Hacker News Reader

Comment by zokier | Hacker News Reader

Wait, what... malicious dhcp can "force" browsers to execute essentially arbitrary code for every request? And this is by design? Is there some flag to nuke that feature from eg Firefox?

View on HN

Yes, WPAD (web proxy auto discover) is for locating a piece of javascript code specified by Proxy auto-config [1], which consists of a single javascript function that is given the url & the host, and returns a proxy to use.

1: https://en.wikipedia.org/wiki/Proxy_auto-config

Edit: note that in addition to SOCKS proxies, this also allows one to provide HTTP proxies. I'm not familiar with the interaction of https traffic with HTTP proxies, but I'd hope browsers avoid using them? Anyone familiar with this care to comment? (specs are sparse in this area)

For SSL through an HTTP proxy, clients use HTTP CONNECT[1], which turns converts the HTTP connection into a plain tunnel to the given host and port.

https://tools.ietf.org/html/rfc2616#section-9.9

https://en.wikipedia.org/wiki/HTTP_tunnel

I knew WPAD existed but I figured it was just some static lookup. Quelle surprise when it's a hack of massive proportions.

So much of this Netscape stuff just reeks of a "startup MVP", to put it mildly.

I don't mind startup MVP stuff, I mind when it goes on to becomes a "standard" with little to no modification. WPAD/PAC is one. See also the "api" for document.cookie, which entirely consists of assigning strings to document.cookie.

> Yes, WPAD (web proxy auto discover) is for locating a piece of javascript code specified by Proxy auto-config [1], which consists of a single javascript function that is given the url & the host, and returns a proxy to use.

So DHCP can cause my browser to execute code. That is … completely and totally insane. I'm not saying you're wrong, but rather that you're right about about a world gone mad.

Yes! http://i.imgur.com/jzEbP4g.png

Menu > Preferences > Advanced > Network > Settings… > No Proxy.

Very simple and easily discoverable setting.

    ________________________

Google Chrome uses your OS's settings for proxy, though, so you can't easily turn it off in most cases, but you can go to

Settings (scroll down a page) > Advanced Settings > Network > Configure System Proxy Settings

(that redirects you to the system settings for proxies, usually).

This turns off the system performing WPAD discovery on its own, but does it actually block the DHCP option?

Yes, it does. The DHCP option will tell your _OS_ about the PAC file, but the browser won't ask the OS for that information unless the "Use system proxy settings" option (which is the default) is selected. The choices in this dialog map to the preference values I describe in https://news.ycombinator.com/item?id=12175050 as follows:

"No Proxy": 0 "Auto-detect proxy settings for this network": 4 "Use system proxy settings": 5 "Manual proxy configuration": 1 "Automatic proxy configuration URL": 2

If I set Firefox to use system proxy, I suppose it won't be affected by WPAD unless the OS does?

Does anyone know if it's possible to force unpatched libproxy on Linux to not use WPAD? Also, does network-manager use libproxy if I don't have libproxy1-plugin-networkmanager installed?

It's not arbitrary code, it is a DHCP option to push a proxy setting. It is DHCP option 252, and isn't really any different than any other DHCP option, like router or default domain.

Setting network settings is exactly what DHCP was for.

Well, in this case the DHCP option provides a url for a javascript file with a function to be called for each url accessed. I presume there could be some sandboxing of that function, depending on how it is typically used.

Edit: even with sandboxing, I imagine they could encode the url into a hostname for a proxy and then use the DNS requests for the proxy to exfiltrate the url. Proxy auto-config allows specifying "PROXY my_encoded_url.other_data.example.com:8080; DIRECT" so that it would attempt the DNS lookup, and on it's failure fallback to using a direct connection so there wouldn't be much change visible to the user (just a slight extra delay due to dns lookup).

> Well, in this case the DHCP option provides a url for a javascript file with a function to be called for each url accessed.

I don't think so. Just a proxy. A malicious proxy can of course inject whatever it wants into your viewed pages.

codys is correct: The DHCP option provides a URL for a javascript file with a function to be called for each URL. The function then returns how to actually go about connecting to that URL (direct or proxied connection) and what hostname to actually use, etc.

This is separate from the proxy that then gets used for the actual connection if the PAC file says to use a proxy. That proxy can't inject things into pages loaded over https unless it's using an MITM cert signed with a trust root that your browser trusts.

The problem under discussion is that the function in the PAC file gets to see the URL being visited.

> Is there some flag to nuke that feature from eg Firefox?

Yes. In Firefox, the "network.proxy.type" preference is an integer that can take on the values 0, 1, 2, 3, 4, 5 with the following meanings:

0,3: no proxy (see https://bugzilla.mozilla.org/show_bug.cgi?id=115720 for the history on why 3 is the same as 0)

1: proxy manually configured in Firefox preferences, no PAC file.

2: Use the PAC file found at the URL given by the value of the "network.proxy.autoconfig_url" preference.

4: Use WPAD to get the PAC file.

5: Do whatever the OS says to do in terms of proxy settings (including what PAC file to use, if any).

The default value is 5. I believe setting the preference to 0 will ensure that you always use a direct, not proxied, connection to the target site, and in particular that no PAC file is used.

Edit: Ah, just noticed that kuschku points to UI for all this stuff below too.

Reply on news.ycombinator.com