Google Chrome Automatic File Download

[nerex@live.com]

Google's Chrome (BETA) allows files (e.g. executable files) to be automatically downloaded to the user's computer without any user prompt.

To check the flaw, open a URL that points to an executable file.

nerex

[Razi Shaban]

On 2 Sep 2008 22:58:27 -0000, nerex@live.com <nerex@live.com> wrote:
> Google's Chrome (BETA) allows files (e.g. executable files) to be automatically downloaded to the user's computer without any user prompt.
>
> To check the flaw, open a URL that points to an executable file.
>
> nerex
>

There's a huge difference between downloading and running. If a file
that is unwanted is auto-downloaded, just delete it. No harm done.


--
Razi

[James C. Slora Jr.]

Razi Shaban wrote Wednesday, September 03, 2008 2:04 PM

> There's a huge difference between downloading and running.
> If a file that is unwanted is auto-downloaded, just delete it.
> No harm done.

Unapproved download does open exploit vectors against other
vulnerabilities, especially when the download is to a location the
attacker can predict.

Merely opening a folder in a GUI triggers exploitable actions such as
icon display. Desktop.ini in Windows triggers actions when its
containing folder is opened. Selecting a file to delete it can trigger
other exploitable actions. Anti-virus scans and other automatic
processes can be exploited by the download or even the mere presence of
some hostile files.

There is plenty of actual malware in the wild that only needs you to
touch the file or scan it with AV or list it in the GUI to be owned,
depending on companion vulnerabilities.

Some vulnerability exploits are mitigated by their need to access a
local file from a known location. Automatic file downloading to a
predictable location eliminates that mitigation.

So users should always be prompted when content is copied to any
location other than their browser cache, and higher-risk file types
should not even go to the cache without giving the user a fighting
chance to refuse the file.

[Nick FitzGerald]

DIOGO LEAL CHAGAS wrote:

> To "fix" this "problem":
>
> In Google chrome
> Tools -> Options -> Minor Tweaks (tab) in download location: check the "ask where to save each file before downloading"

Yes, yes, yes...

_BUT_, in a browser announced with such a massive hoopla about how it's
been double-especially-extra-security-hardened from the outset, _that
something more obviously sensible_ was not the _shipping default
configuration_ is gob-stoppingly stupid; a fundamentally noob-ish design
error.

In short, something that does not bode well for the product living up to
the marketing hype.

Oh, and slapping the standard "we're Google so couldn't be arsed
finishing it so will call it beta" label on it makes no difference.
Fundamentally stupid is fundamentally stupid at whatever point in the
development process that "feature" made its way into the product.


Regards,

Nick FitzGerald