[Full-Disclosure] Race conditions in security dialogs

[Jesse Ruderman <jruderman@xxxxxxx>]

I discovered arbitrary code execution holes in Mozilla, Internet 
Explorer, and Opera that involve human reaction time. One version of the 
attack works like this: the page contains a captcha displaying the word 
"only" and asks you to type the word to verify that you are a human.  As 
soon as you type 'n', the site attempts to install software, resulting 
in a security dialog with "Yes" and "No" buttons. When you type 'y' at 
the end of the word, you trigger the 'Yes' button in the dialog. [Demo 1 
below]

Another form of the attack involves convincing the user to double-click 
a certain spot on the screen. This spot happens to be the location where 
the 'Yes' button will appear. The first click triggers the dialog; the 
second click lands on the 'Yes' button. [Demo 2 below]

These types of attack work on any security dialog that can be triggered 
by untrusted content. The attack is most useful in a dialog where one of 
the buttons means "Yes, let this untrusted content run arbitrary code". 
Firefox has such a dialog in the form of the extension installation 
(XPI) dialog. Similarly, Internet Explorer has the ActiveX installation 
dialog and Opera has an "Open" button for downloaded executables. 
Programs other than browsers might also be vulnerable.

Mozilla's solution, from bug 162020, is to delay enabling the 
"Yes"/"Install" buttons until three seconds after the dialog appears.  
This works, but it's frustrating for users who install extensions often.

Another possible fix in web browsers is to treat all software 
installation requests like unrequested pop-ups.  When a site tries to 
install software, a status bar icon would appear, and only clicking that 
icon would activate the security dialog.  Rumor has it that IE in WinXP 
SP2 does something like this under some(?) circumstances.

The demos require Mozilla or Firefox and require that you go to 
about:config and change
signed.applets.codebase_principal_support to true.  You have to change 
this pref because I'm too lazy to make a demo using XPI (Mozilla), 
signed ActiveX (IE), or executable file download (Opera).

Demo 1 (captcha): http://bugzilla.mozilla.org/show_bug.cgi?id=162020#c25

Demo 2 (double-click): http://bugzilla.mozilla.org/show_bug.cgi?id=162020#c1

--
Jesse Ruderman
Mozilla project volunteer

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html