Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Race conditions in security dialogs
From: Jesse Ruderman <jruderman () hmc edu>
Date: Wed, 07 Jul 2004 01:39:33 -0500

I discovered arbitrary code execution holes in Mozilla, Internet Explorer, and Opera that involve human reaction time. One version of the attack works like this: the page contains a captcha displaying the word "only" and asks you to type the word to verify that you are a human. As soon as you type 'n', the site attempts to install software, resulting in a security dialog with "Yes" and "No" buttons. When you type 'y' at the end of the word, you trigger the 'Yes' button in the dialog. [Demo 1 below]

Another form of the attack involves convincing the user to double-click a certain spot on the screen. This spot happens to be the location where the 'Yes' button will appear. The first click triggers the dialog; the second click lands on the 'Yes' button. [Demo 2 below]

These types of attack work on any security dialog that can be triggered by untrusted content. The attack is most useful in a dialog where one of the buttons means "Yes, let this untrusted content run arbitrary code". Firefox has such a dialog in the form of the extension installation (XPI) dialog. Similarly, Internet Explorer has the ActiveX installation dialog and Opera has an "Open" button for downloaded executables. Programs other than browsers might also be vulnerable.

Mozilla's solution, from bug 162020, is to delay enabling the "Yes"/"Install" buttons until three seconds after the dialog appears. This works, but it's frustrating for users who install extensions often.

Another possible fix in web browsers is to treat all software installation requests like unrequested pop-ups. When a site tries to install software, a status bar icon would appear, and only clicking that icon would activate the security dialog. Rumor has it that IE in WinXP SP2 does something like this under some(?) circumstances.

The demos require Mozilla or Firefox and require that you go to about:config and change signed.applets.codebase_principal_support to true. You have to change this pref because I'm too lazy to make a demo using XPI (Mozilla), signed ActiveX (IE), or executable file download (Opera).

Demo 1 (captcha): http://bugzilla.mozilla.org/show_bug.cgi?id=162020#c25

Demo 2 (double-click): http://bugzilla.mozilla.org/show_bug.cgi?id=162020#c1

Jesse Ruderman
Mozilla project volunteer

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
  • Race conditions in security dialogs Jesse Ruderman (Jul 07)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]