#HITBCyberWeek #CommSec Call Of Duty: Modern Browser Warfare

### Overview In this presentation titled "Call Of Duty: Modern Browser Warfare," Dheeraj Mishra presents his research on web browser security, focusing on bypassing core browser policies rather than traditional deep exploitation. Mishra begins by reviewing the high-level architecture of a modern browser—including the user interface, browser engine, rendering engine (networking, JavaScript interpreter, UI backend), and data persistence layers—before examining the Same-Origin Policy (SOP) and presenting vulnerabilities across multiple modern browsers.

### Key Topics - **Browser Architecture & Same-Origin Policy (SOP):** Mishra explains origins (scheme, hostname, port) and SOP's role since 1995 in preventing unauthorized data exchange between differing origins. - **SOP Bypasses & Metasploit Porting:** Vulnerabilities in Samsung Internet Browser and DuckDuckGo privacy browser where `window.open` and `innerHTML` manipulation allowed spoofing origin content and phishing user credentials. Mishra demonstrated porting these into Metasploit (`auxiliary/gather/samsung_browser_sop_bypass.rb`), capturing credentials via `store_cred` or injecting payloads via `custom_js` / BeEF's `hook.js`. - **Code Execution & Firefox Flaws:** Analysis of `nsILocalFile` in Firefox used via web console / contract ID to invoke `cmd.exe` (reported but marked duplicate), an integer underflow in the certificate database (`cert8.db`) within the NSS library causing crashes on long metadata keys (patched in `sec_asn1e_split`), and a post-logout sensitive data leakage issue due to improper cache handling. - **Low-Hanging Fruit & Spoofing:** Safari trackpad swipe-right gesture viewing pre-logout session data; DuckDuckGo address bar omnibox spoofing via `setInterval`; Safari's rendering of emoji domains (e.g., padlock emoji phishing) versus punycode; and IDN homograph attacks. - **Webview Exploitation:** Denial-of-service vulnerabilities in IBM Lotus Notes' built-in webview via infinite loops (`while(try/catch)`) and repeated file manager prompt triggers, also ported to Metasploit modules.

### Technical Details - **Samsung & DuckDuckGo SOP Bypass:** Script calls `window.open` on a legitimate target URL (e.g., `google.com/csi`) and rewrites child tab `document.body.innerHTML` with a spoofed login prompt, sending captured credentials to the attacker. - **Firefox nsILocalFile:** Creating an instance via `@mozilla.org/file/local;1` allows initializing a local file path (`C:\windows\system32\cmd.exe`) and executing `f.launch()`. - **Certificate DB Integer Underflow:** While visiting an Nginx server with a malformed certificate, Mozilla's `cert8.db` implementation lacked input validation on key length metadata, causing an integer underflow/segmentation fault. - **Cache Leakage:** Visiting a post-login URL (e.g., Gmail's `/mail/u/0`) via `view-source:` after logout retained sensitive plaintext emails in memory until Mozilla implemented stricter `Cache-Control` cleanup.

### Takeaways Mishra recommends researching browser security through DOM fuzzing (referencing Google Project Zero), sandbox escaping, source code audits of open-source browsers, compiling browsers with AddressSanitizer (ASan) for daily use to catch memory crashes, and reviewing public Chrome and Mozilla bug advisories.