18 ms·

Google has a secret browser hidden inside the settings

914 points by matan-h 3y ago

MH15 3y ago
This is telling on my age, but I loved these hacks as a young teenager on early versions of iOS. Parental control existed but didn't touch all areas of the platform.
andreasha 3y ago
TIL mobile JavaScript console https://eruda.liriliri.io/ https://eruda.liriliri.io/
- Aulig 3y ago
  I found that really interesting too. I've often wanted something like that!
  - robin_reala 3y ago
    Used to use Firebug Lite to get the equivalent in IE6: https://web.archive.org/web/20141217201617/http://getfirebug.com/firebuglite https://web.archive.org/web/20141217201617/http://getfirebug...
- taopai 3y ago
  This is awesome. I hope there is a way to auto load a script so I can make some simple extensions.
- wahahah 3y ago
  I'll sometimes go through the trouble of using `data:text/html,<script></script>`, but that is impressively replete.
- cs02rm0 3y ago
  That's mega. Doesn't work for me in Brave on iOS, but does in Safari, I'll take that.
- alufers 3y ago
  There even is a "remote version" of this by the same person: https://github.com/liriliri/chii https://github.com/liriliri/chii By using it you can open the devtools on another computer and all the information is synchronized over WebSockets. I used it once to debug an issue on a customers machine.
- tuukkah 3y ago
  A bookmarklet would be nice. This is how the current developer tools in browsers started (Firebug).
  - djbusby 3y ago
    Oh, Firebug! Blew my mind when I first saw it. No more View Source for me!
  - 8ig8 3y ago
    Bookmarking included in the project README… https://github.com/liriliri/eruda#demo https://github.com/liriliri/eruda#demo
    - tuukkah 3y ago
      Thank you! I must have expected an embed code and missed the javascript: part.
- lopkeny12ko 3y ago
  Is it just me or does this completely not work? When I paste the Javascript snippet into the address bar, nothing happens. And in Nightly it just performs a Google search with that string.
  - eNV25 3y ago
    Try putting it in a bookmark and then execute it.
    - lopkeny12ko 3y ago
      How is this supposed to work? Opening the bookmarks page navigates away from the current page. Even then, selecting the bookmark does nothing.
      - hgsgm 3y ago
        Works in Firefox, not Chrome. Android. 1. Bookmark any page, making a dummy 2. Menu > Bookmarks > edit 3. Change URL of dummy bookmark to the js bookmarklet code. 4. Visit any site. 5. Menu > Bookmarks > tap on the bookmarklet 6. Widget appears on bottom right of page It doesn't work on HN(?) But does work on other sites.
        efreak 3y ago
        If you're on Android and want eruda, I've got a userscript to load it on every site here: https://github.com/Efreak/UserScripts/tree/master/Eruda-Mobile-Devtools https://github.com/Efreak/UserScripts/tree/master/Eruda-Mobi... It helps with things like removing elements because you can see the DOM and it's fewer clicks away and easier to use than ublock, which doesn't show the DOM in the little box provided for element removal and only allows removing one item say a time (you can use multiple selectors, but every time you tap an element to get the selector it overwrites the existing content)
        LordDragonfang 3y ago
- fragmede 3y ago
  Same. My phone just got a whole lot more powerful!
londons_explore 3y ago
Is this different than any other embedded webview? Doesn't nearly every app somewhere have an embedded webview somewhere for things like "view privacy policy", where it is often much easier to display html than sending the whole privacy policy to your app developer?
- deleted 3y ago
  [deleted]
- Aulig 3y ago
  Yea, I think that's all it is.
- dannyw 3y ago
  The webview appears to have privileged JS functions for password manager key management and recovery.
  - jve 3y ago
    > appears Until someone confirms that they are what the name and what the speculation is about.
- brazzy 3y ago
  > Is this different than any other embedded webview? Yes - it exposes an API to set device encryption keys to the websites that you visit with it- At least that's how I interpret the last section "The dangerous functions".
- ceejayoz 3y ago
  Do normal embedded webviews also bypass parental controls? If so, that seems like a massive issue.
  - Tyr42 3y ago
    Normally they are fixed to one domain.
vxNsr 3y ago
Parental control bypass is the bigger issue here, kids will do anything to get around parental controls and Google made a promise when they set up parental controls that it was secure and would prevent your children from accessing things you didn’t want them to. This breaks that promise.
- hobs 3y ago
  When a child is powerful enough to start taking control from you it might be time to start giving it away.
  - robertlagrant 3y ago
    That's true. It's also true that it might not be.
  - jeroenhd 3y ago
    It should be noted that once this technique makes it to the playground, every kid will learn about the magic taps that make the web available, including kids that aren't ready yet. Obviously, parents using parental control will have questions what their kids are doing for hours in the Google Settings app every day, but every kid will probably get that day or week of free browsing until their parents get suspicious. That assumes parents bother to check on the statistics made available by parental controls, of course; if nobody checks, then the kid will access the web unrestricted for years.
    - newaccount74 3y ago
      I suspect my kid found a way to use Spotify to browse the web, because he seems to use it all day and when I ask him what he listens to he just says "stuff".
      - sebzim4500 3y ago
        On the other hand, what kid wants to talk to their parents about what music they listen to?
blagie 3y ago
Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exploiting this, and machines being compromised and escalations At Google scale, if 0.001% accounts are impacted by a security vulnerability, that's still tens of thousands of people (you can do the math too). I don't think engineers at Google quite have a perspective on what it means when their decisions (not just security) ruin thousands of lives. What's astounding is just how good Google's security team was, especially in comparison, maybe 15 years ago. Now, it increasingly reminds me of the path Yahoo took. Critically, issues build on each other and escalate. Most remote root exploits require overcoming multiple layers of security. Defense-in-depth is important. Google used to address issues when a single layer was breached, before they could combine into someone remotely rooting your phone. Now, Google only fixes security bugs only after they've combined into a severe remote exploit (which often means many devices are compromised before an update goes out).
- px43 3y ago
  This is a pretty standard kiosk breakout technique, which have been super common since the 90s. They have always existed, and will continue to exist. The impact and use cases for issues like this are pretty negligible, so they don't get addressed as quickly as bugs that can actually be used for real crime. Also, you say the embedded browser is "not secure", yet the going rate for browser bugs on Android are in the multi-million dollar range, especially if it leads to root.
  - gjsman-1000 3y ago
    There are plenty of ways to invade someone’s privacy without being root. Stealing a Google Account would still be a prize.
- henriquez 3y ago
  At least Mozilla is still around to find all their bugs for them.
golergka 3y ago
Reminds me of the trick in windows 98, where you could by pass the password input screen by opening help and open file dialog.
- orangepurple 3y ago
  You can do that (Win95) https://www.youtube.com/watch?v=1UfNlRe-goY https://www.youtube.com/watch?v=1UfNlRe-goY Or you can hit cancel (Win98) https://www.youtube.com/watch?v=LHgjN_RwH6g https://www.youtube.com/watch?v=LHgjN_RwH6g Or can you simply close the password dialog and wait (Win98) https://www.youtube.com/watch?v=Uk_SKw9hOpQ https://www.youtube.com/watch?v=Uk_SKw9hOpQ
  - dfox 3y ago
    Except on Windows for Workgroups and Windows 9x/ME the fact that you can dismiss the login dialog is intentional feature, so bypassing it through help is just a more convoluted way of doing something that should be possible. It is feature because the login window is there primarily as an single sign on mechanism for remote network services (which obviously would not work when you just dismiss it) and there is no security boundary between local user profiles.
    - golergka 3y ago
      May be, but it was used as a security mechanism in my high school so that we couldn't use our computers nor in designated time.
nameless_prole 3y ago
This reminds me of how I used to get around the filter in high school (early 00s). This was the early days of the internet, so there were classes where they blocked the entire internet because it was a distraction. I found out that (I'm sure this is a known exploit at this point, but at the time it felt awesome figuring it out) if I went into Microsoft Word (or maybe Works?), went to "help" on the menu bar, and clicked on "About Microsoft Works" it took you to an instance of Internet Explorer that you could then use to visit any website you like. I had a really cool teacher for those classes though, and I'm pretty sure he was amused (and maybe even proud) when he saw high schoolers in 2001 or whatever, finding clever ways around restrictions set up by the school. We may not have been doing what he had explicitly asked us for, but clearly we were learning something.
huxflux 3y ago
This brings back memories of older Windows versions, where you could push F1 and trigger various run commands through Windows Help
- TeMPOraL 3y ago
  My first thought too - this feels like that "F1 -> Open Help File -> Other... -> right-click on explorer.exe and select Run" method of bypassing login screen circa Windows 95/98.
  - sota4077 3y ago
    I had not thought of this ins multiple decades at this point, but I used to do this too! What a trip down memory lane.
freakxy 3y ago
[dead]
benreesman 3y ago
[flagged]
thedougd 3y ago
A similar workaround has been available in the 'about' licenses pages. Just follow a link to a license and then you have a browser. It's useful for getting a browser on car head units, Peloton bikes, etc.
- cbolton 3y ago
  Ha! I just went to the "Third-party licenses" page on my Pixel 6, and it loads a never-ending list of links. Looks like a list of all files in the filesystem.
  - jonas-w 3y ago
    Can you enlighten me where the "Third-party licenses" link is?
    - cbolton 3y ago
      In Settings -> About phone -> Legal information
thunderbong 3y ago
This is a bit like accessing the internet from chm (help) files when the browser was blocked. Damn. I revealed my age!
- breckenedge 3y ago
  Or using it to reinstall games that had been deleted by an administrator…
- Steuard 3y ago
  Are we revealing our age through exploits now? How about "using gopher on a university library terminal to access a site that launched a telnet session so you can check your out-of-state college email over the summer"?
  - toast0 3y ago
    I definitely didn't use the open dialog in Notepad to run other executables at the library.
    - adwww 3y ago
      WinPopup LAN messenger!
      - rainclouds 3y ago
        I was a student at a boarding school in the 90s that left WinPopup installed. I quickly found it and taught the whole campus. They tried to remove it but we had backups by that point. Then we found the teacher access internet proxy which had none of the student restrictions and shared it with everyone via WinPopup… I told the staff when I graduated.
    - est 3y ago
      F5 in notepad or use .LOG as first line.
    - Ntrails 3y ago
msephton 3y ago
My brother uses a similar trick to get to a browser to bypass login on locked Android devices. It blows my mind that they can't see the security implications of this.
- saagarjha 3y ago
  Getting to a browser isn’t really a security vulnerability; many devices will even have a “guest” mode that provides direct access to the internet.
  - msephton 3y ago
    Getting to a browser is an open gate. Why leave the gate open?
  - kapp_in_life 3y ago
    Letting your kid or younger relatives use up your mobile data from your locked phone might not be a vulnerability but definitely isn't the expected behavior.
- veave 3y ago
  If you have physical access to the device it was game over to begin with.
- mavhc 3y ago
  A similar trick must be used when resetting some old Android devices, can't set up account because date/time is wrong, can't set date/time because still on set up account screen
paxys 3y ago
If your kid can figure out how to access banned websites by discovering this hack, I think they deserve it.
- deleted 3y ago
  [deleted]
- ilyt 3y ago
  Sure but they might've not discovered it just read it off internet or from other kids.
  - gtirloni 3y ago
    Still better than 99.999% of the other kids out there :)
  - borski 3y ago
    Both of which are forms of discovery
    - rationalist 3y ago
      I can very easily "discover" how to make an illegal <item> in under a minute using the internet, does that mean I should be allowed to have it? I'm pretty sure your response is not what the GP meant.
      - thunderbong 3y ago
        Sure. And if there are consequences, face them.
        rationalist 3y ago
        Generally kids are not able to comprehend or foresee all of the consequences of their actions which is why parents and their communities set rules/restrictions for kids.
bsimpson 3y ago
I used to do the same thing in the lobby while my parents were banking. Those "best viewed in Netscape Navigator" tags were golden for this. Workflow was almost exactly the same: click through until you get a "best viewed in" tag and get from there to a search engine.
- lkois 3y ago
  I've used this to get to a browser that almost does full screen videos in a borrowed Tesla, from the YouTube app. Then navigated to some dodgy adware infested streaming site and it was working okay until changing to another video, when it froze the whole Tesla computer and the car needed a hard reboot
  - bsimpson 3y ago
    "How's 2023 going?" "Well, I played a video and crashed my car. …not like that."
wffurr 3y ago
The hidden help browser features in some FRP bypass methods on some older versions of Android. I used it to rescue test devices left by former colleagues.
stewx 3y ago
This guy's experience reporting a bug to Google reminds me of mine: Me: Here's a bug in Google Sheets that exposes deleted content to third parties. Google: Not a bug. Working as expected, closing issue. Me: Really? I was personally harmed by this bug while using the application. Google: Actually, it is a bug but it's a longtime known issue, therefore you are not eligible for bug bounty. Closing issue.
- djbusby 3y ago
  Is it fixed now?
  - stewx 3y ago
    Probably not.
  - Dudester230602 3y ago
    Google? No, if anything, it's getting worse... They would need to miss more than just cloud and commercialised LLMs to be truly shaken I am afraid.
- yard2010 3y ago
  Sounds like ChatGPT..
- chias 3y ago
  That is, to a T, almost identical to my experience reporting a vulnerability to Google too. Me: Here's a bug in Gmail that allows spoofed email to scrub DKIM failures and appear legitimate Google: "Won't fix (Intended Behavior)" Me: Really? Google intends to allow spoofed email to appear legitimate in its interface? Google: Actually, it's a known issue
  - LeonM 3y ago
    That is our experience with Microsoft as well. We have submitted two separate email related vulnerabilities with O365, one if which we would consider rather serious. We took our time to create a detailed report, with steps to reproduce, etc. For both you hear nothing for about 10 weeks, then it is either closed as "expired", or "won't fix". Last time I checked, both vulnerabilities still exist.
flutas 3y ago
Did some investigation. So when you click on "Manage my account" you actually get taken out of the settings app and into an Activity (name for the "screen" God object on Android) embedded inside of Google Play Services. Eventually, following this the browser is com.google.android.gms/.auth.folsom.ui.GenericActivity. This doesn't seem to be using the default system webview implementation, as on my phone that would be Chrome. Android allows you to build a JS interface between Android code and Javascript code using addJavascriptInterface[0]. They seem to be doing this...a lot in GMS, which is an interesting attack vector to look into later. Our suspect "mm" interface is in MagicArchChallengeView. Which gets you an obfuscated "bwuz" class as what mm links to. bwuz seems to be pretty empty though, again linking out to a few obfuscated classes. Doing a straight string search two classes expose these functions, "qvc" and "pdn". pdn seems like the meat, while qvc has some helpful error logs exposing what each param is. Looks like setVaultSharedKeys expects a gaiaId (Google Accounts and ID Administration ID), and a JSON array of JSON objects with two values, epoch and key. It creates an arraylist of them and passes them off to an abstract class that is everywhere in the package, but seems to be really involved with account security. addEncryptionRecoveryMethod expects a gaiaId, a security domain list, and a member public key. It again packages them into lists and passes them off to the same abstract class mentioned above. That's where I drop off because I have to get to work. Interesting though and warrants further exploration, both on this specific interface but also the others they expose through GMS into webviews. [0]: https://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface https://developer.android.com/reference/android/webkit/WebVi...
- kitsunesoba 3y ago
  I wonder why they’re not using the system default webview… Does this mean it’s WebKit instead of Blink? If it is Blink, it seems likely that it’s not as up to date as the one provided by Chrome. EDIT: just noticed the docs link, yeah it’s WebKit.
  - deleted 3y ago
    [deleted]
  - esprehn 3y ago
dfox 3y ago
What is somewhat more concerning is that depending on the particular Android version and OEM customizations there are various way how to get into this browser or even complete Android Setting screen from the on boarding flow. Most FRP-bypass exploits involving only user manipulation of the device are built on something like that.
YChacker100 3y ago
[dead]
smashah 3y ago
Side point: When you rent a Tesla, please do not sign into youtube. Subsequent renters can see your whole Google account (including family members, phone numbers etc). Or at least sign out before you return the car!
- dewey 3y ago
  What makes this Tesla specific? This seems like pretty standard behavior on public computers or TVs in hotels.
  - AdamN 3y ago
    Yeah that really sketches me out because people log in to Youtube but that's their main gmail (or worse, google apps) account usually. I know Google probably requires re-auth if somebody tried to use that session token again from a different device .... probably.
- liminalsunset 3y ago
  On the other hand, you can use a very similar kiosk escape on the Tesla YouTube app which is just a webview to get a full screen browser while in Park on the Model 3. There is a Factory Reset and/or a Clear Browser Data function under Car menu > Software or Service iirc. The car remembers your navigation locations too, which can usually only be removed by either deleting your driver profile or resetting the car.
RGBCube 3y ago
I can't find the hamburger menu, can anyone else? Maybe a screenshot would help.
deleted 3y ago
[deleted]
trojan13 3y ago
This is exactly how I used to bypass the parental control application on windows when I was young. I only had 1 hour of computer time, after which the tool would close all applications on my PC except Microsoft Office Apps (for productivity). After a bit of clicking around, I somehow managed to open a browser in Outlook and play flash games on Miniclip.
- joshstrange 3y ago
  Reminds me of how we worked around how the macs were locked down in high school. You could only launch certain applications and you couldn't open System Preferences but in Safari you could edit the default web browser. We would change the default web browser to Terminal (You could open Terminal but it was limited in what it could do, like it would fail at opening other apps) and then open Word, make a link, and click on it. The Terminal instance that opened had more privileges than opening it by default and using this instance you could run `open /path/to/your/app`, for example a game on a disk you inserted. I remember our study hall teacher coming over at one point and asking if we were allowed to play the game (Starcraft) and the answer we gave (still can't believe it worked) was "Well these computers are pretty locked down as you know so if we are able to play this game it must mean the school is ok with it", which he accepted.
ptx 3y ago
> We think the issue might not be severe enough [...] It might not? In other words, if a security vulnerability is reported, assume everything is actually fine until proven exploitable beyond any shadow of a doubt?
louissan 3y ago
mmm my kids *will* use this if they find out about this. What would be a way to find out if they did? Does this leave any trace?
- jonas-w 3y ago
  If they use it often, then the Settings app will have a longer screen time compared to normal usage I'd guess.
  - HeWhoLurksLate 3y ago
    Here's the fun thing- it doesn't! If I remember correctly, the only place you can see that something's going on is if you check foreground data usage for Google Play Services
predictabl3 3y ago
This is very similar to the FRP bypass that I've performed on Pixels. (They were donated to me and didn't realize they were "locked" until months after I'd been given them)
mattbis 3y ago
ITs just systemWebView surely and is one session; its just chrome still etc... you can easily get to that. I don't think there is any issue whatsoever. Further " Secret " is highly inaccurate; this is easily known public knowledge..
ez_mmk 3y ago
A Siemens program I recently installed shipped Firefox with it to display the manual
seeknotfind 3y ago
Ah! The good old days. The Windows XP Calculator app had a browser I used to bypass the browser blocks in elementary school. :D
- Dwedit 3y ago
  Okay, I'll bite... How did you bring up a web browser from XP Calculator? I know there's HTML Help, but I don't see a way to get on to the internet from there.
  - seeknotfind 3y ago
    I found an article on it: https://techieinspire.com/how-to-access-the-internet-via-ms-calculator/ https://techieinspire.com/how-to-access-the-internet-via-ms-...
    - Dwedit 3y ago
      Thanks, did not think to check the System Menu.
Double_a_92 3y ago
I remember having to do tricks like those to unlock an account-locked Android device once (the kind that wouldn't go away even if you reset the phone). The browser could be used to download an APK which triggered the Google Account login screen. Then you could login with a throwaway account and that would unlock the device.
explaininjs 3y ago
Reminds me of the Switch, which has a built in fully functional web browser, but it’s only surfaced when connecting to a DNS server that requires a password as far as I am aware.
- johnfernow 3y ago
  In order to login through some captive portals on restricted networks you need a browser. Presumably you sometimes even need JavaScript, or else Nintendo likely wouldn't have included a JS engine since that greatly increases the attack vector. It would have been possible to design a system of letting users read the ToS of a network and enter login information without needing an entire browser. Granted, it's probably safe to assume most captive portals aren't trying to exploit your non-traditional computing device (such as a Nintendo Switch), and if a user is changing the DNS to evade a captive portal and go to some other site, then any exploits that occur on their device are kind of their own fault, but it still seems like a suboptimal system. Either you're going to have a bunch of exploitable devices that otherwise would in practice be secure since they need to have a web browser, or you're going to have devices that straight up can't access many networks (since they don't have a built-in browser.) I'd argue the latter problem is even greater than the former: web browsers are incredibly complex! If your device is capable of running an already existing browser (e.g. Linux or BSD based systems), then it's not that big of a deal. But if it isn't (e.g. certain embedded systems), then it sucks, though there are sometimes workarounds to accessing captive networks without an on-device browser (e.g. AppleTV lets you login through captive portals on iPhone or iPad — works for people in the Apple ecosystem, but that integration isn't as easy with devices from unaffiliated companies.)
- pharrington 3y ago
  The Switch not only has a web browser, but a web server! (afaik its only used when downloading from the Switch's media browser app to your phone)
Aerbil313 3y ago
Haha, I spent an embarrassing amount of time hunting down browsers hidden in apps in the past. The same thing exists in iOS and bypasses for example a time restriction on Safari or Chrome, but can't bypass domain ban or domain time limit restrictions (also included in parental controls). You can access google.com from many apps, I'd say probably half of them. Especially Apple Support app and Microsoft and Google Apps. Those apps always have external links to for example their Terms of Service and you can access internet with not much difficulty, although procedure varies for each app/external link. Also those in-app browsers persist history and website data and there's no way I know of to delete them. iOS Settings app had a couple links which opened in-app browsers which were able to bypass all restrictions but they're all gone since some time, except literally one. Apple, if you hear me, it can be accessed this way: Settings > iCloud > Family Sharing > Screen Time > Learn more about Family Sharing. I am able to access internet from there: Scroll bottom > About Apple > Apple Leadership > Albert Gore Jr. He has links to Insta, twitter and google books (which can take you to google search and youtube) on his site.
- matan-h 3y ago
  Me too, I have a folder in my android called "breakthrough" and it has 20 applications, including Zoom, waze, Spotify, and so on... apparently, now, it should also include Google and maybe even the Settings :)
jonluca 3y ago
Side note - I built a tool to help detect non-default javascript variables attached to the global scope https://github.com/jonluca/Window-Differ https://github.com/jonluca/Window-Differ to aid in security analysis like this. Would be pretty nice to have in devtools
- matan-h 3y ago
  Very cool ! To ensure there is only one JavaScript interface, I edit hackability to be without popups and print, then host it. Your tool sound easier. https://portswigger-labs.net/hackability https://portswigger-labs.net/hackability
russellbeattie 3y ago
Honestly, this is pretty sloppy and Google should know better. I've done a lot of work with WebView on Android and it's a straightforward process to intercept requests to whitelist domains. It's well trodden ground [1], especially for apps that use the WebView for their entire UI. This is an oversight by everyone from the dev team to the product manager to the QA working on it. 1. https://blog.oversecured.com/Android-security-checklist-webview/ https://blog.oversecured.com/Android-security-checklist-webv...
grose 3y ago
Can you imagine if kids actually started using this? mm.closeView() to instantly boot any pesky children off of your website, the ultimate age gate :)
seany 3y ago
The amount of "but parental controls!?" comments in here is kind of shocking. Has something changed about the hacker spirit around kids?
bastawhiz 3y ago
This is an ancient form of exploit that was (and maybe still is) very popular with Windows: from the ctrl+alt+delete lock screen, you could open things like Help and accomplish similar actions, eventually getting access to a browser (which, in Windows' case, was also ~Windows Explorer with full file system access).
Bugaddr 3y ago
Using this webview for using bard

914 points by matan-h 3y ago

MH15 3y ago

This is telling on my age, but I loved these hacks as a young teenager on early versions of iOS. Parental control existed but didn't touch all areas of the platform.

andreasha 3y ago

TIL mobile JavaScript console https://eruda.liriliri.io/ https://eruda.liriliri.io/

Aulig 3y ago
I found that really interesting too. I've often wanted something like that!
- robin_reala 3y ago
  Used to use Firebug Lite to get the equivalent in IE6: https://web.archive.org/web/20141217201617/http://getfirebug.com/firebuglite https://web.archive.org/web/20141217201617/http://getfirebug...
taopai 3y ago
This is awesome. I hope there is a way to auto load a script so I can make some simple extensions.
wahahah 3y ago
I'll sometimes go through the trouble of using `data:text/html,<script></script>`, but that is impressively replete.
cs02rm0 3y ago
That's mega. Doesn't work for me in Brave on iOS, but does in Safari, I'll take that.
alufers 3y ago
There even is a "remote version" of this by the same person: https://github.com/liriliri/chii https://github.com/liriliri/chii By using it you can open the devtools on another computer and all the information is synchronized over WebSockets. I used it once to debug an issue on a customers machine.
tuukkah 3y ago
A bookmarklet would be nice. This is how the current developer tools in browsers started (Firebug).
- djbusby 3y ago
  Oh, Firebug! Blew my mind when I first saw it. No more View Source for me!
- 8ig8 3y ago
  Bookmarking included in the project README… https://github.com/liriliri/eruda#demo https://github.com/liriliri/eruda#demo
  - tuukkah 3y ago
    Thank you! I must have expected an embed code and missed the javascript: part.
lopkeny12ko 3y ago
Is it just me or does this completely not work? When I paste the Javascript snippet into the address bar, nothing happens. And in Nightly it just performs a Google search with that string.
- eNV25 3y ago
  Try putting it in a bookmark and then execute it.
  - lopkeny12ko 3y ago
    How is this supposed to work? Opening the bookmarks page navigates away from the current page. Even then, selecting the bookmark does nothing.
    - hgsgm 3y ago
      Works in Firefox, not Chrome. Android. 1. Bookmark any page, making a dummy 2. Menu > Bookmarks > edit 3. Change URL of dummy bookmark to the js bookmarklet code. 4. Visit any site. 5. Menu > Bookmarks > tap on the bookmarklet 6. Widget appears on bottom right of page It doesn't work on HN(?) But does work on other sites.
      - efreak 3y ago
        If you're on Android and want eruda, I've got a userscript to load it on every site here: https://github.com/Efreak/UserScripts/tree/master/Eruda-Mobile-Devtools https://github.com/Efreak/UserScripts/tree/master/Eruda-Mobi... It helps with things like removing elements because you can see the DOM and it's fewer clicks away and easier to use than ublock, which doesn't show the DOM in the little box provided for element removal and only allows removing one item say a time (you can use multiple selectors, but every time you tap an element to get the selector it overwrites the existing content)
        LordDragonfang 3y ago
fragmede 3y ago
Same. My phone just got a whole lot more powerful!

londons_explore 3y ago

Is this different than any other embedded webview? Doesn't nearly every app somewhere have an embedded webview somewhere for things like "view privacy policy", where it is often much easier to display html than sending the whole privacy policy to your app developer?

deleted 3y ago
[deleted]
Aulig 3y ago
Yea, I think that's all it is.
dannyw 3y ago
The webview appears to have privileged JS functions for password manager key management and recovery.
- jve 3y ago
  > appears Until someone confirms that they are what the name and what the speculation is about.
brazzy 3y ago
> Is this different than any other embedded webview? Yes - it exposes an API to set device encryption keys to the websites that you visit with it- At least that's how I interpret the last section "The dangerous functions".
ceejayoz 3y ago
Do normal embedded webviews also bypass parental controls? If so, that seems like a massive issue.
- Tyr42 3y ago
  Normally they are fixed to one domain.

vxNsr 3y ago

Parental control bypass is the bigger issue here, kids will do anything to get around parental controls and Google made a promise when they set up parental controls that it was secure and would prevent your children from accessing things you didn’t want them to. This breaks that promise.

hobs 3y ago
When a child is powerful enough to start taking control from you it might be time to start giving it away.
- robertlagrant 3y ago
  That's true. It's also true that it might not be.
- jeroenhd 3y ago
  It should be noted that once this technique makes it to the playground, every kid will learn about the magic taps that make the web available, including kids that aren't ready yet. Obviously, parents using parental control will have questions what their kids are doing for hours in the Google Settings app every day, but every kid will probably get that day or week of free browsing until their parents get suspicious. That assumes parents bother to check on the statistics made available by parental controls, of course; if nobody checks, then the kid will access the web unrestricted for years.
  - newaccount74 3y ago
    I suspect my kid found a way to use Spotify to browse the web, because he seems to use it all day and when I ask him what he listens to he just says "stuff".
    - sebzim4500 3y ago
      On the other hand, what kid wants to talk to their parents about what music they listen to?

blagie 3y ago

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exploiting this, and machines being compromised and escalations At Google scale, if 0.001% accounts are impacted by a security vulnerability, that's still tens of thousands of people (you can do the math too). I don't think engineers at Google quite have a perspective on what it means when their decisions (not just security) ruin thousands of lives. What's astounding is just how good Google's security team was, especially in comparison, maybe 15 years ago. Now, it increasingly reminds me of the path Yahoo took. Critically, issues build on each other and escalate. Most remote root exploits require overcoming multiple layers of security. Defense-in-depth is important. Google used to address issues when a single layer was breached, before they could combine into someone remotely rooting your phone. Now, Google only fixes security bugs only after they've combined into a severe remote exploit (which often means many devices are compromised before an update goes out).

px43 3y ago
This is a pretty standard kiosk breakout technique, which have been super common since the 90s. They have always existed, and will continue to exist. The impact and use cases for issues like this are pretty negligible, so they don't get addressed as quickly as bugs that can actually be used for real crime. Also, you say the embedded browser is "not secure", yet the going rate for browser bugs on Android are in the multi-million dollar range, especially if it leads to root.
- gjsman-1000 3y ago
  There are plenty of ways to invade someone’s privacy without being root. Stealing a Google Account would still be a prize.
henriquez 3y ago
At least Mozilla is still around to find all their bugs for them.

golergka 3y ago

Reminds me of the trick in windows 98, where you could by pass the password input screen by opening help and open file dialog.

orangepurple 3y ago
You can do that (Win95) https://www.youtube.com/watch?v=1UfNlRe-goY https://www.youtube.com/watch?v=1UfNlRe-goY Or you can hit cancel (Win98) https://www.youtube.com/watch?v=LHgjN_RwH6g https://www.youtube.com/watch?v=LHgjN_RwH6g Or can you simply close the password dialog and wait (Win98) https://www.youtube.com/watch?v=Uk_SKw9hOpQ https://www.youtube.com/watch?v=Uk_SKw9hOpQ
- dfox 3y ago
  Except on Windows for Workgroups and Windows 9x/ME the fact that you can dismiss the login dialog is intentional feature, so bypassing it through help is just a more convoluted way of doing something that should be possible. It is feature because the login window is there primarily as an single sign on mechanism for remote network services (which obviously would not work when you just dismiss it) and there is no security boundary between local user profiles.
  - golergka 3y ago
    May be, but it was used as a security mechanism in my high school so that we couldn't use our computers nor in designated time.

nameless_prole 3y ago

This reminds me of how I used to get around the filter in high school (early 00s). This was the early days of the internet, so there were classes where they blocked the entire internet because it was a distraction. I found out that (I'm sure this is a known exploit at this point, but at the time it felt awesome figuring it out) if I went into Microsoft Word (or maybe Works?), went to "help" on the menu bar, and clicked on "About Microsoft Works" it took you to an instance of Internet Explorer that you could then use to visit any website you like. I had a really cool teacher for those classes though, and I'm pretty sure he was amused (and maybe even proud) when he saw high schoolers in 2001 or whatever, finding clever ways around restrictions set up by the school. We may not have been doing what he had explicitly asked us for, but clearly we were learning something.

huxflux 3y ago

This brings back memories of older Windows versions, where you could push F1 and trigger various run commands through Windows Help

TeMPOraL 3y ago
My first thought too - this feels like that "F1 -> Open Help File -> Other... -> right-click on explorer.exe and select Run" method of bypassing login screen circa Windows 95/98.
- sota4077 3y ago
  I had not thought of this ins multiple decades at this point, but I used to do this too! What a trip down memory lane.

freakxy 3y ago

[dead]

benreesman 3y ago

[flagged]

thedougd 3y ago

A similar workaround has been available in the 'about' licenses pages. Just follow a link to a license and then you have a browser. It's useful for getting a browser on car head units, Peloton bikes, etc.

cbolton 3y ago
Ha! I just went to the "Third-party licenses" page on my Pixel 6, and it loads a never-ending list of links. Looks like a list of all files in the filesystem.
- jonas-w 3y ago
  Can you enlighten me where the "Third-party licenses" link is?
  - cbolton 3y ago
    In Settings -> About phone -> Legal information

thunderbong 3y ago

This is a bit like accessing the internet from chm (help) files when the browser was blocked. Damn. I revealed my age!

breckenedge 3y ago
Or using it to reinstall games that had been deleted by an administrator…
Steuard 3y ago
Are we revealing our age through exploits now? How about "using gopher on a university library terminal to access a site that launched a telnet session so you can check your out-of-state college email over the summer"?
- toast0 3y ago
  I definitely didn't use the open dialog in Notepad to run other executables at the library.
  - adwww 3y ago
    WinPopup LAN messenger!
    - rainclouds 3y ago
      I was a student at a boarding school in the 90s that left WinPopup installed. I quickly found it and taught the whole campus. They tried to remove it but we had backups by that point. Then we found the teacher access internet proxy which had none of the student restrictions and shared it with everyone via WinPopup… I told the staff when I graduated.
  - est 3y ago
    F5 in notepad or use .LOG as first line.
  - Ntrails 3y ago

msephton 3y ago

My brother uses a similar trick to get to a browser to bypass login on locked Android devices. It blows my mind that they can't see the security implications of this.

saagarjha 3y ago
Getting to a browser isn’t really a security vulnerability; many devices will even have a “guest” mode that provides direct access to the internet.
- msephton 3y ago
  Getting to a browser is an open gate. Why leave the gate open?
- kapp_in_life 3y ago
  Letting your kid or younger relatives use up your mobile data from your locked phone might not be a vulnerability but definitely isn't the expected behavior.
veave 3y ago
If you have physical access to the device it was game over to begin with.
mavhc 3y ago
A similar trick must be used when resetting some old Android devices, can't set up account because date/time is wrong, can't set date/time because still on set up account screen

paxys 3y ago

If your kid can figure out how to access banned websites by discovering this hack, I think they deserve it.

deleted 3y ago
[deleted]
ilyt 3y ago
Sure but they might've not discovered it just read it off internet or from other kids.
- gtirloni 3y ago
  Still better than 99.999% of the other kids out there :)
- borski 3y ago
  Both of which are forms of discovery
  - rationalist 3y ago
    I can very easily "discover" how to make an illegal <item> in under a minute using the internet, does that mean I should be allowed to have it? I'm pretty sure your response is not what the GP meant.
    - thunderbong 3y ago
      Sure. And if there are consequences, face them.
      - rationalist 3y ago
        Generally kids are not able to comprehend or foresee all of the consequences of their actions which is why parents and their communities set rules/restrictions for kids.

bsimpson 3y ago

I used to do the same thing in the lobby while my parents were banking. Those "best viewed in Netscape Navigator" tags were golden for this. Workflow was almost exactly the same: click through until you get a "best viewed in" tag and get from there to a search engine.

lkois 3y ago
I've used this to get to a browser that almost does full screen videos in a borrowed Tesla, from the YouTube app. Then navigated to some dodgy adware infested streaming site and it was working okay until changing to another video, when it froze the whole Tesla computer and the car needed a hard reboot
- bsimpson 3y ago
  "How's 2023 going?" "Well, I played a video and crashed my car. …not like that."

wffurr 3y ago

The hidden help browser features in some FRP bypass methods on some older versions of Android. I used it to rescue test devices left by former colleagues.

stewx 3y ago

This guy's experience reporting a bug to Google reminds me of mine: Me: Here's a bug in Google Sheets that exposes deleted content to third parties. Google: Not a bug. Working as expected, closing issue. Me: Really? I was personally harmed by this bug while using the application. Google: Actually, it is a bug but it's a longtime known issue, therefore you are not eligible for bug bounty. Closing issue.

djbusby 3y ago
Is it fixed now?
- stewx 3y ago
  Probably not.
- Dudester230602 3y ago
  Google? No, if anything, it's getting worse... They would need to miss more than just cloud and commercialised LLMs to be truly shaken I am afraid.
yard2010 3y ago
Sounds like ChatGPT..
chias 3y ago
That is, to a T, almost identical to my experience reporting a vulnerability to Google too. Me: Here's a bug in Gmail that allows spoofed email to scrub DKIM failures and appear legitimate Google: "Won't fix (Intended Behavior)" Me: Really? Google intends to allow spoofed email to appear legitimate in its interface? Google: Actually, it's a known issue
- LeonM 3y ago
  That is our experience with Microsoft as well. We have submitted two separate email related vulnerabilities with O365, one if which we would consider rather serious. We took our time to create a detailed report, with steps to reproduce, etc. For both you hear nothing for about 10 weeks, then it is either closed as "expired", or "won't fix". Last time I checked, both vulnerabilities still exist.

flutas 3y ago

Did some investigation. So when you click on "Manage my account" you actually get taken out of the settings app and into an Activity (name for the "screen" God object on Android) embedded inside of Google Play Services. Eventually, following this the browser is com.google.android.gms/.auth.folsom.ui.GenericActivity. This doesn't seem to be using the default system webview implementation, as on my phone that would be Chrome. Android allows you to build a JS interface between Android code and Javascript code using addJavascriptInterface[0]. They seem to be doing this...a lot in GMS, which is an interesting attack vector to look into later. Our suspect "mm" interface is in MagicArchChallengeView. Which gets you an obfuscated "bwuz" class as what mm links to. bwuz seems to be pretty empty though, again linking out to a few obfuscated classes. Doing a straight string search two classes expose these functions, "qvc" and "pdn". pdn seems like the meat, while qvc has some helpful error logs exposing what each param is. Looks like setVaultSharedKeys expects a gaiaId (Google Accounts and ID Administration ID), and a JSON array of JSON objects with two values, epoch and key. It creates an arraylist of them and passes them off to an abstract class that is everywhere in the package, but seems to be really involved with account security. addEncryptionRecoveryMethod expects a gaiaId, a security domain list, and a member public key. It again packages them into lists and passes them off to the same abstract class mentioned above. That's where I drop off because I have to get to work. Interesting though and warrants further exploration, both on this specific interface but also the others they expose through GMS into webviews. [0]: https://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface https://developer.android.com/reference/android/webkit/WebVi...

kitsunesoba 3y ago
I wonder why they’re not using the system default webview… Does this mean it’s WebKit instead of Blink? If it is Blink, it seems likely that it’s not as up to date as the one provided by Chrome. EDIT: just noticed the docs link, yeah it’s WebKit.
- deleted 3y ago
  [deleted]
- esprehn 3y ago

dfox 3y ago

What is somewhat more concerning is that depending on the particular Android version and OEM customizations there are various way how to get into this browser or even complete Android Setting screen from the on boarding flow. Most FRP-bypass exploits involving only user manipulation of the device are built on something like that.

YChacker100 3y ago

[dead]

smashah 3y ago

Side point: When you rent a Tesla, please do not sign into youtube. Subsequent renters can see your whole Google account (including family members, phone numbers etc). Or at least sign out before you return the car!

dewey 3y ago
What makes this Tesla specific? This seems like pretty standard behavior on public computers or TVs in hotels.
- AdamN 3y ago
  Yeah that really sketches me out because people log in to Youtube but that's their main gmail (or worse, google apps) account usually. I know Google probably requires re-auth if somebody tried to use that session token again from a different device .... probably.
liminalsunset 3y ago
On the other hand, you can use a very similar kiosk escape on the Tesla YouTube app which is just a webview to get a full screen browser while in Park on the Model 3. There is a Factory Reset and/or a Clear Browser Data function under Car menu > Software or Service iirc. The car remembers your navigation locations too, which can usually only be removed by either deleting your driver profile or resetting the car.

RGBCube 3y ago

I can't find the hamburger menu, can anyone else? Maybe a screenshot would help.

deleted 3y ago

[deleted]

trojan13 3y ago

This is exactly how I used to bypass the parental control application on windows when I was young. I only had 1 hour of computer time, after which the tool would close all applications on my PC except Microsoft Office Apps (for productivity). After a bit of clicking around, I somehow managed to open a browser in Outlook and play flash games on Miniclip.

joshstrange 3y ago
Reminds me of how we worked around how the macs were locked down in high school. You could only launch certain applications and you couldn't open System Preferences but in Safari you could edit the default web browser. We would change the default web browser to Terminal (You could open Terminal but it was limited in what it could do, like it would fail at opening other apps) and then open Word, make a link, and click on it. The Terminal instance that opened had more privileges than opening it by default and using this instance you could run `open /path/to/your/app`, for example a game on a disk you inserted. I remember our study hall teacher coming over at one point and asking if we were allowed to play the game (Starcraft) and the answer we gave (still can't believe it worked) was "Well these computers are pretty locked down as you know so if we are able to play this game it must mean the school is ok with it", which he accepted.

ptx 3y ago

> We think the issue might not be severe enough [...] It might not? In other words, if a security vulnerability is reported, assume everything is actually fine until proven exploitable beyond any shadow of a doubt?

louissan 3y ago

mmm my kids *will* use this if they find out about this. What would be a way to find out if they did? Does this leave any trace?

jonas-w 3y ago
If they use it often, then the Settings app will have a longer screen time compared to normal usage I'd guess.
- HeWhoLurksLate 3y ago
  Here's the fun thing- it doesn't! If I remember correctly, the only place you can see that something's going on is if you check foreground data usage for Google Play Services

predictabl3 3y ago

This is very similar to the FRP bypass that I've performed on Pixels. (They were donated to me and didn't realize they were "locked" until months after I'd been given them)

mattbis 3y ago

ITs just systemWebView surely and is one session; its just chrome still etc... you can easily get to that. I don't think there is any issue whatsoever. Further " Secret " is highly inaccurate; this is easily known public knowledge..

ez_mmk 3y ago

A Siemens program I recently installed shipped Firefox with it to display the manual

seeknotfind 3y ago

Ah! The good old days. The Windows XP Calculator app had a browser I used to bypass the browser blocks in elementary school. :D

Dwedit 3y ago
Okay, I'll bite... How did you bring up a web browser from XP Calculator? I know there's HTML Help, but I don't see a way to get on to the internet from there.
- seeknotfind 3y ago
  I found an article on it: https://techieinspire.com/how-to-access-the-internet-via-ms-calculator/ https://techieinspire.com/how-to-access-the-internet-via-ms-...
  - Dwedit 3y ago
    Thanks, did not think to check the System Menu.

Double_a_92 3y ago

I remember having to do tricks like those to unlock an account-locked Android device once (the kind that wouldn't go away even if you reset the phone). The browser could be used to download an APK which triggered the Google Account login screen. Then you could login with a throwaway account and that would unlock the device.

explaininjs 3y ago

Reminds me of the Switch, which has a built in fully functional web browser, but it’s only surfaced when connecting to a DNS server that requires a password as far as I am aware.

johnfernow 3y ago
In order to login through some captive portals on restricted networks you need a browser. Presumably you sometimes even need JavaScript, or else Nintendo likely wouldn't have included a JS engine since that greatly increases the attack vector. It would have been possible to design a system of letting users read the ToS of a network and enter login information without needing an entire browser. Granted, it's probably safe to assume most captive portals aren't trying to exploit your non-traditional computing device (such as a Nintendo Switch), and if a user is changing the DNS to evade a captive portal and go to some other site, then any exploits that occur on their device are kind of their own fault, but it still seems like a suboptimal system. Either you're going to have a bunch of exploitable devices that otherwise would in practice be secure since they need to have a web browser, or you're going to have devices that straight up can't access many networks (since they don't have a built-in browser.) I'd argue the latter problem is even greater than the former: web browsers are incredibly complex! If your device is capable of running an already existing browser (e.g. Linux or BSD based systems), then it's not that big of a deal. But if it isn't (e.g. certain embedded systems), then it sucks, though there are sometimes workarounds to accessing captive networks without an on-device browser (e.g. AppleTV lets you login through captive portals on iPhone or iPad — works for people in the Apple ecosystem, but that integration isn't as easy with devices from unaffiliated companies.)
pharrington 3y ago
The Switch not only has a web browser, but a web server! (afaik its only used when downloading from the Switch's media browser app to your phone)

Aerbil313 3y ago

Haha, I spent an embarrassing amount of time hunting down browsers hidden in apps in the past. The same thing exists in iOS and bypasses for example a time restriction on Safari or Chrome, but can't bypass domain ban or domain time limit restrictions (also included in parental controls). You can access google.com from many apps, I'd say probably half of them. Especially Apple Support app and Microsoft and Google Apps. Those apps always have external links to for example their Terms of Service and you can access internet with not much difficulty, although procedure varies for each app/external link. Also those in-app browsers persist history and website data and there's no way I know of to delete them. iOS Settings app had a couple links which opened in-app browsers which were able to bypass all restrictions but they're all gone since some time, except literally one. Apple, if you hear me, it can be accessed this way: Settings > iCloud > Family Sharing > Screen Time > Learn more about Family Sharing. I am able to access internet from there: Scroll bottom > About Apple > Apple Leadership > Albert Gore Jr. He has links to Insta, twitter and google books (which can take you to google search and youtube) on his site.

matan-h 3y ago
Me too, I have a folder in my android called "breakthrough" and it has 20 applications, including Zoom, waze, Spotify, and so on... apparently, now, it should also include Google and maybe even the Settings :)

jonluca 3y ago

Side note - I built a tool to help detect non-default javascript variables attached to the global scope https://github.com/jonluca/Window-Differ https://github.com/jonluca/Window-Differ to aid in security analysis like this. Would be pretty nice to have in devtools

matan-h 3y ago
Very cool ! To ensure there is only one JavaScript interface, I edit hackability to be without popups and print, then host it. Your tool sound easier. https://portswigger-labs.net/hackability https://portswigger-labs.net/hackability

russellbeattie 3y ago

Honestly, this is pretty sloppy and Google should know better. I've done a lot of work with WebView on Android and it's a straightforward process to intercept requests to whitelist domains. It's well trodden ground [1], especially for apps that use the WebView for their entire UI. This is an oversight by everyone from the dev team to the product manager to the QA working on it. 1. https://blog.oversecured.com/Android-security-checklist-webview/ https://blog.oversecured.com/Android-security-checklist-webv...

grose 3y ago

Can you imagine if kids actually started using this? mm.closeView() to instantly boot any pesky children off of your website, the ultimate age gate :)

seany 3y ago

The amount of "but parental controls!?" comments in here is kind of shocking. Has something changed about the hacker spirit around kids?

bastawhiz 3y ago

This is an ancient form of exploit that was (and maybe still is) very popular with Windows: from the ctrl+alt+delete lock screen, you could open things like Help and accomplish similar actions, eventually getting access to a browser (which, in Windows' case, was also ~Windows Explorer with full file system access).

Bugaddr 3y ago

Using this webview for using bard