Hacker News Reader

Comment by tptacek | Hacker News Reader

The backstory on this, if you don't follow web security at all, is that building public web pages to trick browsers into talking to private networks (or your loopback interface) is a surprisingly pernicious attack vector. The modern countermeasure for this is to require devices parked on private networks to opt-in to the ability mix public Internet requests with private network accesses, using CORS, which is what this is about.

You should probably be mostly thrilled about this development.

View on HN

Finally CSRF attack scenarios on outdated router firmwares can be prevented.

CORS was basically ineffective in a lot of ways because it only works - by design - with newer servers that send those headers and with newer browsers that actually respect the headers and not simply ignore them. It was also ineffective for older servers from pre-CORS ages. The never break the web mentality didn't work out for this scenario.

Looking forward to this! Finally the LOIC and routersploit web implementations are ineffective. Now drop support for ftp in the web browser and we are good to go.

(̶F̶i̶r̶e̶f̶o̶x̶ ̶c̶a̶n̶ ̶s̶t̶i̶l̶l̶ ̶b̶e̶ ̶a̶b̶u̶s̶e̶d̶ ̶t̶o̶ ̶D̶D̶o̶S̶ ̶v̶i̶a̶ ̶f̶t̶p̶ ̶u̶r̶l̶s̶)̶

edit: correction: I was wrong: Firefox finally phased out ftp support this year in July.

> Firefox can still be abused to DDoS via ftp urls

How? They dropped FTP support a few versions ago (https://blog.mozilla.org/addons/2021/04/15/built-in-ftp-impl...).

> Firefox can still be abused to DDoS via ftp urls

Firefox deprecated FTP in 2015, and required it be manually re-enabled since April last year (FF88), and completely removed it in July (FF90), this year.

Thanks on the hint!

I was assuming that they will drop support by the end of this year, didn't follow it up recently so I missed the update in July about it.

The web moves at a brutal pace. It's easy to miss one announcement among all the many, many others.

The sad part is, I now have clients refusing to upgrade Firefox.

Great. And while I blame Mozilla for much, this isn't their fault.

I almost feel as if end users should need a network license, and if they get too many tickets, no license for them!

And yes, it is not realistic.

> The sad part is, I now have clients refusing to upgrade Firefox.

If these clients are on Windows... tell them to use Windows Explorer.. it has FULL ftp capabilities.

You don't need a browser for ftp, or even an FTP specific program.

See answer to the other person in this subthread.

Windows Explorer comes installed on every windows computer.

You cannot even uninstall or disable it as it disables the entire desktop.

Note that I am not talking about Internet Explorer (which is related, but not the same thing)

They can use a third party ftp client and it will register as a protocol handler. You can just view it as "ftp support with a different program"

It's pretty seamless. There's lots of ftp supporting clients. Give it a go

Naturally I suggested such things.

You can insert a dozen strange answers here.

For example, one answer?

A client of mine has an FTP site, and their customers access it. Those customers have an IT policy which does not allow them to install other software, for security reasons.

Thus, keeping and old version of firefox around is what their customers do.

(Yes, this is insane and bizarre beyond belief. The security policy is working against security, and the fact that the security policy doesn't care about an old browser is insane. Yet there it is.)

I have a client with employees around the world. They are usually very secure. However, these employees seem to be the complete opposite of computer literate. Every step they take, every task assigned, is accompanied with PDF files and wiki walkthroughs of "here is menu item X, click this, then menu item Y", along with screenshots, and enlargements of menu items.

All their training is rote. They don't know how to use software, only how to click this, then that, as per pictures and doc, then entire report in the form that pops up.

If anything deviates -- tech support.

I honestly don't know how it is possible to find people capable of doing a job with diligence, competence, and intelligence, but require this level of hand holding, yet I see it myself, through this client, constantly.

Like I said ... strange and bizarre.

While I am sure this client will eventually manage to upgrade its staff, they have been researching clients, testing them, re-working all documentation, and even rolling out 'test upgrades' for employees!

And of course this takes time, naturally they are short staffed, and it requires management buy in at every step.

And getting people to modify about:config? That's way, waaay too complex. So they're stuck on an old browser, which they aren't supposed to use for anything but FTP, yet these employees are the sort that call a browser "google", and don't know the difference between firefox and chrome.

So you can be sure they're using an old version.

Again, I don't blame Mozilla for this.

This is the sort of stuff which makes me think 'maybe people need a license, like a driver's license, to be on the internet, they're too dangerous otherwise'.

But of course, as I said initially... not easy or realistic to roll out.

Now that I think of it, though, maybe it should be "businesses need a license to be on the internet". The important part here being, if you have constant breeches, and your infra gets used to launch endless attacks, you get fined until you go out of business.

> The web moves at a brutal pace.

This is so true. Especially since the pandemic the sheer amount of CVEs are hard to follow through and evaluate whether they're relevant for your own tech stack or not.

Correct me if I'm wrong but the browser still sends the request. The browser checks for the response's CORS headers to see if the response can be used but there's potentially an attack vector even when the response is ignored.

> The never break the web mentality

Would you pass on that memo to the Chrome developers, please?

I'd be a lot more likely to be thrilled by it if the browsers had a persistent per page or per site setting to disable these kind of things.

It gets annoying when a page I write loaded onto my table on my LAN's WiFi cannot talk to devices I own on my LAN just because I loaded the page from my server that is on the public Internet.

PS:

> The modern countermeasure for this is to require devices parked on private networks to opt-in to the ability mix public Internet requests with private network accesses, using CORS, which is what this is about

I predict that most IoT devices won't have a way to configure this.

If the manufacturer intended it to be controllable from some web app from their site, they will opt-in to control from everyone. If the manufacturer only wants it controlled from their mobile app, they will explicitly opt-out of web control if that is possible.

Just to be clear: the people working on PNA thought about how likely it was for IOT devices to support this, and the default behavior for most devices is expected to be fail-closed.

This is why one of my security mantras has become: if it is not secure enough to connect to the open Internet, it is not secure at all.

That doesn't necessarily mean you connect it to the open Internet, but it means you don't leave everything inside wide open because "oh there's a firewall." It also means buggy vulnerable IoT (Internet of Targets) stuff has to be dealt with.

Firewalls are almost security theater. They're just a basic precautionary thing. Same goes for virtual and zero trust networks. Systems must be secure, period.

I think the concern is for even clicking a link, which to my knowledge typically hasn't fallen under implicit CORS concerns. The browser will automatically assume that unless a private origin server (i.e. one within a private address space) explicitly allows requests from a public source, then the navigation should be prevented.

It's always a challenge in browser design, but basically this is just another case of killing valid use cases because some servers don't follow the spec (i.e. GETs with side effects).

> killing valid use cases because some servers don't follow the spec

There are probably 25 IoT devices in my home, and more than half of them have a magic GET request with side effects. For example, just by clicking this link, my lights turn on http://lighting.londons_explorer/cm?POWER%20ON

A malicious web page could redirect me to that URL and force my lights on with no input from me. I bet some of the devices allow firmware updates with the same method.

And because you use crap hardware, everyone else has to change his totally legitimate network setup?

I don't think it's because of this one person, but rather the masses that has crap hardware and software installed everywhere. It's a global problem, not everyone is capable of securing their own network.

Just like not everyone is capable in handling explosives or build roadsafe cars or most other stuff by themselfes. We have rulings for this, laws, needed checks and so on. Start stopping the import of crap, like one does it with illegal firecrackers or in the past with eletronic stuff that interferes to much.

Ok, so which safety measures do you mandate?

Oh, I know! How about a browser that does not allow direct navigation from external to internal addresses? Ah, wait.

It still does not quite work for services that have a public IP address. So where do you go from there, a new protocol that has capability handling and external access is disabled by default?

Forcing companies to issue recalls for buggy hardware and firmware could probably do the trick. Note the expense and the fact of insufficient dissemination of found issues combined with lag to fix them.

Are you suggesting regulating IOT devices for better security? Who the heck could you trust to do that? The FCC? The Chinese government? Consumer rights in the USA is barely a thing, and there is no competent bureaucracy for this sort of auditing. Creating some standards body and coming up with evolving criteria and hoping manufacturers will buy in seems like a multi year, if not multiple decade, process...

In the meantime Google can single handedly monkey patch this situation within a few months and force manufacturers to catch up with the next product cycle. While a less ideal route, this seems far likelier to produce actual results within our lifetimes.

I find it really interesting how the US government can constantly solves very tricky real world problems that impact our lives, yet people have close to zero trust in it. Which isn’t to say you’re wrong here.

I think it’s because when stuff works it looks simple. There isn’t an obvious difference between a mound of dirt piled up in days and one that’s carefully compacted as it’s constructed. At least until you want to build something on top that actually lasts for 50 years. Build stuff to last takes time and nobody is around to see you succeed.

Back to your point actually fixing the underlying issues with IOT security is worth it long term even if it hypothetically takes 20 years to get it correct. At the same time moving quickly and patching one of 100,000 problems can still be useful.

> how the US government can constantly solves very tricky real world problems that impact our lives

What are some recent examples? Especially dealing with technology?

I can think of a bunch of counter-examples where the government did not do a good job of regulating:

* Rural broadband failed

* Net neutrality failed

* Healthcare.gov was a fiasco

* Wireless spectrum auction never got us municipal/rural long-range wireless

* NASA's duties have largely been outsourced to private actors

* State DMVs are a shitshow

* Election integrity failed

* They can't figure out what to do about online disinformation

* Warrantless wiretapping: both unconstitutional yet ineffective, as in 9/11 and the lack of data sharing between agencies

* Foreign military misadventures, our traditional forte: Afghanistan, Iraq, both abysmal failures

* Healthcare: a joke compared to every other developed country

* Education: pathetic and getting worse

* Social programs: Welfare, what welfare? inequality and homelessness getting worse every year

* Infrastructure: crumbling

* Clean water: only for rich white people

* Immigration: heh

* Covid: lol

* Renewables: haha

* Nuclear: let's pretend it's not there

On every major policy front, the US government has been a disaster for decades. I'm no libertarian by any stretch, but our government is a complete shitshow compared to any other developed democracy. We have neither the leadership competence (decisionmakers and legislators) nor the engineering talent (career civil servants) who can tackle something as diverse as nuanced as IoT security, or arguably, digital security in general. Give them 20 years and they might be able to catch up to 1990s netsec, and by then the manufacturers will be two decades ahead and foreign intelligence services even further beyond that.

Our government is doomed, and taking us down with it.

Almost everything the government does is extremely complicated. How about the modern coast guard search and rescue process, weather forecasting, air traffic control, making counterfeit resistant money, etc etc.

Of course it’s all stuff the government does directly like GPS that generally works even if theirs issues with version 1. Go to Healthcare.gov today and it works fine, but wow 8 years ago there where issues. People still get mileage talking about that launch presumably because it’s that unusual.

Bringing up the FTC there’s keeping the wireless spectrum clean. You can blame the Government for not solving all shorts of issues, but people complain while at the same time they largely don’t want state or federal government internet. Healthcare is the same issue, we apparently don’t want even a public option, yet somehow the government is still on the hook.

People are always going to talk up government boondoggles because that’s what’s memorable. Clean water in all 155,693 public water systems in the United States isn’t easy it’s a monumentally difficult task that works 99.9% of the time across a huge range of public and private organizations managed by a huge range of different locations from tiny towns to vast cities. Of course if people actually trusted their water then bottled water would be less popular…

Almost anything any government does is extremely complicated, and yet most of the developed ones succeed in ways our fails at. Why are we unique? Countries poorer than us, less dense than us, smaller than us, still manage to provide many basic services, rights, protections, and guarantees that ours does not. This is American exceptionalism gone awry.

Those things you mentioned aren't recent developments. Yes, there was a time when our government was capable of producing good output. What happened? Why are we still judging today's government by its successes of decades past...? Most of what you mentioned is literally last-century tech. The world has moved on; our government has not.

> You can blame the Government for not solving all shorts of issues, but people complain while at the same time they largely don’t want state or federal government internet.

Maybe there's one class of issues that government can't deliver on because the public mandate isn't quite there yet, like single-payer healthcare. But there's another class of issues that the public DOES want, the government already wrote the laws and allocated the budget for, and then did absolutely nothing about (like rural broadband grants basically going to corrupt telcos, with zero real enforcement). That has nothing to do with the lack of public will, just sheer incompetence and corruption.

Then there's the outright unconstitutional things, like warrantless wiretapping or drone assassinations of US citizens... to say nothing of recent developments, like Roe v Wade.

It's not that our boondoggles our more visible, it's that we fail at providing basic services for a huge portion of the population -- things that most other developed democracies can provide without much issue or controversy. By that measure, we fall far short.

It’s generally possible to find individual governments that do just about any specific thing better than the US gov, but that’s not to say each of those countries is better in every way. The best healthcare isn’t in the country with the lowest crime, least corruption, down a list where the 2nd country is then second on every criteria. Further only looking at US failures ignores how other counties fail in different ways. The UK’s land situation is seriously messed up and yet we rarely consider that when comparing governments. I am not going to say the US is #1, but it’s a long way from abject failure.

Also when you excluded say Nigeria and in fact most counties then every remaining country is going to seem worse simply because you just arbitrarily raised the standards. It’s not US exceptionalism to simply say few countries or groups of countries have landed anything on Mars which is freaking difficult. Sure, providing great healthcare is more important, but it’s also something very few counties have done well.

In the detracting from success by looking at unrelated failures misses my argument, at best it speeks to the likelihood of success not the possibility.

(Sorry for the late reply, didn't see your response until now.)

So what do you think is a fairer way to measure governments? Ratio of important successes to important failures? A matrix of weighted policies and implementation scores?

You'd probably end up with something similar to to the UN's human development index (http://hdr.undp.org/en/composite/HDI), in which the US ranks #17, behind Norway, Ireland, Switzerland, Hong Kong, Iceland, Germany, Sweden, Australia, Netherlands, Denmark, Finland, Singapore, the UK, Belgium, New Zealand, and Canada. All of those are perfectly livable countries. My only criterion was "developed democracies", and Hong Kong isn't even much of a democracy anymore. I don't think that's an unreasonably high bar.

Our government is just on the low end of mediocre compared to other developed democracies, at least by the metrics I can think of.

If you can think of a better metric, I'm all ears.

Although i agree with this browser change, i highly doubt it will fix all crap hardware. There's a limit to how much you can apply band aid solutions to something that seems to be trying its hardest to be insecure, and non-idempotent GET requests is a bit beyond a minor oversight.

Note that GET requests should be side-effect free. Not just idempotent. That means a GET request that turns your lights on, or opens your garage door (which is idempotent) is still wrong.

Isn't that what idempotent means? You can't exactly open the garage if its already open.

https://developer.mozilla.org/en-US/docs/Glossary/Idempotent

In general, an idempotent method is a method such that calling it one time is the same as calling it n times in a row for any n > 1. However, idempotency doesn't require that calling the method one time is the same as calling it zero times, although such a method isn't excluded from the definition either. So a stateless method is necessarily idempotent, but an idempotent method isn't necessarily stateless.

From your example:

> DELETE /idX/delete HTTP/1.1 is idempotent, even if the returned status code may change between requests:

So requesting to open the garage door multiple times which results in an open garage door in the end is an idempotent request, even though after the second request the response is "I am already open!"

Now, a request to toggle the state of the garage door would not be idempotent. The state of the system is different if you call it an odd or even amount of times.

> Note that GET requests should be side-effect free.

Not quite. If a GET request is side-effect free then it won't be logged (since that is a side effect).

GET requests aren't supposed to modify state. Logging is a side-effect but it isn't usually considered to be stateful. Changing the state (on/off) of a lightbulb is definitely against the standard requirements for a GET request.

Logging is stateful, though the state usually isn't observable via HTTP requests. Of course the same is true of the light bulb, unless another API is provided to read its status, and a similar API could be provided for the log files. Or a script could toggle a light bulb in response to the logging.

Perhaps a better way to express this is that user agents are permitted to turn one GET request into N GET requests (N >= 1), and can also issue GET requests without user interaction (e.g. for preloading). When this happens the system should still meet its (customer / end-user) requirements. The requirements related to logging are that every request is logged, so it makes sense to record each GET request separately. The requirements for the light bulb are that one user interaction (not one GET request) equals one state change, so updating the state in response to each GET request doesn't meet the requirements. Even if the API were explicitly "turn on" or "turn off" rather than "toggle" you still wouldn't want the state to be affected by preloading, and you could get odd results if opposing requests were repeated (interleaved).

Nothing will fix all crap hardware, so we have to live with it and solutions like this prevent crap hardware from being accessed and abused even if it remains crap forever (since it will remain crap).

I'd wager the ratio of people who have at least one item of IoT junk to the number of people who have a legit setup that requires allowing cross site access to a local resource from a remote one is probably ten million to one. Who are these "everyone else" who are controlling their LAN devices from a public website who are going to suffer an evening setting up CORS?

edit: what I can see breaking is stuff like Synology QuickConnect https://global.download.synology.com/download/Document/Softw...

Also services using split horizon DNS: i.e. it is publicly available service, but only when used from outside. When used from inside, it is not routed through public interface, but resolved directly to it's internal IP.

I'm pretty sure I'm lacking experience in administering a huge network to spot the obvious? problem, but for smaller setups I've never understood why you would do this anyway and not treat it as "external first" by putting it in a sort of DMZ and treat your internal users as "quasi-external" ones by routing them into the DMZ via another means...

Of course this has the downside if you have actual 'internal only' stuff, but those could be separated from the split stuff... Just too much work with years (decades) old setups?

In DMZ, it still has an IP from private range, ergo, still treated as internal -- it doesn't matter whether it is in the same subnet as your users, only whether it falls into the range that the browser considers private.

So it doesn't solve anything here.

Maybe our understanding of DMZ is different, for me it's not necessarily with an internal IP - so to clarify, what I meant was hosting it on-premise, but only accessible via it's public IP (as the service is public anyway), which shouldn't be slower if your physical route isn't any longer.

At bigger, established corporations, I've seen internal web apps that need external access available set up this way, but when accessed via the public IP, a second auth factor is required. IIRC, MS Exchange's web interface was the most smooth, where the only difference to the end user was an additional field for the MFA code.

If an organization is using the "BeyondCorp" approach, it doesn't seem relevant, but that's tough to bolt onto large, complex existing environments IMO.

Edit: just to clarify, the advantage is similar to what "BeyondCorp" gets you - end users just need to remember the one URL, regardless of where they're connecting from.

good point, I hadn't thought of that because I personally never had that. yeah

I use split horizon networking to, eg, provide public DNS entries to a public canary server. Then on the private network a different DNS server provides correct (LAN-only) addresses. This way I can see if/when private hostnames are leaked to some entity.

I have about two dozen devices on my private LAN so I wouldn't consider myself to be "big" or "enterprise".

The setup is fairly unusual though because most users (and unfortunately many developers) lack the technical know-how for it.

> edit: what I can see breaking is stuff like Synology QuickConnect https://global.download.synology.com/download/Document/Softw...

Goooooood. I hate this thing with a passion since I had to set it up for a computer illiterate friend.

  > just by clicking this link, my lights turn on

Wasn't working for me, so I added an entry to my hosts file directing it to 127.0.0.1.

Now I don't know what's happening with _your_ lights, but when I click that link my own lights come on.

No idea why this obvious joke was downvoted tbh :P

A dress-up localhome joke? Hey, at least it was one I hadn’t heard.

(Cracked a localhome joke in for my first IT job interview. Manager laughed, Engineering Manager rolled his eyes.)

Couldn't a malicious page use an IMG URL to issue the GET request, as in <img src="http://lighting.londons_explorer/cm?POWER%20ON">?

Yes

Wee! I think I'll add that to my repo so you'll know when you're looking at my code. :)

Been following this for a while; I'm really surprised it's taken so long for browsers to begin to address this problem. It's kinda crazy that random websites can just send any HTTP request they want to your private network or local PC with no restrictions; that's a pretty huge attack surface to expose to the public internet.

Even this measure by Chrome is extremely limited, as it sounds like they're only blocking insecure (HTTP) sites from making requests to your private network. HTTPS sites are unaffected (for now).

So would this be like creating a public webpage called “help troubleshoot my router”, and having that webpage serve up malicious JavaScript which attempts to attack my routers local web server?

Reply on news.ycombinator.com