Cursory hack – Fake address bar interaction • Hacker News Board

Re: Cursory hack – Fake address bar interaction

#21

Post by Herrera » Wed, Aug 10, 2016, 2:04 PM UTC

angry-hacker wrote: post #16

There are several similar reports on chromium project. All of them are nofix.

Really? That is strange, because there is ways this could be exploited... Can you link them to me?

Re: Cursory hack – Fake address bar interaction

#22

Post by smidgen2 » Wed, Aug 10, 2016, 2:27 PM UTC

Whoa that is a sweet hack. You should have submitted it to Google for a bug bounty. It should NOT be possible to clickjack the browser's address bar.

Re: Cursory hack – Fake address bar interaction

#23

Post by wazoox » Wed, Aug 10, 2016, 2:41 PM UTC

On both Firefox and Chromium on Linux the true place of the real cursor stay visible (Firefox displays a thin cross, and chromium a light blue star). The menu position of course doesn't make sense in Firefox :)

Re: Cursory hack – Fake address bar interaction

#24

Post by hexadec0079 » Wed, Aug 10, 2016, 2:43 PM UTC

smidgen2 wrote: post #22

Whoa that is a sweet hack. You should have submitted it to Google for a bug bounty. It should NOT be possible to clickjack the browser's address bar.

It isn't though. This merely changes the display of the cursor. Go to windowed mode (not fullscreen) and pull the cursor down into the address bar and tabs area to see that this does not prevent access to the address bar. It only changes how you perceive the position of the cursor.

Re: Cursory hack – Fake address bar interaction

#25

Post by hexadec0079 » Wed, Aug 10, 2016, 2:43 PM UTC

benwaffle wrote: post #14

mrweasel wrote: post #12

Earlier quoted context omitted.

Or Firefox

or on HiDPI

Or on Netscape Navigator

Re: Cursory hack – Fake address bar interaction

#26

Post by HeadlessChild » Wed, Aug 10, 2016, 2:48 PM UTC

hexadec0079 wrote: post #25

benwaffle wrote: post #14

Earlier quoted context omitted.

or on HiDPI

Or on Netscape Navigator

Or in lynx

Re: Cursory hack – Fake address bar interaction

#27

Post by heywire » Wed, Aug 10, 2016, 2:50 PM UTC

Note: If you have the home button always visible in chrome, or the bookmarks bar hidden, you'll notice that the demo doesn't work properly.

Re: Cursory hack – Fake address bar interaction

#28

Post by angry-hacker » Wed, Aug 10, 2016, 3:01 PM UTC

Herrera wrote: post #21

angry-hacker wrote: post #16

There are several similar reports on chromium project. All of them are nofix.

Really? That is strange, because there is ways this could be exploited... Can you link them to me?

https://news.ycombinator.com/item?id=12260444

Sorry, I'm on mobile. But several similar reports as the HN link shows.

Re: Cursory hack – Fake address bar interaction

#29

Post by amga_ » Wed, Aug 10, 2016, 3:27 PM UTC

Source code: https://github.com/jameshfisher/cursory-hack

Re: Cursory hack – Fake address bar interaction

#30

Post by sp332 » Wed, Aug 10, 2016, 3:58 PM UTC

yladiz wrote: post #10

So I thought this was just doing something on click (showing the fake HTTPS info), but that it maybe didn't work on newer or non-Chrome browsers, e.g. Chrome 52, Safari 9.1, and whatever bug was fixed there. But then I noticed that it causes really weird interactions at the top of the browser, at least on Mac; if you open the page in either Chrome or Safari and move your mouse towards the address bar, it jumps around…

I'm using Firefox on Windows and it's awfully flickery but it does work.