The Meltdown of the Web.
Tags: security, webdev, javascript, opensource
Published: 2018-09-03 11:00:08

---
title: The Meltdown of the Web.
published: true
description: How to bypass firewalls, forge false evidences... and many other trivial browser exploits.
tags: security, webdev, javascript, opensource
---

As [Bruce Perens recently put it](https://twitter.com/BrucePerens/status/1035654154939641856), I'm "just a programmer".  
A [humble programmer](https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340.html). And a self-taught one.

A programmer that has learned how to program from a weird group of people whose core value is **curiosity**: the **hackers**.

So when I see a **security hole** affecting in various ways **billions of people**, I behave like a programmer. I try to fix it... or get it fixed. As soon as possible.

So a mounth ago, I wrote an article explaining how [the Web is still a DARPA weapon](https://medium.com/@giacomo_59737/the-web-is-still-a-darpa-weapon-31e3c3b032b8) (that sometimes backfire, as the Russiagate shows).

There I describe two dangerous flawns of the Internet and the Web.

Once I realized that **most security experts didn't understand the severity of the issue**, I talked about it with a [Mozilla developer](https://mastodon.social/@Shamar/100612439781128912) that suggested [to open an issue to Mozilla](https://wandering.shop/@callahad/100621620793416331/embed).

Thus I spent [two hours to write a detailed bug report](https://bugzilla.mozilla.org/show_bug.cgi?id=1487081), but it was soon closed (without saying if the Firefox users are vulnerable to such attacks or not), because

> Bugzilla is not a discussion forum.

On the suggested Lobste.rs thread ([cached here](https://shamar.github.io/documents/Mozilla-Bug1487081-Attachments/Undetectable_Remote_Arbitrary_Code_Execution_Attacks_through_JavaScript_and_HTTP_headers_trickery__Lobsters.html)), I asked if Firefox users are vulnerable to such wide class of attacks (several times) without getting a response.  

Instead I got several [sarcastic](https://shamar.github.io/documents/Mozilla-Bug1487081-Attachments/Undetectable_Remote_Arbitrary_Code_Execution_Attacks_through_JavaScript_and_HTTP_headers_trickery__Lobsters.html#c_dlubhc), [condescending](https://shamar.github.io/documents/Mozilla-Bug1487081-Attachments/Undetectable_Remote_Arbitrary_Code_Execution_Attacks_through_JavaScript_and_HTTP_headers_trickery__Lobsters.html#c_p4qxvi) and [even] (https://shamar.github.io/documents/Mozilla-Bug1487081-Attachments/Undetectable_Remote_Arbitrary_Code_Execution_Attacks_through_JavaScript_and_HTTP_headers_trickery__Lobsters.html#c_e4xjgu) - [insulting](https://shamar.github.io/documents/Mozilla-Bug1487081-Attachments/Undetectable_Remote_Arbitrary_Code_Execution_Attacks_through_JavaScript_and_HTTP_headers_trickery__Lobsters.html#c_2wvw4r) - [comments](https://shamar.github.io/documents/Mozilla-Bug1487081-Attachments/Undetectable_Remote_Arbitrary_Code_Execution_Attacks_through_JavaScript_and_HTTP_headers_trickery__Lobsters.html#c_0y21ub).  

Still, no response to such a simple question. Are Firefox users vulnerable?

When [I reported the same issue](https://bugs.chromium.org/p/chromium/issues/detail?id=879381) to Chromium team, [it was closed in less than ten minutes with the same tone](https://shamar.github.io/documents/Mozilla-Bug1487081-Attachments/ChromiumBug879381.html):

> Filing a bug here isn't the way to change web standards no matter how you feel about them.

It worth noticing here that **both Mozilla and Google are WHATWG members** and they write the [Living Standards](https://whatwg.org/working-mode) that we are talking about. Living Standards that basically **follow** the implementations.

To my money, this means that you have to fix the implementations to fix the standard... but remember, **I'm just a programmer**!

Now, I think I've been very clear about the wide class of attacks that JavaScript opens. When asked to, [I even carefully explained how simple is to fix them](https://medium.com/@giacomo_59737/i-compiled-a-detailed-bug-report-for-mozilla-where-i-described-some-of-the-possible-attacks-and-41843f7e84d8).

But since 

> this is the Web functioning as designed

<a name="PoC"/>

I want you to see **what the Web is designed for**.

# PoC of one of the many possible exploits (bypassing corporate firewalls)

Please add a **temporary** line to your C:\Windows\System32\drivers\etc\hosts containing

> 127.0.0.1 local.jsfiddle.net

This mimic the control of a DNS from the attacker.

Then try [this simple JSFiddle](http://jsfiddle.net/jgt9sd3e/) with a WHATWG browser.

You can change the port number at line 21 to test for any port on your PC.

You can change the IP in /etc/host to probe other machines on your LAN.

JSFiddle (the fictional attacker) has just **bypassed your corporate firewall/proxy**.

# Everything is broken.

This is just **one** of the **uncountably many attacks** you can do this way.  
I could go on **hours** inventing more attacks. And you should be able too.

EDIT: [`here you can find another exploit`](https://rain-1.github.io/in-browser-localhostdiscovery)

As explained in the bug report, you can target a specific person or group.  
Even over a CDN (thus through a third party site that the victim trusts).

And then you can reload an harmless script from the same url, rewriting the cache copy and **removing all evidences of the attack**.

It's really just a matter of **compentence** and **fantasy**.

Still I'm not going to find a [cool name](http://heartbleed.com/) or [draw puppets](https://meltdownattack.com/) to ["evangelize" about it](https://twitter.com/BrucePerens/status/1035617158984654848). I'm a programmer, **not a clown**.

# How can we fix it?

As I explained in the bug report, the **technical solution** is basically to 

- **make users opt-in to program executions** on a per-website basis
- threat such programs as potentially dangerous

You can read a [simple recap with details here](https://medium.com/@giacomo_59737/i-compiled-a-detailed-bug-report-for-mozilla-where-i-described-some-of-the-possible-attacks-and-41843f7e84d8).

However, what you can see here is **how deeply the Web is broken**.

This is not (just) about JavaScript.

This is about **[people](https://twitter.com/giacomotesio/status/1035908349903163392)**.