|
contents | software | |||||||
| More Security Problems for WebGL Researchers at Context Information Security who exposed security flaws in WebGL last month have identified further concerns about early implementations of the new technology that allows web pages to draw fast 3D graphics to deliver a much richer experience to web users. In one example, a vulnerability in the Mozilla Firefox browser made it possible for malicious web pages to capture any screenshot from a target PC – including the user's desktop, other web pages or applications. By revealing that none of the current implementations comply with WebGL conformance standards, Context also raises serious questions for Khronos, the consortium which has drawn up the WebGL specification and conformance tests. The findings are published along with videos in a Context blog Context's original investigations discovered design level security issues that provide a 'back-door' to low-level parts of the operating system via some graphics cards, which were never designed to defend against this type of threat. Following further investigations, Context researchers have discovered that neither Chrome nor Firefox passed the 144 Khronos conformance tests for WebGL, including a number that are directly related to security. "While Mozilla has taken steps to mitigate the original vulnerabilities and will fix this latest threat in the new version of its browser, scheduled for release on 21 June, we believe this is the tip of the iceberg for the difficult adoption of this immature technology, leaving users vulnerable", says Michael Jordon, Research and Development Manager at Context. "The fact that security-related Khronos conformance tests are not clearly identified has been a contributory factor in security issues being missed by developers of the current browser implementations of WebGL", adds Jordon. "It would be unreasonable to expect full conformance to the complete specification of any new standard but some areas of WebGL need to be carefully implemented to prevent security issues arising. Browser developers should now start banning non-conformant configurations as they are identified until the security issues that have been highlighted are resolved." Context's research also found that Khronos' recommended defence against the Denial of Service issue, WebGL_ARB_robustness, is not fit for purpose. It is only supported by certain chipsets and operating systems such as NVidia on Windows and Linux, and the extension only offers mitigation and not a comprehensive solution to WebGLDoS issues. The risks from WebGL depend on the web browser, operating system and graphics card being used. WebGL is currently supported only on Firefox and Chrome and currently users of Internet Explorer, Safari or Opera are not vulnerable to WebGL issues. "We would advise anyone at risk to disable WebGL until the security vulnerabilities have been addressed", added Jordon. "We have been working with developers of the Firefox plug-in NoScript to include support to selectively disable WebGL and would recommend this plug-in to protect users from malicious Internet content." write your comments about the article :: © 2011 Computing News :: home page |