Category Archives: Vulnerability Research

Estonian teenager rewarded $1000 for finding UI spoofing vulnerability in Chrome

Jasper Rebane, a 16-year-old Estonian computer enthusiast, found vulnerability in the Chrome browser. Google has now fixed the security bug and has rewarded him with $1000.

A security vulnerability found by Rebane was corrected in Chrome version 67.0.3396.62 where the changelog just states that he found an error CVE-2018-6135: UI spoofing in Blink. However, Rebane still can not share more precise details about the security error. In his response to Geenius, he said that in the interests of security, it is not allowed to disclose this information so that malicious people could not attack Chrome’s non-upgraded versions.

Currently, the 16-year-old Rebane is haunting plans for the future. In the near future, he plans to participate in the KüberNaaskli competition, where the best will be sent to the European Cyber ​​Security Challenge to represent Estonia. “There is also a plan to learn about things and improve skills, and to take part in the team at many of the CTF’s (Capture the Flag) competitions,” he added. There is also a plan to move on to the YouTube platform where Rebane wants to create educational cyber-security videos.

Links:
https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html
https://bugs.chromium.org/p/chromium/issues/detail?id=823353
https://geenius.ee/uudis/16-aastane-eesti-arvutientusiast-leidis-google-chromeist-vea-ja-sai-selle-eest-heldelt-premeeritud/

SignWise Chrome plugin leaks ID card certificate to arbitrary web sites

signwise_privacy_leak

If you have installed the SignWise plugin (available for Windows and OSX, up to at least version 1.10) to your computer, beware of privacy considerations. SignWise Chrome extension forwards the end-user certificate of the inserted eID smart card without any user interaction to any website, in plain text!

A malicious web site has to embed only a few lines of JavaScript code to collect certificate information from its visitors:

var s = new SignWiseChromePlugin();
s.getAuthenticationCertificate(function(v, e) {…

Similar flaw in 2010 was observed in the official EstEID browser plugin. Will see how much time it will take for SignWise to fix this flaw.

Update from the SignWise Team:

SignWise is happy that our software and services are used by the experts who value the high level security. We are sorry that our provided software had such a problem as described in your post. As of today (12.03.2015) we are happy to inform that your described problem is solved and user information is not shared anymore as described in your post. Our products: SignWise Services (https://www.signwise.org) and SignWise Portal (https://portal.signwise.org) have been built following highest standards of security and strict confidentiality in mind and following the business and security requirements and demands to e-sign high-value electronic documents both in-country and cross borders.

Links:
http://martinpaljak.net/sign/swhack.html
http://id.anttix.org/leak/leak.html

Mobile Pwn2Own 2014: Estonian hacked Nexus 5 using Wi-Fi attack

PacSec2014_pwn20wn

Researchers hacked several of the latest popular smartphones during the Mobile Pwn2Own competition that took place alongside the PacSec Applied Security Conference in Tokyo on November 12-13.

The competition, organized by HP’s Zero Day Initiative (ZDI) and sponsored by BlackBerry and the Google Android Security team, targeted the Amazon Fire Phone, iPhone 5s, iPad Mini, BlackBerry Z30, Google Nexus 5 and Nexus 7, Nokia Lumia 1520, and Samsung Galaxy S5.

Jüri Aedla of Estonia used a Wi-Fi attack against a Nexus 5, but failed to elevate his privileges, HP said.

Links:
http://www.securityweek.com/mobile-pwn2own-2014-iphone-5s-galaxy-s5-nexus-5-fire-phone-hacked