Chrome Attack Trap Falls Flat

Wednesday, March 14, 2012 @ 02:03 PM gHale


There are limitations and then there are limitations, and one just built into Google Chrome to detect and block Flash Player exploits ended up breaking certain Flash-based applications and games for some users.

Suspecting that someone would try to hack Chrome via a Flash exploit at this year’s Pwn2Own contest, the browser’s developers decided to restrict the maximum allowed size of Flash JIT (just-in-time) pages to a value that such exploits would likely exceed. Pwn2Own was a contest at the recent CanSecWest conference where contestants could earn cash prizes if they can hack into various browsers.

RELATED STORIES
Browsers Fall in Hacking Contest
Safari Vulnerabilities Revealed
Chrome Falls, IE Follows
Google Fixes Chrome Vulnerabilities

They wrote the restriction in such a way that when an attacker reached the new limit the browser would throw an “access violation” exception that referenced memory address “0xABAD1DEA,” a hexadecimal value spelling out “a bad idea.”

The limit came online Feb. 23 and first tested out in the browser’s Canary (nightly build) version. They later tweaked the limit because of a considerable number of crash reports and landed in Chrome stable version 17.0.963.66 on March 6.

Some of the Pwn2Own contestants did stumble over the Flash JIT page restriction. Nicolas Joly, a member of the VUPEN Security team, which eventually won the hacking contest, said on Twitter he encountered 0xABAD1DEA exceptions during his tests.

Google Chrome security engineer Justin Schuh said he was the one who put it there in order to detect Flash exploits. “0xABAD1DEA was a breadcrumb I added that’s unique to Flash,” he said.

Schuh later clarified it wasn’t just a trap, but also a mitigation, although he added it was a weak one. The VUPEN Team eventually managed to work their way around the restriction and hacked Chrome during the contest.

However, Google’s half-mitigation, half-trap code caused more problems than it solved, because it ended up interfering with the normal operation of some legitimate Flash-based applications and games, like Sims Social, Audiotool and Paychex Online.

According to reports on the Google Chrome support forum, users started experiencing Flash Player crashes referencing 0xABAD1DEA after they upgraded to Chrome version 17.0.963.66.

Changes aimed at addressing the problem are in Chrome version 17.0.963.79, which released on Saturday, a Google employee said in response to the reports. However, some users still experienced 0xABAD1DEA-related crashes after upgrading to it.



Leave a Reply

You must be logged in to post a comment.