New issue
Advanced search Search tips

Issue 714051 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Apr 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Security



Sign in to add a comment

Spoof with Google Translate

Reported by jm.acun...@gmail.com, Apr 21 2017

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Steps to reproduce the problem:
The spoof is credible because it is based on the interaction of the user by clicking on the icon of the address bar of the browser, action totally independent of the web page that is viewing.

1- Go to http://createcharts.esy.es/spoof-translate.html
2- Click the translation icon in the address bar
3- Click on the Reload button

The Reload button show a layer with Google credentials to redisplay the page.
The message could be: "Please sign in to Google to re-establish the service"

What is the expected behavior?

What went wrong?
An html element with id = "goog-gt-tt" and class = "skiptranslate" causes error in ajax requests and hides the content of the element.

Did this work before? N/A 

Chrome version: 58.0.3029.81  Channel: stable
OS Version: 6.3
Flash Version: Shockwave Flash 25.0 r0
 
Does not play in Google Chrome Versión 60.0.3076.0 (Build oficial) canary (64 bits)
Components: UI>Browser>Translate
Can you add screenshots showing where you think there's a problem?

I /think/ the weakness you're identifying here is that the user might be confused and think that markup they see after clicking "Translate" is coming from Google while in reality it's supplied by an attacker? And the user might react to the "fake" error page by supplying their Google credentials?

The omnibox isn't spoofed at any point, right?

Comment 3 by mea...@chromium.org, Apr 22 2017

Labels: Needs-Feedback
1) Can you add screenshots showing where you think there's a problem?

- Not necessary, the test case is well explained

2) I /think/ the weakness you're identifying here is that the user might be confused and think that markup they see after clicking "Translate" is coming from Google while in reality it's supplied by an attacker?

- Totally agree

3) And the user might react to the "fake" error page by supplying their Google credentials?

- It is likely that certain users will enter their credentials

4) The omnibox isn't spoofed at any point, right?

- It is clear that no
Project Member

Comment 5 by sheriffbot@chromium.org, Apr 24 2017

Cc: mea...@chromium.org
Labels: -Needs-Feedback
Thank you for providing more feedback. Adding requester "meacer@chromium.org" to the cc list and removing "Needs-Feedback" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
When I asked for screenshots, it's because you filed this bug feeling that there's a compelling spoof; screenshots might help make that case. 

I do not experience anything I would consider a spoof here.

Comment 7 by meacer@google.com, Apr 25 2017

Status: WontFix (was: Unconfirmed)
Based on the description in comment #4, there doesn't seem to be a spoof of browser chrome or the omnibox, so closing as WontFix.

jm.acuna73@: If you could provide screenshots pointing to an omnibox spoof we can reopen the bug, thanks.
Components: -UI>Browser>Translate UI>Browser>Language>Translate
Project Member

Comment 9 by sheriffbot@chromium.org, Aug 1 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment