A cute cover for a dangerous vulnerability. [Research Saturday] - CyberWire Daily

Summary

CyberWire Daily: A Cute Cover for a Dangerous Vulnerability [Research Saturday]

Release Date: January 18, 2025

Introduction

In the latest episode of CyberWire Daily, host Dave Bittner engages in a deep dive with Nati Tal, Head of GuardioLabs, discussing a groundbreaking research paper titled "Cross Exploiting a Zero Day Opera Vulnerability with a Cross Browser Extension Store Attack." This episode, part of the Research Saturday series, uncovers how seemingly benign browser extensions can mask severe cybersecurity vulnerabilities.

Understanding Private APIs in Chromium-Based Browsers

At the 04:07 mark, Dave Bittner sets the stage by asking Nati Tal to elucidate the concept of private APIs:

Dave Bittner [04:07]: "Well, before we dig into some of the details here, for folks who might not be familiar with private APIs and what they enable, can you give us a quick explanation of what they are and how they work?"

Nati Tal responds by explaining that private APIs are specialized interfaces within Chromium-based browsers like Opera and Chrome. These APIs grant elevated privileges to specific domains, such as the Chrome Store, allowing functionalities like extension installations and management.

Nati Tal [04:18]: "Those APIs are not public, not everybody can use them. Only those that have the permission to create a web app and deploy it to the domain where Chrome Store is running now."

Discovery of the Opera Vulnerability

At 01:59, Nati outlines the initial discovery process:

Nati Tal [01:59]: "If you're already there under the hood of Chromium, you find some stuff that looks suspicious or look like vulnerable for exploitation. And one of those things was the use of private APIs."

Their research focused on Opera, a Chromium-based browser, where they identified excessive customizations and the use of privileged domains. This setup, though functional, presented a significant security flaw.

Exploiting the Vulnerability Through Browser Extensions

Delving deeper, Nati Tal explains how they exploited the vulnerability using malicious browser extensions:

Nati Tal [06:17]: "We saw those customizations and the use of specific privileges on domains owned by Opera and we realized that...in this method gain privilege escalation, basically on everything that Chromium can offer you."

The team leveraged content scripting, a feature that allows extensions to inject code into web pages. By creating a malicious extension, they could inject unauthorized scripts into privileged domains, thereby escalating privileges across the browser environment.

The "Cute Puppies" Malicious Extension

A pivotal part of the research involved developing a seemingly innocuous extension dubbed "Puppies."

Nati Tal [09:30]: "What it did was something like the benign feature of just creating or rendering cute puppies all over your screen."

This extension, while displaying adorable puppies, secretly injected malicious code into the browser, exploiting the previously identified vulnerability. The simplicity and harmless appearance of the extension made it an effective vector for the attack.

Deployment and Impact of the Malicious Extension

Nati elaborates on how easily the malicious extension bypassed security measures:

Nati Tal [13:18]: "It took us like a few days to code this kind of fix, get it deployed and tested and it was deployed to all users in a matter of two weeks, even less."

By creating and uploading the "Puppies" extension to the Chrome Store within approximately 20 minutes, the team demonstrated how swiftly and effortlessly such malicious extensions could proliferate. Once approved, the extension could be distributed through various channels, including malvertising and pop-up ads, potentially compromising thousands of Opera browsers.

Collaboration with Opera and Mitigation Measures

Upon discovering the vulnerability, GuardioLabs promptly disclosed it to Opera, leveraging their established rapport with the engineering team.

Nati Tal [18:15]: "We also discussed with the Opera engineering about how they're going to mitigate this kind of vulnerability."

Opera responded swiftly by disabling content scripting on the affected domains, effectively neutralizing the vulnerability within two weeks. This rapid response underscores the importance of proactive collaboration between cybersecurity researchers and software developers.

Implications and Future Directions

Nati Tal emphasizes the broader implications of their findings:

Nati Tal [18:08]: "We realized that if those extensions go there, we really need to understand how easy it is or why it is so easy to use this kind of method and deploy malicious extensions."

The research highlights the delicate balance between browser customization and security. As extension ecosystems expand, ensuring rigorous vetting processes becomes paramount to prevent malicious actors from exploiting underlying vulnerabilities.

Conclusion

This episode of CyberWire Daily sheds light on a sophisticated method of exploiting browser vulnerabilities through seemingly harmless extensions. Nati Tal and the GuardioLabs team not only uncovered a critical flaw in Opera but also demonstrated the ease with which malicious extensions can be deployed across Chromium-based browsers. Their proactive approach in researching, disclosing, and collaborating with Opera serves as a model for cybersecurity best practices, emphasizing the need for continuous vigilance in an ever-evolving digital landscape.

For a detailed read, access the full research titled "Cross Exploiting a Zero Day Opera Vulnerability with a Cross Browser Extension Store Attack" here.

Transcript

Dave Bittner (0:02)

You're listening to the Cyberwire network, powered by N2K. And now a message from our sponsor. Zscaler, the leader in cloud security. Enterprises have spent billions of dollars on firewalls and VPNs. Yet breaches continue to rise by an 18% year over year increase in ransomware attacks and a $75 million record payout in 2024. These traditional security tools expand your attack surface with public facing IPs that are exploited by bad actors more easily than ever with AI tools. It's time to rethink your security. Zscaler 0Trust AI stops attackers by hiding your attack surface, making apps and IPs invisible, eliminating lateral movement, Connecting users only to specific apps, not the entire network. Continuously verifying every request based on identity and context. Simplifying security management with AI powered automation and detecting threats using AI to analyze over 500 billion daily transactions. Hackers can't attack what they can't see. Protect your organization with Zscaler Zero Trust and AI. Learn more@Zscaler.com Security hello everyone and welcome to the Cyberwires Research Saturday. I'm Dave Buettner and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems and protecting ourselves in our rapidly evolving cyberspace. Thanks for joining us.

Nati Tal (1:59)

If you're already there under the hood of Chromium, you find some stuff that looks suspicious or look like vulnerable for exploitation. And one of those things was the use of private APIs. It's like a customization method in Chromium that a developer can use to integrate new capabilities for developers, the web applications.

Dave Bittner (2:23)

That's Nati Tal, head of Guardiolabs. The research we're discussing today is titled Cross Exploiting a Zero Day Opera Vulnerability with a Cross Browser Extension Store Attack.

Nati Tal (2:42)

So we see this type of customization and we already did think that, okay, it's something that needs to be handled extremely with care and as such we will probably find some vulnerabilities out there in those areas. So to make sure this is not the case and everything is safe, we started to dig deeper on different Chromium based browsers. One of those was Opera. And quite quickly we realized that there are many customizations over there and this is exactly what happened. We saw those customizations and the use of specific privileges on domains owned by Opera and we realized that okay, it works well, but there is a problem there because when you do such a customization, you need to be extra careful with protecting your own domains for misuse One of those kinds of misuse is actually what we found using other extensions, malicious extensions, in this case, to abuse or even exploit this type of permissive domains, inject your own code to those domains and in this method gain privilege escalation, basically on everything that Chromium can offer you.