New URI browser flaws worse than first thought
'Functionality based exploitation' a troubling new turn of events
IDG News Service - A little-known feature in the Windows operating system can lead to big problems for Web surfers.
Security researchers Billy Rios and Nathan McFeters say they've discovered a new way that the URI (Uniform Resource Identifier) protocol handler technology, used by Windows to launch programs through the browser, can be misused to steal data from a victim's computer.
URI bugs have become a hot topic over the past month, ever since researcher Thor Larholm showed how a browser could be tricked into sending malformed data to Firefox using this technology. This bug allowed an attacker to run unauthorized software on a victim's PC.
Later, other researchers, including Rios and McFetters, showed how other browsers and applications could be misused to achieve similar goals.
In the past days, however, Rios and McFetters have shifted their focus away from malformed data and have taken a close look at how attackers could simply misuse the legitimate features of software that is launched via the URI protocol handler, something they call "functionality based exploitation."
Their initial results show that there could be plenty of ways to misuse this technology.
Though they will not name the company responsible for the software, the researchers said they have found a major flaw in a widely used program that could be misused to steal data from a victim's computer.
"It is possible through the URI to actually steal content from the user's machine and upload that content to a remote server of the attacker's choice," said McFetters, a senior security advisor for Ernst & Young Global Ltd. "This is all through functionality that the application provides."
Rios and McFetters plan to release the results of their research after the vendor has had a chance to fix the problem, but this may be the beginning of a new round of problems with a technology that is just starting to be scrutinized by security professionals.
"It's a hacker's dream and programmer's nightmare," said Eric Schultze, chief security architect with Shavlik Technologies LLC. "I think over the next six to nine months, hackers are going to find lots of ways to exploit standard applications to do non-standard functions."
By using these custom URI protocol names, software developers are trying to make lives easier for their customers. The Windows Registry keeps track of the names and associates them with programs, so that any time they are called up in the browser, the appropriate software is launched.
For example, AOL LLC's instant messenger client uses the name "aim." So clicking on a Web link that begins "aim:goim" or putting the address "aim:goim" in the browser's address bar will open an AIM instant message window.
- Securing Mobility, From Device to Network At one time, the process of managing and securing mobile devices and applications was fairly straightforward. Most organizations worried about one application (email)...
- Data Protection eGuide In this eGuide, CSO and sister publications IDG News Service, Computerworld, and CIO pull together news, trend, and how-to articles about the increasingly...
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!