Vladimir Palant, creator of Adblock Plus, () in the Chromium-based specialized web browser Safepay, offered as part of the Bitdefender Total Security 2020 antivirus package, aimed at enhancing user security while browsing the global network (for example, providing additional isolation when accessing banks and payment systems). The vulnerability allows websites opened in the browser to execute arbitrary code at the operating system level.
The root of the problem is that the Bitdefender antivirus performs local interception of HTTPS traffic by substituting the original TLS certificate of the website. An additional root certificate is installed on the client’s system, allowing the traffic inspection system to operate covertly. The antivirus injects its own JavaScript code into certain pages to implement the Safe Search feature, and in case of a problem with the secure connection certificate, it replaces the error page with its own. Since the new error page is presented on behalf of the opened server, other pages of this server have full access to the content injected by Bitdefender.
When opening a site controlled by an attacker, this site can send an XMLHttpRequest and simulate an HTTPS certificate problem in the response, resulting in a page with an error substituted by Bitdefender. Since the error page is opened within the context of the attacker's domain, it can read the content of the substituted page containing Bitdefender parameters. The Bitdefender substituted page also includes a session key that allows launching a separate Safepay browser session using Bitdefender's internal API, specifying arbitrary command line flags to execute any system commands via the ‘--utility-cmd-prefix’ flag. An example exploit (param1 and param2 are values obtained from the error page):
var request = new XMLHttpRequest();
request.open('POST', Math.random());
request.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
request.setRequestHeader('BDNDSS_B67EA559F21B487F861FDA8A44F01C50', param1);
request.setRequestHeader('BDNDCA_BBACF84D61A04F9AA66019A14B035478', param2);
request.setRequestHeader('BDNDWB_5056E556833D49C1AF4085CB254FC242', 'obk.run');
request.setRequestHeader('BDNDOK_4E961A95B7B44CBCA1907D3D3643370D', location.href);
request.send("data:text/html,nada —utility-cmd-prefix=\"cmd.exe /k whoami & echo\"");
Recall that a study conducted in 2017 , found that 24 out of 26 tested antivirus products, inspecting HTTPS traffic through certificate substitution, reduced the overall security level of HTTPS connections.
Current cipher suites were provided only in 11 out of 26 products. 5 systems did not perform certificate verification (Kaspersky Internet Security 16 Mac, NOD32 AV 9, CYBERsitter, Net Nanny 7 Win, Net Nanny 7 Mac). Kaspersky Internet Security and Total Security products were vulnerable to attacks , while AVG, Bitdefender and Bullguard products were susceptible to attacks and . Dr.Web Antivirus 11 allows reverting to insecure export ciphers (attack ).
Source: opennet.ru
