't, my house doesn't though admittedly most people won't be configured this way. But don't big carriers like comcast also filter common microsoft ports like this and 139 because of worm and exploit activity?

tptacek6• 15 years ago

You only need the SMB connection to grab the username, right? That seems straightforwardly guessable.

Apropos little: UNC path filtering is something the Rails generation of webdevs have a bad habit over overlooking.

trotsky2• 15 years ago

Yeah, only the username. Still, that seems like a pretty hard thing to blind guess at in most attack scenarios if you can't get it through the cifs connect. My reading is that you couldn't brute force it, you'd have one chance to set up the iframe with the cookie file in it which needs the username, or at least just one chance per clickjacked drag action that the user executes for you.

If it's a targeted attack I suppose you have a better shot, are most home windows user names set to the user's full name like "John Doe"?

dopechemical• 15 years ago

If this attack involves "simply sniffing TCP 445" why not just MITM the whole session?

The state of security is becoming an over-hyped sideshow of late where the most trivial attacks, which would work maybe 1% of the time in the wild, are getting mass exposure.

I have a 0day in RHEL 5, you simply need to log onto the machine as root and run this script...

nbpoole3• 15 years ago

"If this attack involves "simply sniffing TCP 445" why not just MITM the whole session?"

Because it doesn't. The attack involves using a bug in IE (an iframe will render cookie data from the local computer) with clickjacking to steal cookie information. Sniffing on port 445 is only mentioned in the context of figuring out the username of your target (by causing the target to connect to your SMB server, running on port 445).

I'd suggest you go back and re-read the whole page before making sweeping generalizations.

est• 15 years ago

> If this attack involves "simply sniffing TCP 445" why not just MITM the whole session?

Hmm, because port 445 is not port 443?

pluies_public• 15 years ago

Apparently that page has been shut down by Google?

"This site has been disabled for violations of our Terms of Service. If you feel this disabling was in error, please fill out our appeal form."

sharjeel• 15 years ago

Any mirrors?

pinko• 15 years ago

http://www.lo0.ro/2011/cookiejacking-stealing-cookies-with-i...

Cookiejacking: 0-day exploit of all Internet Explorer versions

Related Stories