More security problems for WebGL
Context highlights additional WebGL vulnerabilities and raises more questions for Khronos
16 June 2011: Researchers at Context Information Security who exposed security flaws in WebGL last month have identified further concerns about early implementations of the new technology that allows web pages to draw fast 3D graphics to deliver a much richer experience to web users. In one example, a vulnerability in the Mozilla Firefox browser made it possible for malicious web pages to capture any screenshot from a target PC – including the user’s desktop, other web pages or applications. By revealing that none of the current implementations comply with WebGL conformance standards, Context also raises serious questions for Khronos, the consortium which has drawn up the WebGL specification and conformance tests.
The findings are published today along with videos in a Context blog at: http://www.contextis.com/webgl/
Context’s original investigations discovered design level security issues that provide a ‘back-door’ to low-level parts of the operating system via some graphics cards, which were never designed to defend against this type of threat. Following further investigations, Context researchers have discovered that neither Chrome nor Firefox passed the 144 Khronos conformance tests for WebGL, including a number that are directly related to security.
“While Mozilla has taken steps to mitigate the original vulnerabilities and will fix this latest threat in the new version of its browser, scheduled for release on 21 June, we believe this is the tip of the iceberg for the difficult adoption of this immature technology, leaving users vulnerable,” says Michael Jordon, Research and Development Manager at Context.
“The fact that security-related Khronos conformance tests are not clearly identified has been a contributory factor in security issues being missed by developers of the current browser implementations of WebGL,” adds Jordon. “It would be unreasonable to expect full conformance to the complete specification of any new standard but some areas of WebGL need to be carefully implemented to prevent security issues arising. Browser developers should now start banning non-conformant configurations as they are identified until the security issues that have been highlighted are resolved.”
Context’s research also found that Khronos’ recommended defence against the Denial of Service issue, WebGL_ARB_robustness, is not fit for purpose. It is only supported by certain chipsets and operating systems such as NVidia on Windows and Linux, and the extension only offers mitigation and not a comprehensive solution to WebGL DoS issues.
The risks from WebGL depend on the web browser, operating system and graphics card being used. WebGL is currently supported only on Firefox and Chrome and currently users of Internet Explorer, Safari or Opera are not vulnerable to WebGL issues. “We would advise anyone at risk to disable WebGL until the security vulnerabilities have been addressed,” added Jordon. “We have been working with developers of the Firefox plug-in NoScript (http://noscript.net/) to include support to selectively disable WebGL and would recommend this plug-in to protect users from malicious Internet content.”
The full Context blog including two videos can be seen at: http://www.contextis.com/webgl/
About Context
Context Information Security is an independent security consultancy specialising in both technical security and information assurance services. Founded in 1998, the company’s client base has grown steadily based on the value of its product-agnostic, holistic approach and tailored services combined with the independence, integrity and technical skills of its consultants.
The company’s client base now includes some of the most prestigious blue chip companies in the world, as well as government organisations. As best security experts need to bring a broad portfolio of skills to the job, Context staff offer extensive business experience as well as technical expertise to deliver effective and practical solutions, advice and support. Context reports always communicate findings and recommendations in plain terms at a business level as well as in the form of an in-depth technical report.
Issued by:
Context Information Security,
Tel: + 44 (0)20 7537 7515
email: blogs[at]contextis[dot]com
www.contextis.com
