🤖 AI Summary
Googleが Chromium ブラウザコードベースに存在する未修正の脆弱性に関する攻撃コードを公開し、数百万の人々が Chrome、Microsoft Edge、その他の Chromium オリジナルのブラウザを使用している場合に脅威となっている。
この攻撃コードは「Browser Fetch」というプログラミングインターフェースを悪用し、長期的なビデオなど大きなファイルをバックグラウンドでダウンロードすることが可能。アタッカーはこれを用いてユーザーの一部のブラウザ使用状況を監視する接続を作成したり、プロキシとしてサイトを見る機能やDDoS攻撃を実行できる。
この脆弱性は29ヶ月間 Chromium 開発者以外には知られていなかったが、Google がWednesdayにChromium バグトラッカーに公開したことで知られるようになった。攻撃コードは「Browser Fetch」APIを使ってサービスワーカーを開くことにより悪用され、ブラウザ起動後も再開または開いたままである。
この脆弱性はS1レベルで評価され、「サーモンルア」という独立した研究者が2022年末にGoogleへ報告し、一部の開発者から「深刻な問題」と認識されたという。攻撃コードは削除されたが、アーカイブサイト上では公開されている。
Google は脆弱性に関する情報や修正プログラムの提供時期については返答していない。
An anonymous reader quotes a report from Ars Technica: Google on Wednesday published exploit code for an unfixed vulnerability in its Chromium browser codebase that threatens millions of people using Chrome, Microsoft Edge, and virtually all other Chromium-based browsers. The proof-of-concept code exploits the Browser Fetch programming interface, a standard that allows long videos and other large files to be downloaded in the background. An attacker can use the exploit to create a connection for monitoring some aspects of a user's browser usage and as a proxy for viewing sites and launching denial-of-service attacks. Depending on the browser, the connections either reopen or remain open even after it or the device running it has rebooted.
The unfixed vulnerability can be exploited by any website a user visits. In effect, a compromise amounts to a limited backdoor that makes a device part of a limited botnet. The capabilities are limited to the same things a browser can do, such as visit malicious sites, provide anonymous proxy browsing by others, enable proxied DDoS attacks, and monitor user activity. Nonetheless, the exploit could allow an attacker to wrangle thousands, possibly millions, of devices into a network. Once a separate vulnerability becomes available, the attacker could use it to then compromise all those devices.
"The dangerous part here is that you can just have a lot of different browsers together that you can in the future run something on that you figure out," said Lyra Rebane, the independent researcher who discovered the vulnerability and privately reported it to Google in late 2022 in an interview. He said using the exploit code Google prematurely published would be "pretty easy," although scaling it to wrangle large numbers of devices into a single network would require more work. In the thread of Rebane's disclosure to Google, two developers said in separate responses that it was a "serious vulnerability." Its severity was rated S1, the second-highest classification.
Since its reporting 29 months ago, the vulnerability remained unknown except to Chromium developers. Then on Wednesday morning, it was published to the Chromium bug tracker. Rebane initially assumed the vulnerability was finally fixed. Shortly thereafter, he learned that, in fact, it remained unpatched. While Google removed the post, it remains available on archival sites, along with the exploit code. Google representatives didn't immediately respond to an email asking how and why it published the vulnerability and if or when a fix would become available. The exploit works by abusing Chromium's Browser Fetch API to open a service worker that remains persistently active. A malicious website can trigger it through JavaScript, creating a connection that can be used "for monitoring some aspects of a user's browser usage and as a proxy for viewing sites and launching denial-of-service attacks," reports Ars.
Depending on the browser, those connections "either reopen or remain open even after it or the device running it has rebooted," effectively turning the device into part of a "limited botnet."
Read more of this story at Slashdot.
ログイン
