Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reflected File Download: A New Web Attack Vector

drive.google.com

Post reply on HN
Print view View original

41–50 of 81 posts

Re: Reflected File Download: A New Web Attack Vector

#41

Post by Someone »

0x0 wrote: post #9

I'm not sure I understand how this is "worm"-able - it still requires the user to manually execute the downloaded file? How is this any different from pasting a link to a "lol.jpg.exe" malware?

Compare "Are you sure you want to run 'lol.jpg', downloaded from hackers.com a minute ago?" With "Are you sure you want to run 'Windows Security Update 3.1', downloaded from update.microsoft.com a minute ago?". It would be even greater if that second alert showed that a certificate guarantees the file to come from a Microsoft site (would it, if this attack succeeded?)

The more you make your malware look like legit, the likelier that people fall for it. It's not a huge difference, but I guess more people would fall for the latter.

[and of course, it is unlikely that microsoft.com is suspectible to this attack. I don't even know whether it works anywhere at all anymore (from a comment elsewhere in this thread, Google fixed it on their site)]

Re: Reflected File Download: A New Web Attack Vector

#42

Post by lucb1e »

0x0 wrote: post #9

I'm not sure I understand how this is "worm"-able - it still requires the user to manually execute the downloaded file? How is this any different from pasting a link to a "lol.jpg.exe" malware?

Yeah it sounds a bit exaggerated to me, but it's still nice work. It definitely abuses the system and spoofs things that should not be possible to spoof, but it's not as big as I was first afraid it might be after reading just a few lines. It won't silently worm through your social network if you don't execute things that randomly start downloading. However if someone targets you, sends you a link to a .exe or .bat from your own company's website with a good story... yeah that is tempting to click.

Re: Reflected File Download: A New Web Attack Vector

#43

Post by malka »

0x0 wrote: post #9

I'm not sure I understand how this is "worm"-able - it still requires the user to manually execute the downloaded file? How is this any different from pasting a link to a "lol.jpg.exe" malware?

You could craft an url that makes your browser download a file named 'chromesetup.exe' that comes from a google URL, but is a worm.

Re: Reflected File Download: A New Web Attack Vector

#44

Post by TylerE »

JoeAltmaier wrote: post #36
duskwuff wrote: post #34

Earlier quoted context omitted.

> Are there examples where attackers gain a big advantage by having a downloaded file come from a trusted URL? Some operating systems, like Mac OS X, will tag downloaded files with the domain they were downloaded from. A prompt asking the user whether they want to download a file that "was downloaded from google.com" will sound much more convincing than one with an unrecognizable domain name.

But with the proliferation of domain names (.business etc) anybody can have a convincing name?

People take alt-tlds seriously? Even older TLDs like .info or .biz seem seedy and low-rent compared to .com

Re: Reflected File Download: A New Web Attack Vector

#45

Post by skue »

JackC wrote: post #24

So to summarize: (1) You can use semicolons to get some web services to ignore the end of a request URL and respond normally, while tricking browsers into downloading the response as a file with an arbitrary name. This allows you to send a victim to a mainstream site (Google or Bing, e.g.) and have them end up with a file with the name of your choice in their Downloads folder. (2) If the web service responds with use…

> are there examples where attackers gain a big advantage by having a downloaded file come from a trusted URL?

Yeah. I hope Adobe is all over this.

It's not hard for me to imagine a shady website that offers streaming videos prompting users that they need to update Flash, then redirecting the user to an adobe.com URL that downloads an installer. I bet even some savvy HNers could fall for that.

Or how about a similar attack on enterprise users by prompting them to update Adobe Reader.

Re: Reflected File Download: A New Web Attack Vector

#46

Post by jerf »

adr_ wrote: post #30

This sounds basically the same as: http://lcamtuf.blogspot.com.au/2014/03/messing-around-with-d...

A similar technique used to build the payload, but the linked paper does have a more sophisticated technique for setting the target's filename arbitrarily, without having to somehow craft a link with a "download" attribute on a target website.

Re: Reflected File Download: A New Web Attack Vector

#47

Post by zippergz »

TylerE wrote: post #44
JoeAltmaier wrote: post #36

Earlier quoted context omitted.

But with the proliferation of domain names (.business etc) anybody can have a convincing name?

People take alt-tlds seriously? Even older TLDs like .info or .biz seem seedy and low-rent compared to .com

I think you greatly overestimate the degree to which non-technical people understand domain names and TLDs. There are a lot of people who think "www." goes on the front of their email address.

Re: Reflected File Download: A New Web Attack Vector

#48

Post by 001sky »

andrewstuart2 wrote: post #33
JackC wrote: post #24

So to summarize: (1) You can use semicolons to get some web services to ignore the end of a request URL and respond normally, while tricking browsers into downloading the response as a file with an arbitrary name. This allows you to send a victim to a mainstream site (Google or Bing, e.g.) and have them end up with a file with the name of your choice in their Downloads folder. (2) If the web service responds with use…

"Google downloaded a file for me. That's never happened before. Oh well, guess I better run it!"

The confidence game here is the same as any other.

1> Google is a legit, law abiding, legal accountable entity

2> Because of (1), the download likely has the attributes associated with google, not more commonly with "bad guys"

3> The probability of google being spoofed is low enough to not empirically validate the premise or conclusion of (1)

4> Smart people therefore do dumb things as a result of (3)

5> Smart people doing dunmb things is a lucrative proposition, because smart people have money/wealth

Re: Reflected File Download: A New Web Attack Vector

#49

Post by patio11 »

andrewstuart2 wrote: post #33
JackC wrote: post #24

So to summarize: (1) You can use semicolons to get some web services to ignore the end of a request URL and respond normally, while tricking browsers into downloading the response as a file with an arbitrary name. This allows you to send a victim to a mainstream site (Google or Bing, e.g.) and have them end up with a file with the name of your choice in their Downloads folder. (2) If the web service responds with use…

"Google downloaded a file for me. That's never happened before. Oh well, guess I better run it!"

You have to understand that, seen from the perspective of non-technical users, the Googles do weird unpredictable things all the time.
Post reply on HN