7 ms·

Probably through RCE-s in Windows XP’s TCP/IP stack implementation.

by GrumpySloth 3y ago

Wowfunhappy 3y ago
What CVE(s) in the TCP/IP could be used for this?
- GrumpySloth 3y ago
  A quick search led me to CVE-2010-2568, which isn’t in TCP/IP[1], but is an RCE vulnerability that could be triggered by a website triggering a file download and the user later opening the folder with the downloaded file in Windows Explorer. Windows XP with Service Pack 3 is vulnerable. [1]: The CVE database has to have the worst search out of all bug trackers I’ve ever used. (I think using older versions of Windows is fine. But under no circumstances would I connect them to the internet.)
  - Wowfunhappy 3y ago
    Right, but that requires downloading a file, which on an older OS you shouldn't do except from sources you absolutely trust. I really don't think there's anything wrong with browsing the internet.
    - GrumpySloth 3y ago
      Downloading a file is something that happens automatically when you e.g. navigate (or are automatically redirected) to a link which is served with Content-Type of application/octet-stream. Example: <https://0x0.st/H7bb.bin https://0x0.st/H7bb.bin>. If you don’t modify your browser somehow, it’s not something you as a user can protect yourself against.
      - Wowfunhappy 3y ago
        Hmm. It looks like files with the .lnk or .pif file extension can only be downloaded on a user gesture: https://chromium.googlesource.com/chromium/src/+/39841e54180e2583dffa16fbbb9b99fd293821d0/chrome/browser/download/download_extensions.cc#:~:text=%7B%22-,lnk,-%22%2C%20ALLOW_ON_USER_GESTURE https://chromium.googlesource.com/chromium/src/+/39841e54180... So it can't be done silently. Although, I do wish the type was marked "DANGEROUS" a la dll files.
      - jasomill 3y ago
        Not that I'd recommend browsing on an older, unpatched OS, but the modification in question is easy, and IMO worth the extra single click or keypress it introduces in exchange for eliminating "drive-by downloads" from questionable sites. Chrome: Settings → Downloads → check "Ask where to save each file before downloading". Edge: Settings → Downloads → check "Ask me what to do with each download". Firefox: Settings → General → under "Files and Applications", check "Always ask you where to save files". Safari (macOS): Settings → General → as "File download location", choose "Ask for each download". While you're here, uncheck "Open “safe” files after downloading" (Apple scare quotes "safe" appropriately, yet AFAIK still enables this option by default, even after it's been a factor in multiple exploits over the years).

Probably through RCE-s in Windows XP’s TCP/IP stack implementation.

Wowfunhappy 3y ago

What CVE(s) in the TCP/IP could be used for this?

GrumpySloth 3y ago
A quick search led me to CVE-2010-2568, which isn’t in TCP/IP[1], but is an RCE vulnerability that could be triggered by a website triggering a file download and the user later opening the folder with the downloaded file in Windows Explorer. Windows XP with Service Pack 3 is vulnerable. [1]: The CVE database has to have the worst search out of all bug trackers I’ve ever used. (I think using older versions of Windows is fine. But under no circumstances would I connect them to the internet.)
- Wowfunhappy 3y ago
  Right, but that requires downloading a file, which on an older OS you shouldn't do except from sources you absolutely trust. I really don't think there's anything wrong with browsing the internet.
  - GrumpySloth 3y ago
    Downloading a file is something that happens automatically when you e.g. navigate (or are automatically redirected) to a link which is served with Content-Type of application/octet-stream. Example: <https://0x0.st/H7bb.bin https://0x0.st/H7bb.bin>. If you don’t modify your browser somehow, it’s not something you as a user can protect yourself against.
    - Wowfunhappy 3y ago
      Hmm. It looks like files with the .lnk or .pif file extension can only be downloaded on a user gesture: https://chromium.googlesource.com/chromium/src/+/39841e54180e2583dffa16fbbb9b99fd293821d0/chrome/browser/download/download_extensions.cc#:~:text=%7B%22-,lnk,-%22%2C%20ALLOW_ON_USER_GESTURE https://chromium.googlesource.com/chromium/src/+/39841e54180... So it can't be done silently. Although, I do wish the type was marked "DANGEROUS" a la dll files.
    - jasomill 3y ago
      Not that I'd recommend browsing on an older, unpatched OS, but the modification in question is easy, and IMO worth the extra single click or keypress it introduces in exchange for eliminating "drive-by downloads" from questionable sites. Chrome: Settings → Downloads → check "Ask where to save each file before downloading". Edge: Settings → Downloads → check "Ask me what to do with each download". Firefox: Settings → General → under "Files and Applications", check "Always ask you where to save files". Safari (macOS): Settings → General → as "File download location", choose "Ask for each download". While you're here, uncheck "Open “safe” files after downloading" (Apple scare quotes "safe" appropriately, yet AFAIK still enables this option by default, even after it's been a factor in multiple exploits over the years).