VoxxedDays Luxembourg - Abuse web browsers for fun & profits - Dominique Righetto

voxxeddays.com/luxembourg/ #voxxeddaysLU
Abuse web browsers
for fun & profits
Dominique Righetto, Excellium
@righettod

Warning
• This talk will not contain stuff like this

Why abusing browsers?
• Today modern web browsers on Mobile or Desktop :
• Contains plenty of features through native components or plugins.
• Are used as preferred client to access new applications.
• Most of the new applications are web based (thanks Mister Cloud ).
• Security at infrastructure/network is now quite mature.
• Targeting client side and users are more “fruitful” because you
can’t standardize people behavior or mindset.

Our problem
• As penetration tester, the
most important step on a
attack is dedicated to
reconnaissance and
analysis of the target entity.
• Based on the offline analysis
of the grabbed data, we can
further create attack scenarii
and customize related
content.
Reco
Grab as much information as
possible about our victims in
the most stealthy way
Quickly list all available
attack surfaces.
Perform operation on a
variable number of victims.
Support, if possible, modern
and quite old browsers.

Our friend
HTML5
Cross Origin Resource Sharing.
WebSocket.
JavaScript
New native features + JQuery (branch 1.x).
Some other JavaScript libraries for specific job
like hashing or cookie management.
PIWIK
Building block for report rendering and keep
gathered data in-house.
PHP / Symfony / Composer
Handle server side operations.
Our team is composed by PHP integrist so we
can’t fight 

Note about CORS and Web Socket
• Same Origin Policy (SOP for friends) is a pillar of the security
on the web because it restricts the capacity of an hidden caller
(for example Ajax) to contact arbitrary domain in a easy way
(most bypass was using JSONP type call or loading through
tags like IMG/SCRIPT/STYLE/IFRAME…).
• But thanks to HTML5…
• Web Socket is currently not restricted by the SOP.
• CORS configuration is HTTP headers based so, an attacker can easily
configure CORS on his domain to accept any call.

Our enemies
• As we will use only legal
web client side
technologies and we want
to be stealth, we must take
care about:
User
Workstation
antivirus
Web proxy
Firewall

Global approach
• Implements a simple web application, plugins based, in which
each plugin:
• Will be executed on client side.
• Will be in charge of grabbing a specific information.
• Information will be grouped by entity targeted and a visitor
(victim) will have a unique ID in order to track it.
• URL will be provided to victims using the following vectors:
• Phishing ( in our campaign, each time, more than 30% of the targeted
users click  ).
• Via compromising of a "water hole" site.

Global approach
WUI layer
(grab infos)
Plugin X
Controller layer
(store/expose infos)
Storage layer
(database)
Victim browser context
Plugin X
Loading
Send result

Interesting information
• As the final objective is to determine one or several attack
surfaces and according to browser capacities, the following
information are interesting for us:
• Browser name/version + all plugins info + OS name/version:
• Will be used to find a plugin or a browser vulnerable (ex: IE < 11 because
Microsoft do not update them anymore since February 2016).
• Will be used also to determine the type of user because, for example, often Sys
Admin user:
• Have special plugins like one for VMWARE.
• Have local admin or privileged rights 

• Web Socket support level by Browser and Web Proxy:
• Will be used to know if we can use Web Socket to create a 2 way communication
channel because Web Socket is not limited by the Same Origin Policy.
• Site categories on which the user is allowed to browse:
• Will be used to know if we can use site like
Twitter/GitHub/Pastebin/GoogleDrive/Dropbox…for data infiltration/exfiltration.

• File type allowed to be downloaded by the victim from the web:
• Will be used to know, using which file type, we can use as infection vector to
deliver the attack.
• Specific services running on the victim workstation like Tomcat,
MySQL, Oracle, SonarQube, WAS…
• Will be used to know if the victim is a developer because often developer:
• Have local admin or privileged rights 
• Workstation can contains interesting credentials or information.
• Have a set of exception rules about Antivirus real-time scanning.

• Identify the name and version of the Web Proxy:
• Will be used to find vulnerability and bypass for data infiltration or exfiltration.
• CPU and GPU information of the victim workstation:
• Will be used to create a malware that only executes if it detect this type of
CPU/GPU and then escape malware sandboxes.

• Type of Internet connection:
• Will be used to determine the download / upload capacities of the victim
infrastructure and then provides which exfiltration capacity that can be used for
data infiltration or exfiltration.
• Will also be used to determine if the victim work from home/public WIFI….Useful
to find additional attack surfaces…

Plugin n°1 - Approach
• Browser name/version + all plugins info + OS name/version:
1. On modern browsers, use the native object « navigator.plugins » to
retrieve plugins list.
2. Enhance detection using the library « PluginDetect » in order to
support old browsers:
• http://www.pinlady.net/PluginDetect/
3. Retrieve user agent and OS information using the library
« UAParser »:
• https://github.com/faisalman/ua-parser-js

Plugin n°1 - Data sample

• Web Socket support level by Browser and Web Proxy:
1. Detect if browser support Web Socket using the native object
"window.WebSocket".
2. If browser support WS then try to send a unique message to the open
relay "echo.websocket.org":
• If we receive, in response, the message sent Web Proxy support WS.
• Otherwise  Web Proxy do not support WS.

• During the plugin implementation:
1. A list of site, with their associated category, has been built by grabbing the
information against several Web Proxy vendors (ex: Palo Alto / Bluecoat…)
2. The list of site has been grouped by Web Proxy vendor and has been
enhanced with custom local sites and categories (ex: l’essentiel, itnations,
paperjam….).
3. For each site, the smallest image available has been searched on it and was
kept as reference test link.
4. So, the list of sites is now a list of links grouped by categories and Web Proxy
vendor.

• Plugin processing:
• For each link, a HTML IMG tag is generated and added to DOM.
• A random url parameter, in order to avoid caching by the browser, is added to all
url links.
• Each HTML IMG contains a handler on the following events:
• "onload" : Set the flag indicating that the site is allowed because the image can be
loaded.
• "onerror" : Set the flag indicating that the site is NOT allowed because the image
cannot be loaded.

• During the plugin implementation:
1. A list of specific files that can be used as infection vector has been built.
2. Each file is linked to is digest using SHA-256 algorithm.
• Example of tested files format:
• Microsoft Office supporting auto start VBA macros and OLE packages.
• Windows native and .Net binaries.
• Java auto executable archive.
• Adobe Portable Data Format.
• Windows Script File.

• Plugin processing:
• For each file
1. Send a Ajax GET request in order to retrieve the file content.
2. Compare the computed hash of the retrieved file content against the hash associated
to the file.
3. If they match  File type allowed to be downloaded and not altered by Web Proxy.
4. Otherwise  File type not allowed to be downloaded or altered by Web Proxy.

• Based on research performed by Lavakumar Kuppan & Manish
Saindane:
• http://www.andlabs.org/tools/jsrecon/jsrecon.html

1. Test open state of dedicated ports on victim loopback IP address
using Web Socket.
2. Analyze the time taken by the WS "readyState" attribute to move from
initial state 0 to further state 1/2/3.
3. According to the delay taken, the open/closed/filtered state is
deducted. Constant Value Description
CONNECTING 0 The connection is not yet open.
OPEN 1 The connection is open and ready to communicate.
CLOSING 2 The connection is in the process of closing.
CLOSED 3 The connection is closed or couldn't be opened.

• Identify the name and version of the Web Proxy:
1. Analyze request HTTP header to detect presence of headers added
by the Web Proxy like for example: X-Cache-Lookup, X-Cache, Via...
2. Capture the Web Proxy error page by returning a TCP RESET to a
specific Ajax GET request.
3. Use Cross Origin Resource Sharing to send error page captured to
storage controller.

Browser Web Proxy Application
Request Request
TCP RSTProxy Error Page

• CPU and GPU information of the victim workstation :
1. Retrieve CPU information using the library "UAParser" and the native
object "navigator.platform".
2. Retrieve number of CPU Core using the native object
"navigator.hardwareConcurrency".
3. Retrieve GPU information using HTML5 Canvas and the extension
"WEBGL_debug_renderer_info" if this one is available otherwise get
information from Canvas object instance directly.

• Type of Internet connection :
1. If the site https://ipleak.net can be browsed by the victim then perform
an Ajax request on it Site allow CORS request from anyone 
2. Parse page to extract information about Internet connection.

Global attack process resume
Excellium NetworkTarget Network
Browser
(user)
Fingerprinting
Application
Malware
Factory
Information
storage
A B
C
D
E
F
Malware
C&C

Which possible mitigation?
• To be honest, it’s very difficult to block extraction of the
information described into this presentation…
• However, some action can be put in place to limit the amount of
disclosed data, it’s a matter of attack surface available.

• The following actions try to reduce the attack surface available:
• Limit, to the minimum possible according the business need, the
number of plugins installed in browsers : in 2016 Flash is still really
needed? Same question about Java runtime registration into browser?
• Keep browsers, plugins and OS up to date:
• https://browsercheck.qualys.com/?scan_type=js
• Apply the more strict as possible site filtering, if a site is not categorized
then block it by default and require to user to ask you the unlocking in
order to obtains explanation about is utility:
• For example as developer, access to https://stackoverflow.com/ is mandatory but
not http://pastebin.com/

• Limit the number of file type allowed to be downloaded directly using
the Web Proxy (no EXE/WSH/VBS/JAR...)
• Even Jar file, use a dedicated Proxy like Nexus or Artifactory !
• Disable WebRTC and install Ghostery:
• https://www.ghostery.com/try-us/download-browser-extension/
• https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-disable-webrtc/

Thanks you !!!
Question ?
If you want to see a live demo, come to me after the talk…
http://excellium-services.com - http://www.emergenc6.com

VoxxedDays Luxembourg - Abuse web browsers for fun & profits - Dominique Righetto

More Related Content

What's hot (15)

Viewers also liked (14)

Similar to VoxxedDays Luxembourg - Abuse web browsers for fun & profits - Dominique Righetto (20)

Recently uploaded (20)

VoxxedDays Luxembourg - Abuse web browsers for fun & profits - Dominique Righetto