Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reflected File Download: A New Web Attack Vector

drive.google.com

Post reply on HN
Print view View original

31–40 of 81 posts

Re: Reflected File Download: A New Web Attack Vector

#31

Post by tedunangst »

daeken wrote: post #29
tedunangst wrote: post #18

Earlier quoted context omitted.

The obvious is that you think you're running "su" but you're really running some other command because your PATH is ~/.trojans:/bin:/usr/bin. They may not have immediate control, but they'll get it eventually.

Just FYI, PATH is always reset by su to prevent exactly this. Same with LD_LIBRARY_PATH and other security-critical environment variables.

That's after you run su. Just to be clear, I'm talking about an attacker fiddling with your path so you run fake-su, stealing your password, then calling su and making it look like nothing shady happened. By the time su is running, it's far too late for it to do anything.

Re: Reflected File Download: A New Web Attack Vector

#32

Post by alkonaut »

If the downloaded payload would auto-execute without warning then this would be serious. Otherwise (if it needs intervention) it feels like a far fetched threat.

1) Aren't the people who would execute files that randomly download exactly the people who can never find the files they download?

2) Aren't the people who execute random stuff from the Internet also the people who won't be able to tell whether a URL feels trustworthy or not?

So by 1) you could just as well serve funny.jpg.exe to the victim, and by 2) you can reach a wide enough audience by serving it from your bad guy domain rather than trying to masquerade as Google.

Re: Reflected File Download: A New Web Attack Vector

#33

Post by andrewstuart2 »

JackC wrote: post #24

So to summarize: (1) You can use semicolons to get some web services to ignore the end of a request URL and respond normally, while tricking browsers into downloading the response as a file with an arbitrary name. This allows you to send a victim to a mainstream site (Google or Bing, e.g.) and have them end up with a file with the name of your choice in their Downloads folder. (2) If the web service responds with use…

"Google downloaded a file for me. That's never happened before. Oh well, guess I better run it!"

Re: Reflected File Download: A New Web Attack Vector

#34

Post by duskwuff »

JackC wrote: post #24

So to summarize: (1) You can use semicolons to get some web services to ignore the end of a request URL and respond normally, while tricking browsers into downloading the response as a file with an arbitrary name. This allows you to send a victim to a mainstream site (Google or Bing, e.g.) and have them end up with a file with the name of your choice in their Downloads folder. (2) If the web service responds with use…

> Are there examples where attackers gain a big advantage by having a downloaded file come from a trusted URL?

Some operating systems, like Mac OS X, will tag downloaded files with the domain they were downloaded from. A prompt asking the user whether they want to download a file that "was downloaded from google.com" will sound much more convincing than one with an unrecognizable domain name.

Re: Reflected File Download: A New Web Attack Vector

#35

Post by Untit1ed »

andrewstuart2 wrote: post #33
JackC wrote: post #24

So to summarize: (1) You can use semicolons to get some web services to ignore the end of a request URL and respond normally, while tricking browsers into downloading the response as a file with an arbitrary name. This allows you to send a victim to a mainstream site (Google or Bing, e.g.) and have them end up with a file with the name of your choice in their Downloads folder. (2) If the web service responds with use…

"Google downloaded a file for me. That's never happened before. Oh well, guess I better run it!"

Unfortunately I could easily see that happening.

Re: Reflected File Download: A New Web Attack Vector

#36

Post by JoeAltmaier »

duskwuff wrote: post #34
JackC wrote: post #24

So to summarize: (1) You can use semicolons to get some web services to ignore the end of a request URL and respond normally, while tricking browsers into downloading the response as a file with an arbitrary name. This allows you to send a victim to a mainstream site (Google or Bing, e.g.) and have them end up with a file with the name of your choice in their Downloads folder. (2) If the web service responds with use…

> Are there examples where attackers gain a big advantage by having a downloaded file come from a trusted URL? Some operating systems, like Mac OS X, will tag downloaded files with the domain they were downloaded from. A prompt asking the user whether they want to download a file that "was downloaded from google.com" will sound much more convincing than one with an unrecognizable domain name.

But with the proliferation of domain names (.business etc) anybody can have a convincing name?

Re: Reflected File Download: A New Web Attack Vector

#37

Post by nowarninglabel »

JoeAltmaier wrote: post #36
duskwuff wrote: post #34

Earlier quoted context omitted.

> Are there examples where attackers gain a big advantage by having a downloaded file come from a trusted URL? Some operating systems, like Mac OS X, will tag downloaded files with the domain they were downloaded from. A prompt asking the user whether they want to download a file that "was downloaded from google.com" will sound much more convincing than one with an unrecognizable domain name.

But with the proliferation of domain names (.business etc) anybody can have a convincing name?

Yeah, but to avoid detection, botnets register random character domain names that are not going to appear legitimate, so this would be a nice tool in their arsenal.

Re: Reflected File Download: A New Web Attack Vector

#38

Post by emersonrsantos »

metzman wrote: post #7

I think the author is claiming that clicking on https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?g... results in a file ChromeSetup.bat being downloaded, but in chrome and firefox the file downloaded is f.txt. Has anyone tried this on other browsers? EDIT: Here is the portion of the paper explaining why this no longer works: "However, a common implementation error could result in Reflected File Download fro…

On Safari 7 at OSX file is downloaded as f.txt.json.

Re: Reflected File Download: A New Web Attack Vector

#39

Post by al2o3cr »

STRML wrote: post #5

The bit about the semicolon separator was new to me. Are there many web services using the semicolon to send parameters? In any case, it seems that the real bug is that browsers don't properly recognize `;` as a separator and can derive the resource name from what comes after. That's definitely a problem; it would be crazy if, for example, you could craft a querystring ending with "&/file.bat" and the browser would p…

Parameters I'm not sure, but there was a hot minute back before Rails 2.0 shipped where it was using them:

https://github.com/rails/rails/commit/0cac2806a6fd9f1f63cdce...

That 2007 commit rolled back to just using slashes.

Post reply on HN