Serious security risk in modern browsers

[shadowmanwkp]

Red alert for most browsers, there seems to be a serious security risk in modern browsers that use webgl, a fairly recent technology. The browsers that mainly use this technology are firefox and google chrome.

In order to deliver advanced graphics and 3D rendering from the Web without introducing lag and impacting performance, WebGL interacts with the graphics driver at a core level. The low-level functionality of the graphics processor has always been shielded from executable code, and was not designed with security in mind.

A new report that is based on continued research by Context, points out that webgl can pose a serious risk to a computer. Other testings have been done to determine if the actions taken by Khronos and browser vendors actually work to make WebGL safe. However, current updates do not remedy the problems. Web browsers that enable WebGL by default pose a security risk. In a nutshell, it appears that all browsers with webgl support are vulnerable to webgl exploits and should be disabled immediately.

You can find instructions on how to disable webgl in firefox and google chrome here
If you are on a mac and use google chrome you also need automator to add the arguments, info on that here
(do not copy and paste the parameters! you only need to add the parameter that disables webgl that you can find in the link above!)[/p]

Source 1 (news report)
Source 2 (findings by context, contains tech-talk)

 

[Anakir]

inb4lulzsec.

 

[Nathan Drake]

So basically, stop using the internet is the message I'm getting, as other browsers like IE aren't exceptionally safe themselves.

 

[stinkoman]

So basically, stop using the internet is the message I'm getting, as other browsers like IE aren't exceptionally safe themselves.

Opera. From what I've read WebGL's only in Development Releases.

 

[Nathan Drake]

It's in development releases of Opera and Safari.
I hate both of those browsers. I'll stick with the one that may kill my computer.

Oh, hey, look, this shit being unsafe isn't even anything new.

WebGL was shown to have fundamental security vulnerabilities in May 2011 enabling both denial of service and cross scripting attacks.

The actual sentence is from Wikipedia. The article with said info is here - Source: http://www.contextis.co.uk/resources/blog/webgl/

At least the sources from Wikipedia are reliable for what they have.

 

[shadowmanwkp]

Most browsers can disable webgl. In firefox for example you can go to about:config (just type it in your address bar and ignore the warning), then search for webgl.disabled it is false by default (thus it is on), but by double-clicking it, you can set it to true and disable the feature.

 

[Nathan Drake]

Most browsers can disable webgl. In firefox for example you can go to about:config (just type it in your address bar and ignore the warning), then search for webgl.disabled it is false by default (thus it is on), but by double-clicking it, you can set it to true and disable the feature.

Is there really any loss when disabling it? From what I've read WebGL as a whole is really new (premiering for FF in Firefox 4 judging by the date of release), so I'm not sure just how well it is utilized.

 

[s4mid4re]

Most browsers can disable webgl. In firefox for example you can go to about:config (just type it in your address bar and ignore the warning), then search for webgl.disabled it is false by default (thus it is on), but by double-clicking it, you can set it to true and disable the feature.

Is there really any loss when disabling it? From what I've read WebGL as a whole is really new (premiering for FF in Firefox 4 judging by the date of release), so I'm not sure just how well it is utilized.


Here's a quote from the OP's first source link:QUOTE

In a nutshell, it appears the answer is "no". What is the risk? In order to deliver advanced graphics and 3D rendering from the Web without introducing lag and impacting performance, WebGL interacts with the graphics driver at a core level. The low-level functionality of the graphics processor has always been shielded from executable code, and was not designed with security in mind. WebGL exposes the low-level core functions of the system to possible malicious exploits.

I guess it's just for enhancing performance

 

[shadowmanwkp]

Most browsers can disable webgl. In firefox for example you can go to about:config (just type it in your address bar and ignore the warning), then search for webgl.disabled it is false by default (thus it is on), but by double-clicking it, you can set it to true and disable the feature.

Is there really any loss when disabling it? From what I've read WebGL as a whole is really new (premiering for FF in Firefox 4 judging by the date of release), so I'm not sure just how well it is utilized.


Here's a quote from the OP's first source link:QUOTE

In a nutshell, it appears the answer is "no". What is the risk? In order to deliver advanced graphics and 3D rendering from the Web without introducing lag and impacting performance, WebGL interacts with the graphics driver at a core level. The low-level functionality of the graphics processor has always been shielded from executable code, and was not designed with security in mind. WebGL exposes the low-level core functions of the system to possible malicious exploits.

I guess it's just for enhancing performance

Some applications that rely on webgl will not function, but it is not necessary to turn it on. It has been stated several times in the first source that it is not necessary to turn it on. The first post is just a quick heads up for people and the sources go much deeper into the subject, I just wanted to avoid tech talk.

 

[SamAsh07]

Thanks for the news

Just removed Google Chrome. Does IE9 also use WebGL?

 

[cwstjdenobs]

Thanks for the news

Just removed Google Chrome. Does IE9 also use WebGL?

Nope. But nothing is really using WebGL yet anyhows, so just turning it off in chrome should be good enough.

Also am I reading the sources wrong, or does it say this doesn't affect Linux? EDIT: Yes I was. That was just the DoS case.

 

[shadowmanwkp]

Thanks for the news

Just removed Google Chrome. Does IE9 also use WebGL?

Nope. But nothing is really using WebGL yet anyhows, so just turning it off in chrome should be good enough.

Also am I reading the sources wrong, or does it say this doesn't affect Linux?

This is what context has found on ubuntu: Screen goes black after a few seconds and then recovers.Conformance Results Failures (out of 144 tests): chrome 4 times, firefox 21 times. This means linux is affected. Do note that it might be more severe than this, because we do not fully know what can be done with the exploit.

Edit: ninja got ninja'ed

 

[david432111]

A new report that is based on continued research by Context, points out that webgl can pose a serious risk to a copmuter. Other testings have been done to determine if the actions taken by Khronos and browser vendors actually work to make WebGL safe. However, current updates do not remedy the problems. Web browsers that enable WebGL by default pose a security risk. In a nutshell, it appears that all browsers with webgl support are vulnerable to webgl exploits and should be disabled immediately. [/p]

I don't have a copmuter, so I think I'm safe.

 

[R2DJ]

Can anyone tell me how to disable WebGL on Chrome on a Mac? Thanks

 

[shadowmanwkp]

A new report that is based on continued research by Context, points out that webgl can pose a serious risk to a copmuter. Other testings have been done to determine if the actions taken by Khronos and browser vendors actually work to make WebGL safe. However, current updates do not remedy the problems. Web browsers that enable WebGL by default pose a security risk. In a nutshell, it appears that all browsers with webgl support are vulnerable to webgl exploits and should be disabled immediately. [/p]
I don't have a copmuter, so I think I'm safe.

Ah dammit, after all those edits still slipped through, it's fixed now.

QUOTE(R2DJ @ Jun 17 2011, 12:58 PM)

Can anyone tell me how to disable WebGL on Chrome on a Mac? Thanks

Just found a good link explaining it for both FF and chrome: http://techtrickz.com/how-to/disable-webgl...fox-quick-tips/ you can also find it in the first post. I don't use a mac personally, but you can probably use the same trick here.

Edit: woop-tee-doo I was wrong, you actually need a separate program for that, you can read all about it here: http://superuser.com/questions/271678/how-...s/271697#271697
The only thing you need to do is change the arguments a bit.

 

[naved.islam14]

Thank You, I don't want my laptop to be hacked.

 

[Hop2089]

Webgl has been disabled.

Nice find there and quite easy to do.

 

[Slyakin]

Yeah, I disabled webgl as well, but I don't want to see a loss in performance...

Does anyone have examples of websites that use webgl?

 

[WiiUBricker]

I can't find webgl.disabled in the firefox config.

 

[Slyakin]

I can't find webgl.disabled in the firefox config.

In the bar near the top of the page, search "webgl"