mailing list archives
Race conditions in security dialogs
From: Jesse Ruderman <jruderman () hmc edu>
Date: Wed, 07 Jul 2004 01:39:33 -0500
I discovered arbitrary code execution holes in Mozilla, Internet
Explorer, and Opera that involve human reaction time. One version of the
attack works like this: the page contains a captcha displaying the word
"only" and asks you to type the word to verify that you are a human. As
soon as you type 'n', the site attempts to install software, resulting
in a security dialog with "Yes" and "No" buttons. When you type 'y' at
the end of the word, you trigger the 'Yes' button in the dialog. [Demo 1
Another form of the attack involves convincing the user to double-click
a certain spot on the screen. This spot happens to be the location where
the 'Yes' button will appear. The first click triggers the dialog; the
second click lands on the 'Yes' button. [Demo 2 below]
These types of attack work on any security dialog that can be triggered
by untrusted content. The attack is most useful in a dialog where one of
the buttons means "Yes, let this untrusted content run arbitrary code".
Firefox has such a dialog in the form of the extension installation
(XPI) dialog. Similarly, Internet Explorer has the ActiveX installation
dialog and Opera has an "Open" button for downloaded executables.
Programs other than browsers might also be vulnerable.
Mozilla's solution, from bug 162020, is to delay enabling the
"Yes"/"Install" buttons until three seconds after the dialog appears.
This works, but it's frustrating for users who install extensions often.
Another possible fix in web browsers is to treat all software
installation requests like unrequested pop-ups. When a site tries to
install software, a status bar icon would appear, and only clicking that
icon would activate the security dialog. Rumor has it that IE in WinXP
SP2 does something like this under some(?) circumstances.
The demos require Mozilla or Firefox and require that you go to
about:config and change
signed.applets.codebase_principal_support to true. You have to change
this pref because I'm too lazy to make a demo using XPI (Mozilla),
signed ActiveX (IE), or executable file download (Opera).
Demo 1 (captcha): http://bugzilla.mozilla.org/show_bug.cgi?id=162020#c25
Demo 2 (double-click): http://bugzilla.mozilla.org/show_bug.cgi?id=162020#c1
Mozilla project volunteer
Full-Disclosure - We believe in it.
- Race conditions in security dialogs Jesse Ruderman (Jul 07)