Post Message Vulnerabilities in Chrome By Alfred Zhong, Trevor - - PowerPoint PPT Presentation

Post Message Vulnerabilities in Chrome

By Alfred Zhong, Trevor Hornung

Why use extensions?

Extensions extend the functionality of the web browser. They usually serve a single purpose that is narrowly defined and easy to understand. Some of the more popular extensions, such as Ad Blockers, have 500+ million downloads.

Same Origin Policy

• Web page can access data belonging to a second web page if they both

belong to the same “origin”

• All fields must match to be considered the same origin

○ URI Scheme ○ Hostname ○ Port number

PostMessage Mechanism

• PostMessage relaxes the constraints of the same origin policy by allowing

scripts from different origins to communicate.

• This is usually secure if done properly.
• PostMessage is used in both webpages and extensions

Origin Checks

• Allows a script to communicate with other scripts with a specified origin.

The script ignores postMessages which do not pass the origin check.

• Hard to spoof an origin
• Security vulnerability if there is an insecure origin check

Breaking Origin Checks

• Examples from “The Postman Always Rings Twice” by Son and Shmatikov

Possible Consequences

• Arbitrary messages could be sent to the extension

○ The extension could be disabled or altered ○ Any data the extension has could be stolen ○ Anything the extension has permission to do could be done

Attack Scenario - (Toy Exploit)

• Imagine you have an extension installed which has permission to look

through your web browsing history. The extension also, for some reason, sends this history data to its parent website through a postMessage mechanism.

• That postMessage has a vulnerable origin check.
• A malicious website can steal the user’s history!

Collecting Extensions

• Each Chrome extension has a unique ID
• Unfortunately, Google does not provide

a master list of extension IDs.

• We had to write an extension which

scrapes the ID information as we manually scrolled through the Chrome Web Store.

• (Probably would have been better to

automate this through Selenium)

• 7290 extensions collected

Finding Origin Checks

• Find “addEventListener” call that is being used for messages
• Find an origin check
• Optionally: Find “postMessage” calls sending data out of the extension

How many extensions are potentially vulnerable?

String No successive postMessage send With a successive postMessage send .origin 669 30 .origin.indexOf 33 2 .origin.includes 2 .origin.match 16 1

Exploit in the Wild

https://chrome.google.com/webstore/detail/fair-adblocker/lgblnfidahcdcjddiepkckcfdhpknnjh

Exploit in the Wild - Origin Check

if(!event.origin.match(/^http(s)?:\/\/(.*\.)?(localhost|lgblnfidahcdcjddiepkckcfdhpknnjh|lngjmaohjfjl mbggeodkgpokfbdemejg|standsapp.org|stndz.com)(:\d*)?/i)) return; Example origins that bypass this check:

• http://espn.nfl.standsapp.org
• http://espn.nfl.localhost.com
• http://XXXXXXXXX.localhost.com
• http://XXXXXXXXX.localhost.XXXXXXXXX.com
• http://espn.nfl.standsapp.org.XXXXXXXX.XXXXXXXXX.com
• https://cs.utexas.localhost.edu
• https://cs.utexas-idcheck.lgblnfidahcdcjddiepkckcfdhpknnjh.edu

Exploit in the Wild

This code is available after the origin check bypass. It sends back the user’s name and email address if it is set in the extension.

Exploit in the Wild

This code is also available after the origin check bypass. It sends information including the “active tab” of the user. If the user keeps our malicious website

• pen in the background, we can get a trace of what websites our user visits,

potentially allowing for fingerprinting as well as theft of sensitive URLs. We can also see what websites are whitelisted.

Exploit in the Wild Demonstration

http://cs.utexas.edu/~alfred

Are we too late?

Mitigation Techniques

For extension makers:

• Make secure origin checks!

○ .match, .indexOf, … are NOT secure.

• Only use postMessage when absolutely necessary
• Avoid running scripts anywhere that interacts with outside messages
• Obfuscation makes our lives difficult

For web users:

• Any permissions that an extension asks for can potentially be exploited

Conclusion

• Vulnerable postMessage origin checks exist in browser extensions
• These checks can be subverted
• Vulnerable extensions can be exploited

Future Work

• Firefox
• Dynamic checking for more robust postMessage checks
• Online tool that breaks origin checks