There has also been some excellent follow-up research from Pepe Vila, Mario Heiderich et al, d0nut and Michał Bentkowski covering all sorts of CSS exfiltration techniques. David, Eduardo and I covered it in our CSS The Sexy Assassin talk back in 2008! Stefano di Paola and Alex K. If I could compromise a filter list then I would have control over the CSS on every web site when using uBlock Origin but what could I do? Most research on CSS exploitation has focused on attribute-based selector attacks - because they make it quite easy to steal passwords in inputs. Chrome has the function too but you must use it in combination with the url() function.
There is an alias called -webkit-image-set() which allows strings as URLs on Firefox. This was quickly patched but I managed to find a bypass that worked in the latest uBlock Origin version: #input,input/* I had a quick look at his injection vector and indeed I was able to control more or less the full CSS of the injected filter rule: #div:style(-foo: 1/*)Į#div Due to ethical (not to mention legal) concerns, we opted not explore this vector.Ī while ago one of my heroes, Tavis Ormandy mentioned on Twitter that uBlock Origin was vulnerable to CSS injection in their filter rules. We did find a technique to encourage malicious rule installation, but believe that the most plausible attack vector is a compromised filter list. Please note that these techniques assume a malicious rule has been installed. All vulnerabilities discussed in this post have been reported to uBlock Origin and patched. In this post, we'll show you how we were able to bypass these restrictions in uBlock Origin, use a novel CSS-based exploitation technique to extract data from scripts and attributes, and even steal passwords from Microsoft Edge.
These lists are not entirely trusted, so they're constrained to prevent malicious rules from stealing user data. Behind the scenes, they're powered by community-provided filter lists - CSS selectors that dictate which elements to block. Ad blockers like uBlock Origin are extremely popular, and typically have access to every page a user visits.
0 kommentar(er)
