Issue metadata
Sign in to add a comment
|
Security: Bypass of Google Safe Browsing in Chrome
Reported by
huub.r...@gmail.com,
May 24 2017
|
||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS Website builders, for example phishermen or malware coders, can easy BYPASS the Google Safe Browsing / Deceptive website warnings in Google Chrome using redirects to URL's based on data:text/html;base64 encoding with an iframe. While other browsers report an error Google Chrome is showing the final URL embedded in the base64 encoding, even when this final URL is in the Safe Browsing database. Criminals are using this bug in the wild. VERSION Chrome Version: [58.0.3029.110] + [stable] Operating System: [Windows 10 (64-bit) fully patched] REPRODUCTION CASE I was visiting a data:text/html;base64 based URL today. But you can test this with every reported phishing or malware site encoded within a data:text/html;base64 based URL. The redirector found in a phishingmail hXXp://95.110.172.211/aW5mb0BzZXJqYW4tdmxvZXJlbi5ubA0=/indes.php?sdsdgsdgsdg was redirecting to the URL 'data:text/html;https://www.ing.nl/particulier/index.html;base64,77u/DQoNCg0KDQoNCg0KDQoNCjxoZWFkPg0KCQ0KCTx0aXRsZT5JbmxvZ2dlbiBNaWpuIElORzwvdGl0bGU+DQo8Ym9keSBzdHlsZT0ibWFyZ2luOjBweDtwYWRkaW5nOjBweDtvdmVyZmxvdzpoaWRkZW4iPg0KICAgIDxpZnJhbWUgc3JjPSJodHRwOi8vbTJtLWVsZWt0cm9uaWsuY29tL2ltZy9hcHBzL3MvbmV3L2luZGV4MS5odG0iIGZyYW1lYm9yZGVyPSIwIiBzdHlsZT0ib3ZlcmZsb3c6aGlkZGVuO2hlaWdodDoxMDAlO3dpZHRoOjEwMCUiIGhlaWdodD0iMTAwJSIgd2lkdGg9IjEwMCUiPjwvaWZyYW1lPg0KPC9ib2R5Pg0KDQo8L2h0bWw+' Which means you will be guided to: Source: <head> <title>Inloggen Mijn ING</title> <body style="margin:0px;padding:0px;overflow:hidden"> <iframe src="hXXp://m2m-elektronik.com/img/apps/s/new/index1.htm" frameborder="0" style="overflow:hidden;height:100%;width:100%" height="100%" width="100%"></iframe> </body> </html> While hXXp://m2m-elektronik.com/img/apps/s/new/index1.htm was already in the Safe Browsing database. Chrome must show the 'Decptive website warning' here, but the phishing site was clearly visible. Same problem appears in the Mobile browser version. See attached files for examples.
,
Aug 31 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by kenrb@chromium.org
, May 24 2017Status: Duplicate (was: Unconfirmed)