4 ms·

RCE Without Native Code: Exploitation of a Write-What-Where in Internet Explorer

54 points by twoodfin 7y ago

userbinator 7y ago
IE is one of the few remaining browsers that still lets you configure settings on a per-"zone" basis by default, with no need to install additional extensions to get this IMHO very useful function: https://evolpin.files.wordpress.com/2011/11/internet-zone.png https://evolpin.files.wordpress.com/2011/11/internet-zone.pn... That setting has been there since at least IE5, if I remember correctly; and it's also one of the things I always disable after a new install too. I think the fact that Microsoft clearly understood the idea of partitioning sites into different trust levels, with different levels of security for each, was an idea ahead of its time. They did not have the "JS is obligatory and you should trust all sites to run arbitrary code" attitude that unfortunately is prevalent today. ...then MS comes up with Edge and removes the feature completely, possible due to those developers with the aforementioned harmful attitude: https://answers.microsoft.com/en-us/insider/forum/all/microsoft-edge-site-security-zones/403c5b72-d0b9-4b8e-a20d-43c53781b0bf https://answers.microsoft.com/en-us/insider/forum/all/micros... Edit: did I say something wrong...?
- saagarjha 7y ago
  Firefox has some sort of “profiles” thing, does it not? Can you change settings per profile?
  - JadeNB 7y ago
    Behaviour per profile (loosely speaking, an identity) is different from behaviour per zone (a site or group of sites).
- ahje 7y ago
  It's actually a quite brilliant idea, but just like NoScript and other similar addons, it's simply too complicated for most users. Yes, you and I might be able to use it, but my grandmother can't. As the web is mostly built to be as accessible as possible, it won't catch on.
w0mbat 7y ago
I find “write-what-where” a little clumsy as a term. How about just calling it “POKE”, like when we were kids writing BASIC?
- saagarjha 7y ago
  Presumably the qualifiers are there to distinguish it from a more limited write primitive, which can still be quite useful.
  - adrianratnapala 7y ago
    But the POKE operation is specifically about writing to a given address. So it does capture what you are talking about. (Whether it is any clearer than "write-what-where" I leave as an exercise to the reader).
- adrianratnapala 7y ago
  The kids these days write JavaScript.
- breakingcups 7y ago
  I think a larger portion of the audience will understand "write-what-where"-primitive than "POKE" nowadays. "Write-what-where" might feel clumsy, it's a lot less ambiguous than a word like POKE, which only means something to the subset of programmers who grew up on BASIC.

54 points by twoodfin 7y ago

IE is one of the few remaining browsers that still lets you configure settings on a per-"zone" basis by default, with no need to install additional extensions to get this IMHO very useful function: https://evolpin.files.wordpress.com/2011/11/internet-zone.png https://evolpin.files.wordpress.com/2011/11/internet-zone.pn... That setting has been there since at least IE5, if I remember correctly; and it's also one of the things I always disable after a new install too. I think the fact that Microsoft clearly understood the idea of partitioning sites into different trust levels, with different levels of security for each, was an idea ahead of its time. They did not have the "JS is obligatory and you should trust all sites to run arbitrary code" attitude that unfortunately is prevalent today. ...then MS comes up with Edge and removes the feature completely, possible due to those developers with the aforementioned harmful attitude: https://answers.microsoft.com/en-us/insider/forum/all/microsoft-edge-site-security-zones/403c5b72-d0b9-4b8e-a20d-43c53781b0bf https://answers.microsoft.com/en-us/insider/forum/all/micros... Edit: did I say something wrong...?

saagarjha 7y ago
Firefox has some sort of “profiles” thing, does it not? Can you change settings per profile?
- JadeNB 7y ago
  Behaviour per profile (loosely speaking, an identity) is different from behaviour per zone (a site or group of sites).
ahje 7y ago
It's actually a quite brilliant idea, but just like NoScript and other similar addons, it's simply too complicated for most users. Yes, you and I might be able to use it, but my grandmother can't. As the web is mostly built to be as accessible as possible, it won't catch on.

w0mbat 7y ago

I find “write-what-where” a little clumsy as a term. How about just calling it “POKE”, like when we were kids writing BASIC?

saagarjha 7y ago
Presumably the qualifiers are there to distinguish it from a more limited write primitive, which can still be quite useful.
- adrianratnapala 7y ago
  But the POKE operation is specifically about writing to a given address. So it does capture what you are talking about. (Whether it is any clearer than "write-what-where" I leave as an exercise to the reader).
adrianratnapala 7y ago
The kids these days write JavaScript.
breakingcups 7y ago
I think a larger portion of the audience will understand "write-what-where"-primitive than "POKE" nowadays. "Write-what-where" might feel clumsy, it's a lot less ambiguous than a word like POKE, which only means something to the subset of programmers who grew up on BASIC.