Slashdot Mirror
Firefox, Opera Allow Phishing By Data URI Claims New Paper
hypnosec writes "A student at the University of Oslo, Norway has claimed that Phishing attacks can be carried out through the use of URI and users of Firefox and Opera are vulnerable to such attacks. Malicious web pages can be stored into data URIs (Uniform Resource Identifiers) whereby an entire webpage's code can be stuffed into a string, which if clicked on will instruct the browser to unpack the payload and present it to the user in form of a page. This is where the whole thing gets a bit dangerous. In his paper, Phishing by data URI [PDF], Henning Klevjer has claimed that through his method he was able to successfully load the pages on Firefox and Opera. The method however failed on Google Chrome and Internet Explorer."
I'm not surprised to see IE ranking well. It has grown to be one of the most secure browsers ever made. Only Chrome has something like IE. Internet Explorer has sandboxing and JIT hardening and all these things while Firefox and Opera have hardly anything (Firefox is actually the worst in this regard).
I reported a bug in IE4, where I could basically make a URL:
About://HTML
and the HTML was replaced with whatever I wanted.
It took a couple versions but apparently they fixed it.
In other words, IE and Chrome do not implement the data URI to the specification.
Lucky them, they can pose now as "more secure".
Questions raise, answers kill. Raise questions to stay alive.
How do these malicious URIs get access to the underlying Operating System?
AccountKiller
I really wonder about the quality of new papers. There is no new attack vector. It is still phishing. It doesn't matter if the page is loaded from the phishing mail or from another server. I think it is harder to spot a typo in the domain than spotting the data line address.
Also it doesn't matter how you load the phishing website. If you clicked the link in the mail you are either curious to investigate or deserve to fall for it.
Testing if I can embed
Can anyone explain to me why this is worse than serving up the same "malware" on a web page instead of a data URL? The screenshot in the paper clearly shows the url starting "data:text/hml;" instead of http://en.wikipedia.org/ so surely it is just doing the same thing as if I hosted a mock wikipedia login on "mysite.com" - and is a lot less likely to fool people than if I used a domain like wikipediaLogin.com
This might technically be a phishing exploit but you would have to be pretty stupid to fall for it still as the address bar at the top of the page would not be your banks a web address.
I dont read
So I click on a link and a page loads, as expected. What happens then? How does that page compromise my browser?
I'm not surprised to see IE ranking well.
I have a piece of shit in my toilet bowl that ranks just as well in this case. It too is incapable of opening data URLs
Caveats:
1) Chrome doesn't seem to work with base64 encoding in the data URI scheme.
2) Chrome appears to have a length limit for page data. I was able to get about 11502 characters of URI encoded text rendered. That works out to 7717 characters of HTML in my test case.
Because those are sooo short !!
I'll take what's behind door #2, Monty !!
Open the url in Chrome. Fails.
Now do Refresh. Voila!
So if someone can embed a refresh, haha.
I actually went and read the paper that this is supposedly all based on. (I know, it's not the done thing and I apologise) I don't know if it has changed since the other article was written but I couldn't find any reference to Opera or Firefox.
It does mention that Chrome will throw an error but if you hit enter or reload it will work. There is a one sentence reference to the fact that IE has "a limit to URIs". I presume that means a length limit and if so IE is not invulnerable - only the initial payload has to be smaller.
While there is much hand wringing about the fact that it cannot be shut down because there is not central server it is hosted on I don't see it as an issue. For phishing to be effective the stolen data has to actually GO somewhere which probably provides a target that can be shut down. It doesn't matter how long the URI circulates after the target is shut down - all that stolen data is probably going to the great byte bucket in the sky.
I think the more interesting point that the paper made is that phishing sites can effectively be hosted on link shortening services using this method.
... in an alert box of it's own:
javascript: and data: URIs typed or pasted in the address bar are disabled to prevent social engineering attacks.
Developers can enable them for testing purposes by toggling the "noscript.allowURLBarJS" preference.
Browsing the Web w/o NoScript is dangerous to the core anyway.
Just my 2cents
- Holger
You click on a link and it displays the inlined HTML in a browser, exactly as the specification demands. The address bar shows a URL that starts with "data:" instead of "http:" and looks nothing like the URL of the spoofed site. What makes this a vulnerability?
Does it also bend spoons?
If you nest your languages, you can do a remarkable amount in a data URI: here's a Javascript chess-playing app, and an unbounded supply of webpages exploring the Collatz Graph, respectively. I expect you could get a small phishing site (which pulled graphics, etc, from the real thing) done similarly, and there's no server to take down. Writing a viral data URI that mailed itself to your friends might be harder.
Well played Anonymous Coward.
This changes everything
Here's an online Base64 decoder for those unwilling to click the link
http://www.motobit.com/util/base64-decoder-encoder.asp
Don't forget to set it for "decode"
[Fuck Beta]
o0t!
Well, the paper actually says:
Internet Explorer has a limit to data URIs,
(it does not even end the sentence).
whereas he broadly explains that
In Google Chrome in particular, a control for unsafe redirection is implemented, [...]
That probably means, that the version of IE he used just had a size limit for data URIs, instead of having some "real" security feature implemented.
Therefore he presumably tested his data URI with IE 8, not with IE9.
The appropriate url is displayed, data URIs serve a purpose. OP, this is ridiculous. Quit giving this guy a voice.
Where genius and insanity become confused true wisdom is found
America has been preparing for this for a long time now... security through obesity.
As the author of the paper I feel the need to clarify a tiny point before I fall asleep. Google Chrome is vulnerable, it is only REDIRECTION TO A DATA URI that Chrome sees dangerous and denies. For more details, please contact me on Twitter (@hennikl) or by email (it's in the paper title). I'll try to watch this thread and give more exhaustive answers after some hours of beauty sleep. It seems a lot of the commenters do not grasp the idea completely ;) --Henning Klevjer
As the author of the cited paper, I feel that I have to clarify a few issues here: As well as Opera and Firefox, GOOGLE CHROME ALSO "suffers" from the ability to host data URIs. It just distrusts being redirected to one. IE (it is said) has a size limit to data URIs of 32 KB. However, in my tests, a ~26 KB URI was tried, unsuccessfully. The data URI phishing pages can be made in many ways, differing in how they use other data. One can make a true offline (or local) version of a web page if all linked content on the page is contained in the "root page" through yet another data URI. If the data URI web pages are presented on a computer running a related trojan program, this program may handle the communication of the "secret information" (credit card #, passwords, etc.). This can be done P2P (as in botnets) thus no need for server infrastructure. Another issue I'm discussing in my paper (http://klevjers.com/papers/phishing.pdf) is that of ownership to the data URI contents. I feel TinyURL unwittingly takes ownership of whatever content that is hosted there, as they store the entire (phishing) web page on their servers.
File this one under uninteresting and an obvious forgery.
Technically this is not much different than just hosting a look-alike page to collect passwords. The phishing attack would be much more interesting if the URL wasn't so obviously bogus. According to the paper an attack could use a URL shortener to further hid the obviously odd URI. The problem with this is that the URI attack described in the article requires that you send the URI with payload to the victim. A URL shortener service has no reasonable way to direct the short URL to the crafted URI.
Ironically, using a shortened URL (tinyurl, bit.ly goo.gl etc) would make it easy to hide a real phishing site hosted out on the Internet. To say that this is a security hole is to say that because all browsers allow people to go to sites that can claim to be who they are not all browsers are insecure.
-rd
So "researcher reveals how a link *itself* can be malicious"?
Really?
And this guy writes about this, and couldn't be bothered to take 5 minutes to put a working clickable example-link online somewhere?
Its the usual "Hackers can write a virus that makes your computer explode!!!!"-BS