Wednesday, 19 March 2014

When "usability outweighs the perceived risks" [Google]

Sometimes advantages of used solution outweighs potential security risk, situation like that opens wide field for black hats.

Introduction

Using Google as proxie is well known topic, ex. google translator, but recently I noticed also content downloading possibility, what creates a way more abuse possibilities.

Blogger "image from web"
When we want to add a new photo from web, there is created request like that:



 Url:
https://images-blogger-opensocial.googleusercontent.com/gadgets/proxy?url=http://1.bp.blogspot.com/-FbuVMEv0Abg/Ut10Wpi_WFI/AAAAAAAAD1I/q1Pk4RPA2e4/s1600/Screenshot_2.jpg&container=blogger&gadget=a&rewriteMime=image/*

Opening that link will start downloading image in p.txt file, from address included in "url" parameter.  In this example "http://1.bp.blogspot.com/-FbuVMEv0Abg/Ut10Wpi_WFI/AAAAAAAAD1I/q1Pk4RPA2e4/s1600/Screenshot_2.jpg". What is exactly my .jpg, just with changed extension to text file. But let's see what can we achieve by changing the "url", or  "rewriteMime" parameter.

Threats


1)Malicious file download using google servers:

We can change url parameter to any page or file and thanks to rewriteMime, (http://en.wikipedia.org/wiki/MIME) we can give "advice for browser", what to use for opening this file, despite of default .txt format. Some of the browsers use that parameter (ex. firefox). It gives possibility to send malicious file, as google servers (File is being downloaded to google servers firstly and then to client)
So lets make some tests, by downloading files from dropbox and changing their mime parameters:

.docx and .pdf - popular files, often containing exploits.
https://images-blogger-opensocial.googleusercontent.com/gadgets/proxy?url=https://dl.dropboxusercontent.com/u/17580849/testing/test.docx&container=a&gadget=b&rewriteMime=application/msword

https://images-blogger-opensocial.googleusercontent.com/gadgets/proxy?url=https://dl.dropboxusercontent.com/u/17580849/testing/test.pdf&container=a&gadget=b&rewriteMime=application/pdf


.zip that may contain malicious .exe
https://images-blogger-opensocial.googleusercontent.com/gadgets/proxy?url=https://dl.dropboxusercontent.com/u/17580849/testing/test.zip&container=a&gadget=b&rewriteMime=application/zip

Video:





In chrome and IE situation is better, they both recognize files as .txt, despite the Mime parameter change.

2)Bypass downloading content from websites blocked or marked as danger websites

Because everything is going though goggle servers, it lets to use content from sources, that maybe should be blocked for some reasons. So it can work as proxy.

3) Silence malware updates possibility

Default extension of file is .txt, but after downloading there is no problem for malware to change it to exe., so connecting this, with previously talked proxy possibility, it can be used by malware to make updates thought legit google servers.

Video: 

video


4) DoS using google servers
During tests, I didnt notice any security, as captcha or requests limit, so it gives possibility to make numerous requests of downloading file from target website and at the end the DoS attack. Attacker could choose big file on website, which using this method will be downloaded many times by fast google servers.


Conclusion

Web developers often encounter this kind of problem, the title which describes it, comes from email that I got from Google:



As we can see in Google opinion possible advantages are higher than the risk. Same situation we can observe right now (27.04), with Facebook, where it's possible to use notes service for downloading content from any website (cause DDos, when many people open the note) (more info: http://chr13.com/2014/04/20/using-facebook-notes-to-ddos-any-website/). The most realistic solutions seems to be monitoring such a service and trying to catch abuses.

1 comment:

  1. Damn... I am late by 2 months...

    "we can give 'advice for browser', what to use for opening this file, despite of default .txt format. Some of the browsers use that parameter (ex. firefox)"
    Firefox 29.0.1 still tries to open that links by notepad.

    Good job!

    ReplyDelete