2015年10月2日星期五

Watch your Downloads: the risk of the "auto-download" feature on Microsoft Edge and Google Chrome

Probably it's commonly known that when you try to download something on your modern browser e.g. Google Chrome or Microsoft Edge, the file will be downloaded automatically to your local system with just a simple clicking - no need for additional confirmations. With default settings, the file will be downloaded to your "Downloads" folder ("C:\Users\<username>\Downloads").

Personally, I have worried about this feature quite some times, now I finally got some time on highlighting the risk for the public. (Please tell me if there's someone already talked about this, I quickly googled around and wasn’t able to find an appropriate one, I think it should be known by many ppl).

The "auto-download" feature is good from “user experience” perspective, but obviously it's not good for security, as the downloading could also be started by Javascript (<iframe src="url">). The attacker may just place a malicious DLL with a specific name into the "Downloads" folder when the victim visits a webpage he/she controls. In future, when the victim tries to download/install good programs (executables) from legitimate websites - of course, the good executable will be downloaded, and will be launched from the "Downloads" folder as well - then the installation/execution progress could be hijacked.

This is because that in the real world, most executables rely on dlls. The "application directory" is the very first place in the search order when searching/loading for a dll (you may want to check this paper I released years ago). So, probably, most of dlls even the system dlls could be hijacked when you place a same-named dll in the executable’s directory, and that's not for the situation that the searched dll doesn't exist anywhere on the system.

Usually, the "Downloads" folder is a place with massive downloaded files, so the victim probably never get a change to realize there is a malicious DLL sitting in his/her "Downloads" folder. I’d also doubt that even if a normal user notices a strange dll sitting in his/her "Downloads" folder, will he/she really delete it immediately? People may think that DLLs won’t be executed by themselves anyway, right?

Anyway, in the real world, for most people, who really check their "Downloads" folder every time when they try to install something from internet? Instead, most people just click the "Run" button directly when installing something (see following figure).



I have quickly made a video showing this risk. The test environment is Windows 10 Pro, with Microsoft Edge and Google Chrome, fully updated as of Oct 2nd, 2015, all with default settings. Check it out here.



As you may have noted, a modified “VERSION.DLL” will be dropped into the “Downloads” folder when visiting the webpage https://dl.dropboxusercontent.com/u/14747595/auto_download_test/test.html. Then, when the user tries to install Adobe Reader from the official adobe.com website, the installation process of Adobe Reader will be hijacked - the modified “VERSION.DLL” will be loaded and my shellcode will be executed.

There’s one small thing, the code execution should be run out of the browser sandbox, but unluckily the tested shellcode I copied from internet runs calc.exe, and because there’s no calc.exe anymore on Windows 10, what you’ve seen it’s just a Calculator App which runs within the App Container sandbox. Other shellcode, for example, running notepad.exe, will be run out of the App Container sandbox and give attacker the control of your system. #BringTheLovelyCalcBackMicrosoft!

Also note that with default setting, the Microsoft Edge will promote a warning dialog saying the DLL is dangerous, offering the user an option to delete the file.



But:

1) Anyway, the DLL has been already dropped into the "Downloads" folder, if the user chooses not to delete the file or just do nothing, future execution will still be hijacked.
2) I also guess this Microsoft Edge warning could be bypassed if the DLL is a signed DLL, but I don't have a certificate to test.

On Google Chrome, as you have seen, there's no warning at all.

[Updated on Oct 3rd, 2015 for Mitigations]
There's actually an option on Google Chrome (Settings => Show advanced settings => Ask where to save each file before downloading). As the name suggests, if you enable this, you will have a chance to check before every downloading. If you see some website asking you to download especially a DLL, you'd better DON'T ALLOW.

I haven't figured out a way for similar mitigation on Microsoft Edge, have pinged Microsoft, will updated if I find any.

Also please note that just changing the default "Downloads" folder to other folder does NOT mitigate this risk.

Thanks,
Haifei

82 条评论:

  1. Nice! I really enjoyed reading your post. Thanks for sharing and keep up the good work.

    Dell Notebook repairs & HP Laptop repairs



    回复删除
  2. Just call on Adobe Support (Toll Free +1-877-339-8403) For Adobe Flash Player Update, install, Download Or other technical issue. Get Online Technical Help by Our Experts.

    回复删除
  3. Call +1-877-339-8403 Adobe Support Phone number and Get Online Technical solution for Your All Adobe Products and Versions like Adobe Flash Player, Acrobat, Light Room, Illustrator etc.

    回复删除
  4. Hello! Very good article! You're a great expert! I am currently working on advertising management system for innovative advertising agencies.

    回复删除
  5. Adobe Flash Player Support Avails Customer Care Support Phone Number at 1-877-339-8403 and get Adobe Flash Player Technical Support Helpline Number for any issue.

    回复删除
  6. Contemporary watches with sophisticated simplicity. Here are options for watch, fashion watch, minimalist watch, sleek watch, men's watches, ladies' watch, cheap watch, CA, nice watch and dress watch.

    回复删除
  7. Nice information...you blog...
    Today, mostly people need Microsoft technical support to troubleshoot their Windows operating system problems. Because, most of people use Microsoft™ windows® product. Dial 1-800-723-4210 at windows tech support for Microsoft windows 10 support from online technical experts by 24/7


    Microsoft Tech Support

    回复删除
  8. Microsoft Windows XP Support, Microsoft Windows Vista Support, Microsoft Windows
    7 Support, Microsoft Windows 8 Support, Microsoft Windows 8.1 Support, Microsoft Windows 10 Support
    Microsoft Windows customer care

    回复删除
  9. I just got a product key from www.vanskeys.com. it worked perfectly. I'm so excited to share my experience here. their customer service is 1st class and I will definitely be recommending the site and I will be using the site again.

    回复删除
  10. Its very useful post for me, and hope this will be helpful for people in future. Thanks for share this. Get help for Dell Printer
    Dell Printer Support Number UK
    Dell Printer Contact Number UK

    回复删除
  11. Thank a lot for this post that was very interesting. Keep posting like those amazing posts, this is really awesome
    massive vst crack windows
    7RwCrack

    回复删除
  12. Accomplishing your daily works with the help of Adobe Application on your computer, but technical issue are still found in during its use, so you must talk to the technical experts at 0800-090-3220 to get an accurate solution. Adobe Helpline Number UK

    回复删除
  13. Thanks for sharing nice information with us. Call us at 0800-368-6133 Kaspersky Support Number UK and Kaspersky Helpline Number UK get quick and satisfied solution.

    回复删除
  14. Office 2016 Product Key

    In order to activate your Windows 10 key, you just need to get a product key from the site http://www.MsKeyHome.com/ . It's the legal copy and you will experience a good after-sale service. The site not only provides product key for Windows 10 key, but also windows 8 and so on. If you have any technical problem, you also can contact the service department online. Don't worry. Any such problem, just contact them and you will get support.

    Office 2016 Product Key

    回复删除
  15. Amazing, Such a very useful blog. Here we provide superb quality antivirus service. When technical issues occurred on Norton antivirus, no need to take tension and contact with expert technicians they will help you in resolving all sorts of technical issues. Dial 0808-238-7544 Norton Support Number UK and get instant help.

    回复删除
  16. Nice post I really like it. Call us at Adobe Help Number UK and Adobe Support Number UK to get quick and satisfy solution.

    回复删除
  17. Very Nice Post! We all know that Microsoft Office has various applications and any of it application can stop working due to technical issue. When such a thing happens with you, connect with our technical team at Microsoft Help Desk UK.

    回复删除
  18. Every computing device now trusts Windows as an operating system. But it too sometimes, become so intrusive and starts generating some unknown errors. You can get them rectified in a short time period when you contact the tech executives at Windows Technical Care for UK. They take it as their responsibility to fix your errors.
    Windows Support Number UK

    回复删除
  19. Microsoft is an amazing attempt acknowledged as the most desired in the market. When it becomes difficult to handle the complications arriving in it, you should talk to the well trained team of tech personalities at Microsoft Customer Care Number in the UK.

    回复删除
  20. A printer user will definitely feel the need of a printer technician at some point of time. If your HP Printer is also showing tantrums to you then feel free to connect with us on HP Printer Technical Helpline Number UK .

    回复删除
  21. If you are facing problem while open a Pogo games account than you can contact on Pogo Support Number
    Pogo games not loading

    Pogo support number

    回复删除
  22. Adobe products have been existing sometime when it comes to the error you can get in touch with Adobe Dreamweaver Tech Support Number 1-855-676-2448 as experts are available all time.

    https://adobe-support-phone-number.webnode.com

    回复删除
  23. Microsoft programs sometimes, get you some unknown errors that you won’t able to solve of your own. In such situation, you can take help from the well trained team of tech executives at Microsoft Technical Helpdesk in the UK. They put forward the best they can for resolving the issue you are confronted with.
    Microsoft Support Number UK

    回复删除
  24. There may be some employees in your office that are using your business printer for their personal use. If one or two employees are doing so then it won’t cost you must but if a 20-30 employees are doing the same then it might cost you much. Read this blog and learn how to track print job in a better way. To know more about printer, feel free to visit: Canon Printer Technical Helpline UK.

    回复删除
  25. Whether it is about Microsoft Office or Office 365, both are widely used in homes and offices. Users can definitely face complications with its components like Word, Excel or PowerPoint. You can connect with software experts on Microsoft Help Number UK and consult with them to resolve any issue with any Office component.

    回复删除

  26. If you're looking for Norton Setup you'll be able to Easily call us 800-368-7751, and get Quick support for Norton Set up also www.setupnorton.co.uk is most beneficial and affordable for your home and commercial use.We will be the best and affordable Norton support company.

    回复删除
  27. I am feeling satisfied by the solution given in this blog. In case, you find some other difficult situation, just consult our professionals at Microsoft Contact Support Number UK.

    回复删除
  28. The user might face some XYZ form of difficulty in the operation of Adobe software. Engineer and another representative of Adobe have been very instrumental in making sure that objective of the software is achieved. Presence of Adobe Helpline Number UKis the ideal form of source for learning about solutions in reference to activation issues arising inside the Adobe Software.

    回复删除
  29. Kodak manufactures has introduced a vast range of printers that offers best printing devices across the market. In case, you want to correct the technical errors, you must dial at Kodak Printer Customer Care Number UK for quick assistance. They will value you and answer in every possible manner.

    回复删除
  30. Adobe has various multimedia products such as Adobe Photoshop, Reader or Acrobat, Flash, Illustrator, Dreamweaver and many more. All these products have proved to be really helpful but they are definitely prone to technical issues and these technical issues can be resolved at Adobe Customer Support Number via software experts.
    Adobe Support Number

    回复删除
  31. I am feeling glad that I land up to this post. We also work for HP Printer users, they can contact us on HP Printer Customer Support Help Number UK if in case they are having any question about the product.

    回复删除

  32. Mostly all the escorts are available online for booking. You can select and book them as per you convenience and availability. Either you can go to meet the Karachi Escorts in 5 star hotels or the girl with reach out to your place. Since Pakkistan is a metro city it has urbanized way ahead of other small cities in Pakistan.Escorts in Karachi mainly focused about the tourist but that does not imply they do not deal with local people.

    回复删除
  33. Our Adobe Customer Support, Service & Help you in getting rid of the commonly technical problems. We are available round the clock on Adobe technical support number 1-800-301-3935.

    Adobe Support Number
    Adobe Tech Support Number
    Adobe Customer Service number
    Adobe Help Number

    回复删除
  34. nice information with us. Call us at 0808-168-9042 Kaspersky Support Number UK and
    Kaspersky Help Number UK get quick and satisfied solution.

    回复删除
  35. The combination of all the working units of Adobe has so nicely being united, that is the result of Adobe software functioning correctly. If the user still wants to communicate then just bank on Adobe Helpline Number UK. Professionals have a lot of expertise in ensuring the user will not have any difficulty in the operating of Adobe software.

    回复删除

  36. When the situation becomes tough and you can’t deal with the disturbing issues of Kaspersky security, you must get in touch with the experts. Call at Kaspersky Technical Care Number UK and they will offer the best workaround for whatever problem you have come across.

    回复删除
  37. Adobe users can now find fast and effective solution for their problems related to any of Adobe application on Adobe Contact Number UK. At this number, you can ask anything from our software engineers that are related to Adobe application and we assure you that they will definitely answer your query.

    回复删除
  38. Well done to the writer of this blog. We understand people worries that’s why we have also opened a 24/7 helpline for all HP Printer user. You can connect with us on HP Printer Customer Care Number UK to access immediate help.

    回复删除
  39. Hello, friends, I am Alex Smith. I am working with the technical support team. Friends we provide the best and online technical assistance. If you further trouble in HP devices and you need some help, contact to our technical support because we provide the different- different technical support for the users such as HP devices support and Lexmark printer technical assistance. Just dial our technical support number and discuss your doubt or issues with us.
    For more help dial our technical support number:-
    Lexmark customer service number


    Lexmark support number


    Lexmark customer service number

    HP technical support number

    HP customer care number

    HP helpline number

    HP printer customer support

    回复删除
  40. nice blog with valuable information....thanks for sharing..
    Quicken Support Phone Number

    回复删除
  41. My printer suddenly started giving out low quality prints the ink levels were fine paper feed was fine too I was unable to figure out the cause and solution but then I read this informative piece given here and now my printer is back to normal. One can also reach the technicians at printer support number uk. Brother Printer Phone Number UK

    回复删除
  42. hank you so much for sharing this valuable information here I am very much sure that this will help many people as there is a huge population that gets stuck with the techniques. I will be glad if you will keep sharing informative pieces like this often if in case your Epson printer starts giving out low quality prints or any other issue comes up while you are operating HP printer then reach the experts at HP printer help number uk

    回复删除
  43. Kaspersky is an antivirus software that keeps all the systems and devices safe from all types of malware, spyware Trojans and all such unwanted elements. As this software is based on many advanced technologies therefore if it ever puts you into any technical trouble then connect at Kaspersky Helpline Number UK

    回复删除
  44. Nice blog! It is very informative for Printer users. Hurry Up! Call for HP Printer Support. If Your Printer create any technical error in printing. Give us a call at Hp Printer Customer Support UK or Hp Printer Toll Free Number UK and get instant support.

    回复删除
  45. Are frequent error prompts from BullGuard Antivirus becoming a cause of concern for you? Has your BullGuard Antivirus yet again stopped updating automatically? Are you facing problems in installing or uninstalling BullGuard Antivirus? Are you still getting adware and malware prompts even after installing BullGuard Antivirus? We offer round the clock BullGuard Support for all such problems. We have a team of highly skilled and experienced BullGuard Technical Support experts who can resolve all such problems quickly. You get high-quality BullGuard Antivirus Help 24 X 7 at the most affordable prices whenever you want. Call us now for help.
    Bullguard Support Number

    回复删除
  46. Avast is a security providing software its assigned task is to protect the systems from all the infections malware, spyware Trojans and viral attacks. So, it is actually normal if Avast shows up frequent security alerts therefore, if you are getting repeated alerts then it is advisable that you conduct a proper scan on the system. However this will help only if the alerts are getting displayed only on some particular program because then in that case there are high chances of that particular program being infected. If this is not the case then you can simply disable the repeatedly coming up security alerts and continue working.Avast antivirus showing frequent security alerts

    回复删除
  47. system users around the globe are technically sound therefore most of them face many difficulties while performing basic actions of installing and uninstalling of the antivirus. But now such users can take a sigh of relief as the technical support team is here to help them with proper step wise guidance over the same procedures be it installing or uninstalling they will now be able to do it in minutes and up to total accuracy.
    Technical help in installing or uninstalling the antivirus

    回复删除
  48. nice blog with valuable information...thanks for sharing such a great post with us...
    quicken 2018 installation problems

    回复删除
  49. Thanks for sharing with us, keep sharing more valuable information and Get technical support for Printer visit at HP Printer Help Number Uk & Epson Printer Contact Number Uk

    回复删除
  50. This information given here made it easy for me to get my antivirus fixed. It is finally back to normal working. For any problem related to BullGuard. click here:
    Bullguard Help Number UK
    Bullguard Contact Number UK
    Bullguard Support Number UK

    回复删除
  51. If you are looking to Adobe Support Number to solve your issues, please get in touch with our highly qualified experts to get the best support service at highly reasonable cost. Adobe Installation Phone Number, Adobe Support Number and get instant solution.
    To know more, you can visit our Website: https://www.callsupportnumber.net/adobe-customer-service

    回复删除
  52. Glad to read the post, it is written very well with all the information properly included.Yahoo Customer Care Number UK

    回复删除
  53. This type of informative stuff is very much in need nowadays, keep writing and keep posting.Microsoft Customer Service Number UK

    回复删除
  54. Norton antivirus has in its association a lot of complicated technical procedures, if in case you are stuck with the issue as to how you can access your Norton account then all that is to be done is enter your e- mail address and password , if in case you do not have an account then click on ‘’create account’ ‘ if in case you already have an account then an option will appear that would ask if you want your password and e- mail address to be remembered or not then choose your preference and click the option ‘’’sign- in’’.Norton help Number UK

    回复删除
  55. Avast antivirus is the easiest of all the antivirus software when it comes to usage. For scanning a PC using Avast antivirus open the user interface click protection click scan then from the list that appears select your preferred scan type and then further follow the on screen instructions as they appear. If in case you get stuck at some point while following the instructions appearing on screen you can easily connect to the technical team and get your problem resolved by trained and certified experienced technicians at the earliest and in the easiest manner possible.Avast Customer Care Number Uk

    回复删除
  56. The above given error is very commonly observed by the users as they operate this antivirus. This usually appears if there is another security program running on the system uninstalling that will automatically solve the issue. If that is not the case then conducting a proper repair of AVG will do the needful. For repairing AVG go to start click ‘’control panel ‘’ open programs click the option ‘’program and features’’ select AVG from the list click ‘’change’ ’ further click ‘’repair’’. If still you are unable to get your antivirus fixed then ask advice from experts at AVG tech support.AVG Toll-Free NUmber UK

    回复删除
  57. I was in search of a piece like this from last few days; the information given here is written very well and is easily understandable and any technical support for printers visit at HP Printer Help Number UK & Epson Printer Contact Number Uk

    回复删除
  58. We Provide the best technical support for Kaspersky antivirus, Call For Kaspersky Customer, Customer Support For Kaspersky, 24/7 Technical support team available:- kaspersky Support Number | kaspersky Customer UK

    回复删除
  59. Great Blog!Dial Kaspersky Help Number UK to get all the problems with your Kaspersky antivirus solved within no time.

    回复删除
  60. I was worried about how will I get my AVG updated as my son is out of town and I am not that much technically sound but then I read this post given here and it helped me a lot I could easily get AVG updated on my own.
    AVG Help Number UK

    回复删除
  61. HP Printer can put you to stake sometimes when technical errors come your way. In case, you won’t able to deal with such issues, contact the technical team at HP Printer Technical Care Number UK and detail them your main concern so that they can resolve the situation in the shortest time period possible.
    HP Printer Helpline Number UK
    HP Printer Support Number UK
    HP Printer Contact Number UK

    回复删除
  62. This write up given here is really very helpful for those who are looking for some genuine technical support like me, resolving my issue became magic as I finished reading this. keep posting such information often.
    Gmail Support Number UK | Gmail Help Number UK

    回复删除
  63. This blog is really very well written and is very much informative helped me a lot in understanding complex AVG technicalities easily.
    Avg Support UK | Avg Customer UK | Avg Refund UK

    回复删除
  64. This post written here is undoubtedly very much helpful for the antivirus users around the globe, but it will be more appreciated if people will also share some practical videos of procedures like installation of the software as it will be more helpful.
    kaspersky Customer Care Number UK | kaspersky Support Number UK | kaspersky Help Number UK

    回复删除
  65. Nice post ! thank you for sharing this information,I am also want to introduce about a number, If you need of technical help to Set up the Wired Printer, you can contact us at 0808-169-3104 HP Printer Help Number UK any time you need and we are there to serve you the best solution.

    回复删除