JavaScript Attack Can Break ASLR

BleepingComputer has reported that security researchers discovered a new attack that can be carried out in nearly any browser just using JavaScript. Even with the protections & sandboxing of today’s modern browsers (like Google Chrome, Microsoft Edge, Opera, and Mozilla Firefox) it can break the address space layout randomization (ASLR) that most of today’s central processing units (CPUs) use to prevent malicious programs from figuring out where system processes are located in memory. The attack is called an ASLR⊕Cache, or AnC attack.


Release: Google Chrome 56

Google has released version 56 of its web browser, based on the open-source Chromium web browser. There were 51 security-related bug fixes and one security researcher nabbed over thirty-thousand dollars ($30,000) for reporting some particularly nasty cross-site scripting (XSS) issues in Blink, Chrome’s rendering engine.

Here are the other new and fixed features:

For Users

  • WebGL 2.0 Support
  • HTML5 by Default
    • For all users the browser will now attempt to load HTML5 content over Flash and will only fall-back to Flash when it is absolutely necessary
    • Around October of this year Flash will require the user to explicitly approve its use
  • Built-in FLAC (Free Lossless Audio Codec) codec/support
  • The URL input bar now shows “Not Secure” next to the information icon for sites that are not encrypted and requesting username and passwords
  • Improved Bluetooth support via Bluetooth Low-Energy (BLE) and the Web Bluetooth API
  • Page reloading up to 28% faster

For Developers

  • Added “system-ui” font-family value that uses the operating system’s (OS’s) default font
  • Network
    • Support added for Referrer-Policy (CSP referrer) header
    • reflected-xss header deprecated
  • CSS
    • background-image-repeat: space value support added
      • Fills background with repeated tiles but no so much that it goes outside the container and will “space out” the tiles equally
    • position: sticky value support added
      • Works as “relative” until it reaches a maximum value, then works as “fixed”
    • offset-rotate motion path property now supported
    • Scroll anchoring support added, new overflow-anchor  with possible values of auto or none (to disable)
      • Locks the browser to a specific element so that content reflows do not force the browser away from the anchor element as images & other content load
      • touch-action: pinch-zoom property support added
  • SVG
    • SVGElement.currentView, SVGElement.useCurrentView, and SVGViewSpec interface deprecated
  • JavaScript
    • Chrome will no longer fetch the src (source) property of <script>  tags with non-script MIME types (suggests using the link preload element instead)
    • Removed deprecated MediaStreamTrack.getSources()
    • Shadow DOM: Will now dispatch synthetic events when target and relatedTarget event property values are identical/same
    • Showing/hiding the URL bar will no longer affect the page size or elements with vh units
      • overlay with “extra at the top” rather than pushing content around
    • KeyboardEvent.isComposing read-only value which returns true after compositionstart event has fired but before compositionend has
    • MediaStream Image Capture now allows for taking images/video from attached camera/imaging devices
    • Fixed attached mouse on Android devices incorrectly firing TouchEvent instead of MouseEvent
    • Large images now allowed to be sent as notification content via Notification API
    • OPUS audio codec support
    • PaymentRequest.canMakePayment() returns true or false if a payment can be accepted via Payment Request API
    • Remote Playback API support added
      • Android only, desktop support will be added in a later version – desktops currently report no available playback devices even when there is at least one available
      • Can control external devices’ (like Smart TVs, Chromecasts, Rokus, etc.) media playback
    • Shaddow DOM: slotchange events are no longer re-fired at slot’s assignedSlot (correct odd behavior and comply with specification change)
    • Streams API: WriteableStream is now supported
    • Added ImageBitmapRenderingContext
      • Provides low-level context for rendering an image on Canvas
    • Document-level TouchEvents are now passive by default
    • Web Bluetooth API supported
    • WebGL 2 supported
    • WebAudio API
      • Added ConstantSourceNode
      • ChannelSplitterNode channelCount and channelCountMode are constant
      • PannerNode.rolloffFactor clamps to nominal range
      • Removed deprecated Doppler API
  • Security
    • Added early support for TLS 1.3
    • Removed various ECDSA TLS cyphers
    • SHA-1 certificates are no longer trusted
    • Touch scroll events no longer allow popups to be opened
    • window.prompt() no longer brings background/inactive tabs to the foreground/active state
      • Background tabs will just not display a prompt
  • DOM
    • Rare case-insensitive matches for <input> group name are no longer done
    • Non-white-space Unicode control characters are now rendered in compliance with the specification
    • Delay running rendering pipeline (including requestAnimationFrame requests) inside iframes until all stylesheets have loaded
    • Allow any element below the body to be defined as the root scroller (which allows hiding URL bar, generate overscroll glow, etc.) via document.rootScroller

Chrome now reloads pages 28% faster


Release: Firefox 51

Mozilla has released version 51 of the open-source Firefox web browser. What can you expect from this release?

For Users

  • Save password prompt allows you to view the password before it is saved
  • Zoom button added to the URL bar that displays the zoom level other than 100% – pressing the button returns to default zoom
  • Video performance for those that cannot make use of hardware GPU acceleration has been improved
  • Passwords are now saved from forms that do not emit a “submit” event
  • Free Lossless Audio Codec (FLAC) codec is now built-in
  • WebGL 2 is now supported – provides more advanced 3D images and animations
  • Subtle warning (crossed lock icon) displayed on sites that are not using a secure certificate (SSL/HTTPS) and asking for login username and password
  • Georgian (ka) and Kabyle (kab) locales added and Belarusian (be) locale removed
  • Improved E10s (multi-process) function with better tab switching
  • More reliable browser sync
  • 25 security issues fixed – includes many potential memory issues, some API issues, privilege escalation or information reveals, and URL spoofing

For Developers

  • HTML

    • The <hr>  tag can now be used within <menu>  tags/elements
    • selectionStart and selectionEnd attributes/properties now return correct position when there is no selection within <input>  and <textarea>  elements
  • CSS

    • :indeterminate pseudo-element selector now supported for <input type=”radio”>
    • :placeholder-shown pseudo-element selector now supported for <input type=”text”>
    • :placeholder pseudo-element selector now unprefixed
    • :valid pseudo-class selector fixed to select valid <form>  elements
    • unicode-bidi: plaintext  now works with vertical writing mode
    • clip-path: fill-box  and clip-path: stroke-box  now properly supported
    • Flexible Box Model’s (flexbox) line height is now clamped in single-line auto-height flex container with max-height (matching change to the specification)
  • JavaScript

    • Symbol.toStringTag, TypedArray.prototype.toString() , and TypedArray.prototype.toLocaleString() implemented
    • DateTimeFormat.prototype.formatToParts() now works
    • const and let are now fully compliant with the specification
    • const used within for … of now gets a new binding on each iteration and no longer throws a SyntaxError
    • Using for each … in now produced a deprecation warning
    • Generator functions can no longer be a child of a label and you can no longer use “let” as a label (for obvious syntax reasons)
    • Legacy generator functions now throw an error when used in method definitions (must use asterisk)
    • next()  iterator method now throws a TypeError when it does not return an object
    • Child-indexed pseudo-class selectors will match when they do not have a parent
  • Developer Tools

    • The Network Monitor now has a “blocked” state which shows when a connection is waiting to execute because the simultaneous connections limit has been reached
  • WebGL

    • WebGL 2 now enabled by default
    • The WEBGL_compressed_texture_es3 extension (implemented in Firefox 46) has been renamed to WEBGL_compressed_texture_etc and is no longer included by default in WebGL 2 contexts
    • The EXT_disjoint_timer_query extension has been updated to use WebGLQuery objects instead of WebGLTimerQuery objects
    • The OES_vertex_array_object extension now uses the WebGL 2 WebGLVertexArrayObject object instead of its own WebGLVertexArrayObjectOES object
    • You can now use ImageBitmap objects as a sources for texture images in methods like WebGLRenderingContext.texImage2D(), WebGLRenderingContext.texSubImage2D(), WebGL2RenderingContext.texImage3D(), or WebGL2RenderingContext.texSubImage3D()
  • IndexedDB v2

    • IndexedDB version 2 is now enabled
      • Supports for the new IDBObjectStore.getKey() method has been added
      • Supports for IDBCursor.continuePrimaryKey() method has been added
      • Binary keys are now supported
  • Canvas

    • The non-standard CanvasRenderingContext2D.mozFillRule() method has been removed; the fill rule can be defined using a parameter of the standard CanvasRenderingContext2D.fill() method
    • The CanvasRenderingContext2D.imageSmoothingEnabled has been unprefixed
  • SVG

    • tabindex attribute Added
    • href attribute added, which renders xlink:href obsolete
    • You can now use custom data attributes on SVG elements through the SVGElement.dataset property and the data-* set of SVG attributes
    • CSS Animations used in an SVG image which is presented in an <img> element now work again; this was an old regression
  • Web Workers

    • WorkerGlobalScope.onclose obsolete event and the close event of Worker objects have been removed
  • Networking

    • image/*, video/*, audio/* or text/csv MIME types served to <script> elements, Worker.importScripts(), Worker(), or SharedWorker() are blocked and no longer allowed
  • XHR

    • XMLHttpRequest.responseXML no longer returns a partial document when there is a parse error. Instead, it now returns null (as the specification dictates)
    • To match the latest specification an XMLHttpRequest without an Accept header set with setRequestHeader() is now sent with such a header, with its value set to */*
    • now correctly nulls out username and password values when omitted according to the specification
  • WebRTC

    • The RTCPeerConnection.removeStream() method has been removed. It was deprecated back in Firefox 22, and has been throwing a NotSupportedError for a long time. You need to use RTCPeerConnection.removeTrack() instead, for each track on the stream.
    • WebRTC now supports the VP9 codec by default
    • The method HTMLMediaElement.captureStream(), which returns a MediaStream containing the content of the specified <video> or <audio>. It’s worth noting that this is prefixed still as mozCaptureStream(), and that it doesn’t yet exactly match the spec.
  • Audio/Video

    • Added FLAC support (FLAC codec) in both FLAC and Ogg containers. Supported FLAC MIME types are: audio/flac and audio/x-flac. For FLAC in Ogg, supported MIME types are: audio/ogg; codecs=flac, and video/ogg; codecs=flac
    • Added support for FLAC in MP4 (both with and without MSE)
    • Throttling in background tabs of timers created by Window.setInterval() and Window.setTimeout() was changed in Firefox 50 to no longer occur if a Web Audio API AudioContext is actively playing sound. However, this didn’t resolve all scenarios in which timing-sensitive audio playback (such as music players generating individual notes using timers) could fail to work properly. For that reason, Firefox 51 no longer throttles background tabs which have an AudioContext, even if it’s not currently playing sound.
  • DOM (Document Object Model)

    • The deprecated DOMImplementation.hasFeature() now returns true for all arguments
    • onerror / error event is now supported for <img> elements and HTMLImageElement objects
    • Animation.effect can now be set rather than being a read-only property
    • Permissions.revoke()  is now behind a browser setting/preference (dom.permissions.revoke.enable) and is disabled by default
    • property and StorageManager.estimate() are now implimented/enabled. Storage unit persistence features are not yet implemented
    • BatteryManager.chargingTime and BatteryManager.dischargingTime round to the nearest 15 minutes
  • Events

    • onanimationstart, onanimationiteration, and onanimationstart event handlers are now supported in addition to supporting the corresponding events using addEventListener()
    • ontransitionend event handler supported


Browsers’ Interfaces Are Insecure

As browsers continue to add new features, many of them need to notify or request confirmation from the user. These notifications and dialogs are showing outside the browser interface and appear inside or overtop of the content window (considered to be untrusted since any content can be displayed by developers). This means that content developers can mimic these notifications easier and trick (or bait/phish) users into clicking or submitting information to dialogs that are not part of the browser.

A family member was recently subject to something very similar  last week. The browser was being forced into fullscreen mode. Popups were repeatedly sent to prevent being able to do anything else with the browser. Whenever I hit F11 to exit fullscreen mode, it immediately went back into fullscreen mode. At the same time the browser’s interface (address bar, tabs, bookmarks, etc.) could have been faked within that full screen browser tab. Since many browsers today use the same or similar technology to render their interfaces it can be easily mimicked using HTML & CSS. Luckily I was able to prevent the popups and close the browser window using Ctrl + W. An simple [may not be perfect] fix for this is to require requesting the user approve going to fullscreen in cases other than for the video tag – similar to how the user’s location must be requested.

These encroachments have security researchers worried because it means that none of the browser window can be trusted and phishing schemes / scams will likely become increasingly successful when the user believes they are interacting with the browser when they are really interacting with the content of a potentially malicious website.


Chrome Changes: Encryption Notification

Google Chrome version 56 (based on the open-source Chromium web browser) is scheduled to be released at the end of the month. One of the major user-level changes is how sites without encryption will appear. Until now there has just been a lowercase letter “i” with a circle around it — this was typically an indicator to get more information about the site. In the upcoming version this symbol will be accompanied by a “not secure” message to indicate that the site is not secure:

The difference between Chrome 53 and Chrome 56 when a non-encrypted site is visited: The circled lowercase "i" will be accompanied by "Not secure"


Google has also indicated that future versions of Chrome will continue to make sites that are not encrypted appear with a more prominent warning symbol:

In future versions of Chrome the "Not secure" indicator will be red, have a triangle exclamation mark warning icon, and be much bolder.


Imminent: Non-HTTPS Sites Labeled “Not Secure” by Chrome

Google warned about this back in September of 2016.


Google Chrome 55 Released

Google has released version 55 of the Chrome web browser (based on the open-source Chromium browser) a few days early (was supposed to be released on the 6th). There was over $70,000 paid out to security experts, developers, and white-hat hackers for finding over 25 different security-related issues with the browser.

Noteworthy features:

async & wait functions

ES2016’s async and await function flags will be fully supported and allows making function calls that do not delay the main browser thread (asynchronous). Note that because IE does not support this (though can be mimicked using a settimeout polyfill; Edge has this feature behind an experimental flag) it will be awhile before it can be used cleanly. Babel (the ES6->ES5 JavaScript transpiler Node.js module) transpiles these for browsers that do not support it using the settimeout polyfill.

Pointer Events

Pointer Events API will be fully supported and allow capturing mouse and touch move, over, and leave/out events combined into a single event.

Persistent Storage

Persistent Storage will be supported. Note that pretty much all browsers support localStorage, but it is simply up to the browser when to remove the data. For instance, when hard drive space runs out, storage data gets wiped automatically to free up space. Persistent Storage provides a mechanism that allows the developer to request their data be kept unless clearing out all non-persistent data still does not free up enough storage space. It identifies whether or not their request was accepted or the browser is simply only accepting non-persistent storage.

Chrome 55 is expected to use significantly less memory. Chrome was the first browser to support per-tab processes – but has always been at the cost of using a fair bit more memory than other browsers. Now they have a goal to, eventually, reduce the memory usage enough that Chrome can be used easily on a computer with just 1GB of memory. Version 55 is the first step toward that goal as it both uses a fair bit less memory and has a rewritten garbage collector.


Safari… Sans Flash

The new technology preview of the Apple’s WebKit-based Safari web browsers shows that they are removing Netscape Plugin Application Programming Interface (NPAPI) in an upcoming version of Safari.


Chrome Security Update: 45.0.2454.101

Google has released a security update for it’s Chrome web browser. The new version, 45.0.2454.101, includes fixes for a reported cross-origin bypass that affects both the document object model (DOM) parser as well as the V8 JavaScript/ECMAScript engine.

It is recommended that you update your browser to this version to prevent possible exploits. You can do so by clicking the main menu icon (three dashes in the top right) and going to Help / About Google Chrome or by downloading from:


Firefox: Stolen and Fixed

Mozilla, an open-source software community run by the non-profit organization, Mozilla Corporation, and developers of the Firefox web browser, has announced it’s bug tracking software, Bugzilla, was hacked. The organization’s blog post states that the account that was compromised had access to privately-listed bugs representing zero-day security flaws in the browser. However, if you keep your browser up-to-date you are protected. The zero-day flaws that were stolen were all patched as part of version 40.0.3 released August 27, 2015. The post does not state the date that the account was compromised.

Green bug being swept up by a broom. Icon / clip-art.
By Poznaniak, pozostali autorzy w plikach źródłowych via Wikimedia Commons

This should definitely be a wake-up call for you to keep the software you use up-to-date. Many applications today will automatically update (including the more recent versions of Firefox) but some do not. In addition to keeping you safe from security flaws, the latest versions of programs also deliver features that make using the software more enjoyable and sometimes easier. In the case of web browsers, it also delivers new tools for web developers to use to make better web applications and websites that are more visually appealing and interactive.

More Information

More detailed explanation of why you should take the time to ensure the software you use is up-to-date will be in an upcoming post! I will link the post here.