OWASP AppSec EU 2013: I'm in ur browser, pwning your stuff
Channel: Christiaan008
Date: 2013-12-08

For more information and to download the video visit: http://bit.ly/appseceu13
Playlist OWASP AppSec EU 2013: http://bit.ly/plappseceu13

Speaker: Krzysztof Kotowicz

Browser extensions can let you easily make notes, entertain you with a game, or take an annotated screenshot of the website you're visiting. They can also XSS any website you're visiting, harvest your browsing history, replace your cookies, silently change your proxy or execute code on your machine. Even benign, legitimate extesions can do this, just because they were poorly coded. These flaws are fairly common, and the attacks are easy. In this talk meterpreter sessions will be opened, Google will be XSSed, all your mailbox will belong to us and your PGP private keys will be extracted. But as constructing attack payloads is so boring, we'll present tools that help you find vulnerable extensions, confirm the vulnerabilities and exploit them. After the talk you'll be set to go to either attack Chrome extensions or code them properly as multiple code examples will be given.

The presentation will consist of technical overview of Google Chrome extensions architecture, its built-in security mechanisms, inluding Content Security Policy. Focus will be given into bypassing the protections by leveraging poor extension coding, UI redressing attacks or side-channel attacks. Several flaws in popular Chrome extensions will be demonstrated, with varying consequences from universal XSS flaw to Remote Code Execution on clients machine. 

Having analyzed top 10 000 most popular extensions from Chrome Web Store, we will describe several identified vulnerability classes including, but not limited to:

* XSS in content scripts
* XSS in view pages
* Direct URL access
* UI interface spoofing
* DOM content extraction
* NPAPI binary vulnerabilities