Target=”_blank” is an underestimated vulnerability • Hacker News Board

Re: Target=”_blank” is an underestimated vulnerability

#31

Post by userbinator » Thu, May 05, 2016, 2:18 AM UTC

Cpoll wrote: post #3

For anyone that wants to see this in action: - Open a website, let's say google.com - Open a console and type in `window.open(" http://xkcd.com")` - Disable your popup blocker and do it again. - Open a console in the new xkcd window and type in `window.opener.location = " https://news.ycombinator.com/user?id=Cpoll"` Note that Google quietly turned into my profile page. Now, imagine that it instead turned into malicio…

For anyone who wants to see this defeated:

- Disable JavaScript.

Seriously, seeing all these interesting behaviours just makes me advocate even more strongly browsing the "open Web" with JS off by default. The power of JavaScript is not to be underestimated, and while it makes for some very good things that would be otherwise impossible, I think users should be more aware of and understand the risks that allowing any page to run JS can imply.

I only allow JS for a very small number of sites which I thoroughly trust and require it, and haven't missed it one bit; the fact that it automatically rids a lot of other surprising and annoying things pages can do, besides phishing or exploiting you, is a nice bonus.

Re: Target=”_blank” is an underestimated vulnerability

#32

Post by dmnd » Thu, May 05, 2016, 2:26 AM UTC

At Flexport, a security audit revealed we were vulnerable to this. So we made a linter to detect it. If you use React like we do, maybe our linter will be useful to you too: https://github.com/yannickcr/eslint-plugin-react/pull/582

Re: Target=”_blank” is an underestimated vulnerability

#33

Post by biggerfisch » Thu, May 05, 2016, 2:41 AM UTC

gcr wrote: post #28

Cpoll wrote: post #3

For anyone that wants to see this in action: - Open a website, let's say google.com - Open a console and type in `window.open(" http://xkcd.com")` - Disable your popup blocker and do it again. - Open a console in the new xkcd window and type in `window.opener.location = " https://news.ycombinator.com/user?id=Cpoll"` Note that Google quietly turned into my profile page. Now, imagine that it instead turned into malicio…

How is this any different in principle than $.get("page", function(result){document.body = result;}); ? If the attacker can run the javascript you mentioned, they've already run.

The "benefit" is that it causes a "trusted" tab to change, not a new one that a user might expect to be tainted. If I open a link from HN (for example), read it, and close the tab, I'd expect to be back at HN. If the link changed my `window.opener` url to a fake-HN, I could do some action that asks for a password or some similar data. It's more likely to succeed since the user already trusts the existing window/tab/site.

Re: Target=”_blank” is an underestimated vulnerability

#34

Post by emidln » Thu, May 05, 2016, 2:44 AM UTC

briHass wrote: post #23

zerd wrote: post #16

I guess this is the trick 99% of porn sites use to do "pop-unders" now. Shouldn't the fix for this be in the browers?

Yep. Open requested link in a new tab, change the previous tab to some autoplay video or fake chat interface. It's not phishing exactly, but it is certainly devious.

To be fair, not all of those chat interfaces were fake. Some are just scripts that connect to real people quickly once you interact favorably. Then they try to sell you on $50 of cam show credits.

Re: Target=”_blank” is an underestimated vulnerability

#35

Post by G3E9 » Thu, May 05, 2016, 2:47 AM UTC

For you Firefox users, try the add-on RequestPolicy (https://requestpolicycontinued.github.io/) and before a site opens or redirects to another domain, you'll be prompted (you can make policies around your decision for future instances.)

Re: Target=”_blank” is an underestimated vulnerability

#36

Post by WhoBeI » Thu, May 05, 2016, 3:30 AM UTC

gcr wrote: post #29

This is not a very informative article. It doesn't explain how the attack works (e.g. what is the window.opener object? how can an attacking page modify it? what's the trick and why is it important?).

Read the mdn post I link below as well and it should become clear.

https://developer.mozilla.org/en-US/docs/Web/API/Window/open...

Re: Target=”_blank” is an underestimated vulnerability

#37

Post by UIZealot » Thu, May 05, 2016, 3:35 AM UTC

userbinator wrote: post #31

Cpoll wrote: post #3

For anyone that wants to see this in action: - Open a website, let's say google.com - Open a console and type in `window.open(" http://xkcd.com")` - Disable your popup blocker and do it again. - Open a console in the new xkcd window and type in `window.opener.location = " https://news.ycombinator.com/user?id=Cpoll"` Note that Google quietly turned into my profile page. Now, imagine that it instead turned into malicio…

For anyone who wants to see this defeated: - Disable JavaScript. Seriously, seeing all these interesting behaviours just makes me advocate even more strongly browsing the "open Web" with JS off by default. The power of JavaScript is not to be underestimated, and while it makes for some very good things that would be otherwise impossible, I think users should be more aware of and understand the risks that allowing any…

Couldn't agree more.

I don't even enable JavaScript for google.com, not since they integrated the pile of crap that is/was Google+ which added 10% usage load on my CPUs.

Re: Target=”_blank” is an underestimated vulnerability

#38

Post by bluesmoon » Thu, May 05, 2016, 3:54 AM UTC

Looks like an almost verbatim copy of https://mathiasbynens.github.io/rel-noopener/

Re: Target=”_blank” is an underestimated vulnerability

#39

Post by lomnakkus » Thu, May 05, 2016, 4:20 AM UTC

userbinator wrote: post #31

Cpoll wrote: post #3

For anyone that wants to see this in action: - Open a website, let's say google.com - Open a console and type in `window.open(" http://xkcd.com")` - Disable your popup blocker and do it again. - Open a console in the new xkcd window and type in `window.opener.location = " https://news.ycombinator.com/user?id=Cpoll"` Note that Google quietly turned into my profile page. Now, imagine that it instead turned into malicio…

For anyone who wants to see this defeated: - Disable JavaScript. Seriously, seeing all these interesting behaviours just makes me advocate even more strongly browsing the "open Web" with JS off by default. The power of JavaScript is not to be underestimated, and while it makes for some very good things that would be otherwise impossible, I think users should be more aware of and understand the risks that allowing any…

(Assuming I'm understanding the exploit correctly, obviuosly:)

Limiting JS to a few sites won't protect you fully from this attack, though it will obviously limit your exposure.

If one of your trusted sites, A, has been compromised by, say, an XSS attack, with the ability to inject JS then this attack can be leveraged to also compromise your access credentials to site B by redirecting your login attempt on site B to a malicious imitation of site B's login page. (Of course this assumes that you already have B open in a tab somewhere and that you opened site A through a _blank link on site B. Mostly I would think that would be a plausible scenario for sites mostly based on user-generated content such as forums, social media, and such.)

AFAICT always explicitly force-reloading any login page should make you a lot safer, but remembering to always do that is perhaps not realistic.

Re: Target=”_blank” is an underestimated vulnerability

#40

Post by joveian » Thu, May 05, 2016, 5:13 AM UTC

Is there a canonical safe way to pop up a link in a new tab/window? This seems like a major bug and hopefully browser vendors will fix it quickly.